@@ -40,6 +40,29 @@ ai-studio-cli setup dependencies
 
 > If the installation of drivers occurs, the system reboots at the end of Phase 1.
 
+**Choosing a container runtime (Docker / Podman)**
+
+Phase 1 installs the NVIDIA Container Toolkit and configures GPU access for the
+container runtime of your choice. Select it with `--runtime`:
+
+```bash
+# Docker (default) — configures the NVIDIA container runtime
+ai-studio-cli setup dependencies --runtime docker
+
+# Podman — generates a CDI spec (/etc/cdi/nvidia.yaml) and installs podman
+ai-studio-cli setup dependencies --runtime podman
+
+# Both
+ai-studio-cli setup dependencies --runtime both
+```
+
+The toolkit package is identical for both; only the access mechanism differs —
+Docker uses the NVIDIA container runtime, while Podman uses the Container Device
+Interface (CDI). With Podman, run GPU containers via
+`podman run --device nvidia.com/gpu=all ...`. The CDI spec is regenerated
+automatically after driver updates/reboots when the `nvidia-cdi-refresh`
+service is available (NVIDIA Container Toolkit ≥ 1.18).
+
 **Phase 2 — Build nvbandwidth**
 
 Run this to verify drivers, clone `nvbandwidth` from GitHub, and compile it.
@@ -50,10 +73,17 @@ ai-studio-cli setup nvbandwidth
 
 **Phase 3 — Install vLLM Dependencies (Optional)**
 
-If you intend to run inference benchmarks using the Docker fallback strategy, you must install Docker Engine and the NVIDIA Container Toolkit.
+If you intend to run inference benchmarks using the container fallback strategy, you must install a container runtime and the NVIDIA Container Toolkit. Choose the runtime with `--runtime` (default `docker`):
 
 ```bash
+# Docker (default)
 ai-studio-cli setup vllm
+
+# Podman — installs podman + podman-compose and generates a CDI spec
+ai-studio-cli setup vllm --runtime podman
+
+# Both
+ai-studio-cli setup vllm --runtime both
 ```
 
 ---
@@ -114,7 +144,7 @@ The `bench` subcommand provides an automated way for testing LLM serving perform
 
 ### Quick Start — Zero-Config Benchmark
 
-The CLI comes bundled with a default, optimized `docker-compose.yaml` (configured for `Qwen2.5-32B-Instruct` with FP8 and PP-4 and TP-1). If you don't provide a compose file, it will use this default automatically:
+The CLI comes bundled with a default, optimized compose file (configured for `Qwen2.5-32B-Instruct` with FP8 and PP-4 and TP-1). If you don't provide a compose file, it will use this default automatically:
 
 ```bash
 # Simplest case — uses the built-in default compose
@@ -124,6 +154,17 @@ ai-studio-cli bench --requests 200 --concurrency 20 --max-tokens 1024
 ai-studio-cli ab-bench --requests 200 --concurrency 20 --max-tokens 1024
 ```
 
