Build systemd-sysext image as part of image build and publish as release artifact and as signed update payload.
/etc/subuid/ and /etc/subgid should be provided by the Flatcar base image.

For usage after the boot, add a oneshot service (set remainafterexit, with a drop-in for multi-user.target that Upholds= this helper service) which prepares the system. The helper should copy a default content to /etc/containers/policy.json if it doesn't exist, maybe issue udevadm control --reload-rules, udevadm trigger, and (another) systemctl daemon-reload to trigger the quadlet systemd generator and then reevaluate the common targets to start the enabled quadlet (podman generator) units: systemctl restart --no-block sockets.target timers.target multi-user.target. Once we set up the extensions from the initrd, we can say that only initrd activation is supported and then skip the udevadm and daemon-reload workarounds.

Old content:

libpod (podman)
Libpod provides a library for applications looking to use the Container Pod concept, popularized by Kubernetes. Libpod also contains the Pod Manager tool (Podman). Podman manages pods, containers, container images, and container volumes.

• Package upstream repo: https://github.com/containers/libpod
• Gentoo ebuild: https://packages.gentoo.org/packages/app-emulation/libpod

Impact of adding this package to the Flatcar OS image

• [ * ] This package meets the requirements of Flatcar Container Linux’ new package guidelines: https://github.com/flatcar-linux/Flatcar/blob/master/adding-new-packages.md

• The package improves on the following core values:

  • [ * ] Secure by default
  • [ ] Always up to date
  • [ * ] Improve container experience
  • [ * ] Operate at scale / automation / telemetry

The package will increase the OS image by: ?

The package will potentially increase Flatcar’s attack surface:

• It should decrease attack surface by removing the container runtime's daemon.

Benefits of adding this package to the Flatcar OS image
CRI compatible container runtime make a lot of sense when you're running something to orchestrate your containers, Kubernetes namely.

Having a tool to run containers not in a k8s environment, would help adoption of FlatCar for all other use cases.
podman integrates easily with systemd unit, and also enable users to run rootless containers, increasing security.