All three run OCI images. The difference is what you have to install, run, and babysit to keep them working.
| Feature | cardinal | Docker | Podman |
|---|---|---|---|
| Daemon | None — one binary talks to the kernel | dockerd always running | None (per-container, rootless) |
| Binary size | ~5 MB static | ~100+ MB client + daemon | ~50 MB + optional podman service |
| Image format | OCI / Docker V2 | OCI / Docker V2 | OCI / Docker V2 |
| Bridge network | cardinal0 · 10.0.2.0/24 | docker0 | podman bridge |
| Compose | cardinal.toml + compose YAML | docker-compose | podman-compose |
| Auto-start | systemd supervisor | systemd dockerd | systemd user units |
| Cluster orchestration | Built in | Docker Swarm | — (pods only) |
| FaaS / serverless | Built in | — | — |
| Web console / terminal | cardinal console built-in | External tools | External tools |
| Seccomp / AppArmor | Default + custom | Default + custom | Default + custom |
| Encrypted backups | AES-256-GCM built-in | — | — |
| Audit logging | Built in | — (auditd integration) | — (journald) |
| Blueprint registry | 27 one-command templates | — | — |
| Rootless | Yes (newuidmap) | Partial (rootless mode) | Native |
| Docker API compatible | cardinal serve | Native | podman socket |
You want one small binary on a VPS, containers that come back after a reboot without a daemon, and cluster/FaaS capabilities without installing a second product.
You're on a team that already standardised on Docker tooling, need the vastest ecosystem of third-party integrations, or rely on Docker Desktop for local development.
You want a daemonless, rootless experience with a Docker-compatible CLI on RHEL-family systems, and you don't need built-in clustering or FaaS.
The table is one thing — five minutes with the real binary is another. Install in one line and run your first container.
Install cardinal