+#### Container runtime (Docker or Podman)
+
+The `bench`, `ab-bench`, and `vllm` commands work with either runtime. By default the runtime is **auto-detected** (Docker preferred, then Podman); override it with `--runtime`:
+
+```bash
+# Force Podman — uses podman-compose and CDI device passthrough
+ai-studio-cli bench --runtime podman --requests 200 --concurrency 20
+```
+
+Under Podman the bundled compose file is automatically adapted (the GPU `deploy.resources` reservation is rewritten to the CDI `devices: [nvidia.com/gpu=all]` form, which `podman-compose` understands). If you supply your *own* `--compose-file` for Podman, use the CDI device syntax yourself.
+
 To keep the server running after the benchmark (e.g., for follow-up runs):
 ```bash
 ai-studio-cli bench --keep-server --requests 200
@@ -140,7 +181,7 @@ ai-studio-cli bench --compose-file docker-compose.yaml --requests 200 --concurre
 
 ### Prerequisites (One-Time Setup)
 
-Before running benchmarks with the built-in vLLM server, ensure you have **Docker Engine** and the **NVIDIA Container Toolkit** installed on your system. 
+Before running benchmarks with the built-in vLLM server, ensure you have a container runtime (**Docker Engine** or **Podman** + `podman-compose`) and the **NVIDIA Container Toolkit** installed. Run `ai-studio-cli setup vllm --runtime <docker|podman|both>` to install them. 
 
 ### Manual Server Management
 
@@ -192,7 +233,7 @@ ai-studio-cli bench --endpoint http://<ip>:<port> --dataset sharegpt --dataset-p
 
 The benchmarking tool automatically determines the best way to run the test:
 1. **Local Execution**: If `vllm` is installed locally in your Python environment (e.g., via `pip install vllm`), it will run the benchmark natively to avoid overhead.
-2. **Docker Fallback**: If `vllm` is missing (common on fresh nodes), it automatically falls back to pulling and running the `vllm/vllm-openai:latest` Docker image. The Docker container uses host networking to reach your inference server.
+2. **Container Fallback**: If `vllm` is missing (common on fresh nodes), it automatically falls back to pulling and running the `vllm/vllm-openai:latest` image with the active runtime (Docker or Podman, per `--runtime`). The benchmark client container uses host networking to reach your inference server (no GPU is requested — the client is a plain load generator).
 
 ### Auto-Detection & Structured Results
 
 
@@ -65,7 +65,8 @@ func init() {
 	abBenchCmd.Flags().IntVar(&abRequests, "requests", 1000, "Total number of requests to send (-n)")
 	abBenchCmd.Flags().StringVar(&abOutputFile, "output", "", "Write ab gnuplot output to this file (ab -g flag); empty = skip")
 	abBenchCmd.Flags().StringArrayVar(&abExtraArgs, "ab-arg", nil, "Additional raw argument for ab; can be repeated (advanced: do not interpolate untrusted input)")
-	abBenchCmd.Flags().StringVar(&abComposeFile, "compose-file", "", "Path to a custom docker-compose.yml; uses bundled default if server is unreachable and this is unset")
+	abBenchCmd.Flags().StringVar(&abComposeFile, "compose-file", "", "Path to a custom compose file; uses bundled default if server is unreachable and this is unset")
+	abBenchCmd.Flags().StringVar(&containerRuntime, "runtime", "auto", "Container engine: auto, docker, or podman")
 	abBenchCmd.Flags().BoolVar(&abKeepServer, "keep-server", false, "Leave the vLLM server running after the benchmark completes")
 	abBenchCmd.Flags().IntVar(&abServerTimeout, "server-timeout", 900, "Maximum seconds to wait for the vLLM server to become ready (default allows for large model load times)")
 
 
@@ -96,8 +96,9 @@ func (r *benchRunner) registerFlags(cmd *cobra.Command) {
 	cmd.Flags().StringArrayVar(&r.additionalArgs, "vllm-arg", nil, "Additional raw argument for vllm bench serve; can be repeated (advanced: do not interpolate untrusted input)")
 	cmd.Flags().StringVar(&r.gpuTag, "gpu-tag", "", "GPU tag for structured result path (auto-detected if empty)")
 	// Server lifecycle flags
-	cmd.Flags().StringVar(&r.server.vllmImage, "vllm-image", "vllm/vllm-openai:latest", "Docker image to use for benchmarking if vllm is not installed locally")
-	cmd.Flags().StringVar(&r.server.composeFile, "compose-file", "", "Path to a custom docker-compose.yml; uses bundled default if server is unreachable and this is unset")
+	cmd.Flags().StringVar(&containerRuntime, "runtime", "auto", "Container engine: auto, docker, or podman")
+	cmd.Flags().StringVar(&r.server.vllmImage, "vllm-image", "vllm/vllm-openai:latest", "Container image to use for benchmarking if vllm is not installed locally")
+	cmd.Flags().StringVar(&r.server.composeFile, "compose-file", "", "Path to a custom compose file; uses bundled default if server is unreachable and this is unset")
 	cmd.Flags().BoolVar(&r.server.keepServer, "keep-server", false, "Leave the vLLM server running after the benchmark completes")
 	cmd.Flags().IntVar(&r.server.timeoutSec, "server-timeout", 900, "Maximum seconds to wait for the vLLM server to become ready (default allows for large model load times)")
 	// Dashboard
@@ -305,11 +306,12 @@ func (r *benchRunner) execute(ctx context.Context, args []string, structuredDir
 		return nil
 	}
 
-	if isDockerAvailable() {
-		return r.runInDocker(ctx, args, structuredDir)
+	engine := currentEngine()
+	if isContainerEngineAvailable(engine) {
+		return r.runInContainer(ctx, engine, args, structuredDir)
 	}
 
-	return fmt.Errorf("neither 'vllm' nor 'docker' commands found; please install vLLM locally or install Docker")
+	return fmt.Errorf("neither 'vllm' nor a container engine (%s) was found; install vLLM locally or install %s", engine.cli(), engine.cli())
 }
 
 // applyPromptDataset writes the --prompt string to a temporary JSONL file
@@ -347,33 +349,40 @@ func (r *benchRunner) applyPromptDataset(args *[]string) (func(), error) {
 	return func() { _ = os.RemoveAll(dir) }, nil
 }
 
-func (r *benchRunner) runInDocker(ctx context.Context, args []string, resultDir string) error {
-	if err := ensureImagePulled(ctx, r.server.vllmImage); err != nil {
+// runInContainer runs the vLLM benchmark client in a container when vLLM is not
+// installed locally. The client is a plain HTTP load generator (it talks to the
+// already-running server endpoint), so it does not request GPU access itself.
+func (r *benchRunner) runInContainer(ctx context.Context, engine containerEngine, args []string, resultDir string) error {
+	if err := ensureImagePulled(ctx, engine, r.server.vllmImage); err != nil {
 		return err
 	}
 
-	dockerArgs := []string{"run", "--rm", "--network", "host", "--entrypoint", "vllm"}
+	runArgs := []string{"run", "--rm", "--network", "host", "--entrypoint", "vllm"}
+	if engine.isPodman() {
+		// Avoid SELinux denials on bind-mounted dirs (no-op on AppArmor hosts).
+		runArgs = append(runArgs, "--security-opt=label=disable")
+	}
 
 	if absDir, err := filepath.Abs(resultDir); err == nil {
-		dockerArgs = append(dockerArgs, "-v", fmt.Sprintf("%s:%s", absDir, absDir))
+		runArgs = append(runArgs, "-v", fmt.Sprintf("%s:%s", absDir, absDir))
 	}
 
 	for i, arg := range args {
 		if arg == "--dataset-path" && i+1 < len(args) {
 			if absDataset, err := filepath.Abs(args[i+1]); err == nil {
 				datasetDir := filepath.Dir(absDataset)
-				dockerArgs = append(dockerArgs, "-v", fmt.Sprintf("%s:%s", datasetDir, datasetDir))
+				runArgs = append(runArgs, "-v", fmt.Sprintf("%s:%s", datasetDir, datasetDir))
 			}
 			break
 		}
 	}
 
-	dockerArgs = append(dockerArgs, r.server.vllmImage)
-	dockerArgs = append(dockerArgs, args...)
+	runArgs = append(runArgs, r.server.vllmImage)
+	runArgs = append(runArgs, args...)
 
-	fmt.Printf("Launching Docker: docker %s\n", shellJoin(dockerArgs))
+	fmt.Printf("Launching container: %s %s\n", engine.cli(), shellJoin(runArgs))
 
-	cmd := exec.CommandContext(ctx, "docker", dockerArgs...)
+	cmd := exec.CommandContext(ctx, engine.cli(), runArgs...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	cmd.Stdin = os.Stdin
@@ -489,16 +498,16 @@ func isVllmAvailable() bool {
 	return exec.Command("vllm", "--version").Run() == nil
 }
 
-func isDockerAvailable() bool {
-	return exec.Command("docker", "--version").Run() == nil
+func isContainerEngineAvailable(engine containerEngine) bool {
+	return exec.Command(engine.cli(), "--version").Run() == nil
 }
 
-func ensureImagePulled(ctx context.Context, image string) error {
-	if exec.CommandContext(ctx, "docker", "image", "inspect", image).Run() == nil {
+func ensureImagePulled(ctx context.Context, engine containerEngine, image string) error {
+	if exec.CommandContext(ctx, engine.cli(), "image", "inspect", image).Run() == nil {
 		return nil
 	}
 	fmt.Printf("Pulling %s (this may take a while on first run)...\n", image)
-	pull := exec.CommandContext(ctx, "docker", "pull", image)
+	pull := exec.CommandContext(ctx, engine.cli(), "pull", image)
 	pull.Stdout = os.Stdout
 	pull.Stderr = os.Stderr
 	return pull.Run()
 
@@ -11,7 +11,9 @@ import (
 //go:embed assets/docker-compose.yaml
 var defaultComposeFile []byte
 
-// generateComposeFile extracts the bundled docker-compose.yaml to a stable config directory.
+// generateComposeFile extracts the bundled compose file to a stable config
+// directory, adapting the GPU passthrough syntax to the active container
+// runtime (Docker reservation vs. podman CDI devices).
 func generateComposeFile() (path string, cleanup func(), err error) {
 	configDir, err := os.UserConfigDir()
 	if err != nil {
@@ -22,14 +24,21 @@ func generateComposeFile() (path string, cleanup func(), err error) {
 		return "", nil, fmt.Errorf("creating config dir: %w", err)
 	}
 
-	path = filepath.Join(dir, "docker-compose.yaml")
+	engine := currentEngine()
+	content := composeForRuntime(defaultComposeFile, engine)
+
+	name := "docker-compose.yaml"
+	if engine.isPodman() {
+		name = "podman-compose.yaml"
+	}
+	path = filepath.Join(dir, name)
 
 	needWrite := true
 	if existing, readErr := os.ReadFile(path); readErr == nil {
-		needWrite = !bytes.Equal(existing, defaultComposeFile)
+		needWrite = !bytes.Equal(existing, content)
 	}
 	if needWrite {
-		if err := os.WriteFile(path, defaultComposeFile, 0644); err != nil {
+		if err := os.WriteFile(path, content, 0644); err != nil {
 			return "", nil, fmt.Errorf("writing compose file: %w", err)
 		}
 	}
 
@@ -12,7 +12,7 @@ func serverLifecycle(composeFile, endpoint string, timeoutSec int, keepServer bo
 	if effectiveCompose == "" {
 		if !isVLLMReachable(endpoint) {
 			fmt.Println("No --compose-file provided and server is unreachable.")
-			fmt.Println("Starting vLLM using bundled default docker-compose.yaml...")
+			fmt.Printf("Starting vLLM using bundled default compose file (%s runtime)...\n", currentEngine().cli())
 			path, cleanup, err := generateComposeFile()
 			if err != nil {
 				return "", nil, fmt.Errorf("extracting default compose file: %w", err)
 
@@ -0,0 +1,130 @@
+package cmd
+
+import (
+	"os/exec"
+	"strings"
+)
+
+// containerRuntime selects the container engine for vLLM/bench operations.
+// Values: "auto" (default — detect installed engine), "docker", or "podman".
+// It is bound to the --runtime flag on the bench, ab-bench, and vllm commands.
+var containerRuntime = "auto"
+
+// containerEngine describes how to invoke compose and the container CLI for a
+// concrete runtime ("docker" or "podman").
+//
+// The two runtimes diverge in how compose is invoked and how GPUs are exposed:
+//   - Docker uses the `docker compose` plugin and the NVIDIA container runtime.
+//   - Podman uses the standalone `podman-compose` binary and CDI devices
+//     (`nvidia.com/gpu=all`). Note: `podman compose` (the subcommand that
+//     delegates to docker-compose) silently drops CDI devices, so we always
+//     shell out to `podman-compose` instead.
+type containerEngine struct {
+	rt string // "docker" | "podman"
+}
+
+// currentEngine resolves the active engine from the --runtime flag, falling
+// back to auto-detection (Docker preferred, then Podman).
+func currentEngine() containerEngine {
+	switch strings.ToLower(strings.TrimSpace(containerRuntime)) {
+	case "podman":
+		return containerEngine{rt: "podman"}
+	case "docker":
+		return containerEngine{rt: "docker"}
+	default: // auto
+		if commandAvailable("docker") {
+			return containerEngine{rt: "docker"}
+		}
+		if commandAvailable("podman-compose") || commandAvailable("podman") {
+			return containerEngine{rt: "podman"}
+		}
+		// Nothing detected — default to docker so callers surface a clear
+		// "docker not found" error rather than a confusing one.
+		return containerEngine{rt: "docker"}
+	}
+}
+
+func commandAvailable(bin string) bool {
+	_, err := exec.LookPath(bin)
+	return err == nil
+}
+
+// cli returns the container CLI binary (docker/podman) used for run/pull/inspect.
+func (e containerEngine) cli() string { return e.rt }
+
+// isPodman reports whether this engine is Podman.
+func (e containerEngine) isPodman() bool { return e.rt == "podman" }
+
+// composeArgv returns the binary and full argument list for a compose
+// subcommand against the given file.
+func (e containerEngine) composeArgv(file string, args ...string) (string, []string) {
+	if e.rt == "podman" {
+		full := []string{}
+		if file != "" {
+			full = append(full, "-f", file)
+		}
+		return "podman-compose", append(full, args...)
+	}
+	full := []string{"compose"}
+	if file != "" {
+		full = append(full, "-f", file)
+	}
+	return "docker", append(full, args...)
+}
+
+// composeCommand builds an *exec.Cmd for a compose subcommand against file.
+func (e containerEngine) composeCommand(file string, args ...string) *exec.Cmd {
+	bin, full := e.composeArgv(file, args...)
+	return exec.Command(bin, full...)
+}
+
+// composeDisplay returns a human-readable command string for logging.
+func (e containerEngine) composeDisplay(file string, args ...string) string {
+	bin, full := e.composeArgv(file, args...)
+	return bin + " " + strings.Join(full, " ")
+}
+
+// composeAvailable reports whether the compose tooling for this engine is
+// installed, returning a helpful message when it is not.
+func (e containerEngine) composeAvailable() (bool, string) {
+	if e.rt == "podman" {
+		if !commandAvailable("podman-compose") {
+			return false, "podman runtime selected but 'podman-compose' is not installed.\n" +
+				"  Install it with 'pip install podman-compose' (or 'apt-get install podman-compose'),\n" +
+				"  or provision with: ai-studio-cli setup vllm --runtime podman"
+		}
+		return true, ""
+	}
+	if !commandAvailable("docker") {
+		return false, "docker runtime selected but 'docker' is not installed.\n" +
+			"  Install it with: ai-studio-cli setup vllm"
+	}
+	return true, ""
+}
+
+// dockerGPUBlock and podmanGPUBlock are the GPU passthrough stanzas for the
+// bundled compose file. Docker uses the compose `deploy.resources` reservation;
+// podman-compose honours CDI devices instead. composeForRuntime swaps one for
+// the other so the rest of the bundled compose file stays byte-identical.
+const dockerGPUBlock = `    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: all
+              capabilities: [gpu]`
+
+const podmanGPUBlock = `    devices:
+      - nvidia.com/gpu=all
+    security_opt:
+      - label=disable`
+
+// composeForRuntime adapts the bundled compose bytes for the target runtime.
+// For docker it is a no-op; for podman it rewrites the GPU block to the CDI
+// device form that podman-compose understands.
+func composeForRuntime(raw []byte, e containerEngine) []byte {
+	if !e.isPodman() {
+		return raw
+	}
+	return []byte(strings.Replace(string(raw), dockerGPUBlock, podmanGPUBlock, 1))
+}