podman run as rootless generate an ID but no container, quadlet won't start

[Extarys]

I'm running Rocky Linux 9 in a VM and practicing Ansible. Using it I created a regular user Test and a Quadlet for nextcloud AIO.
The problem is that the service doesn't start, and the podman command returns an ID, but podman ps -a doesn't show any containers.

A simple nginx container works as rootless:

podman pull docker.io/nginx
podman  run --name docker-nginx -p 8080:80 docker.io/nginx

Service
Content of /home/Test/.config/containers/systemd/nextcloud.container:

[Container]
ContainerName=nextcloud-aio-mastercontainer
Environment=NEXTCLOUD_MOUNT=/mnt/data/nextcloud/
Environment=NEXTCLOUD_DATADIR=/mnt/data/nextcloud/domain.local
Environment=APACHE_PORT=10000
Environment=TALK_PORT=10001
Environment=APACHE_IP_BINDING=127.0.0.1
Environment=WATCHTOWER_DOCKER_SOCKET_PATH=/run/user/1002/podman/podman.sock
Image=docker.io/nextcloud/all-in-one:latest
Network=bridge
PublishPort=127.0.0.1:10002:80
Volume=/run/user/1002/podman/podman.sock:/var/run/docker.sock:ro
Volume=nextcloud_aio_mastercontainer:/mnt/docker-aio-config
AutoUpdate=registry
Pull=newer

[Unit]
Description=NextCloud for Test at domain.local
Documentation=https://github.com/nextcloud/all-in-one/blob/main/docker-rootless.md
After=local-fs.target
Requires=podman.socket

[Install]
WantedBy=multi-user.target default.target
[X-Podman]
User=Test

When trying to run the service: systemctl --user start nextcloud.service

$ systemctl --user status nextcloud.service
× nextcloud.service - NextCloud for Test at domain.local
     Loaded: loaded (/home/Test/.config/containers/systemd/nextcloud.container; generated)
     Active: failed (Result: exit-code) since Wed 2024-12-11 22:24:32 UTC; 21s ago
   Duration: 530ms
       Docs: https://github.com/nextcloud/all-in-one/blob/main/docker-rootless.md
    Process: 4930 ExecStart=/usr/bin/podman run --name=nextcloud-aio-mastercontainer --cidfile=/run/user/1002/nextcloud.cid --replace --rm --cgroups=split --network=b>
    Process: 4988 ExecStopPost=/usr/bin/podman rm -v -f -i --cidfile=/run/user/1002/nextcloud.cid (code=exited, status=0/SUCCESS)
   Main PID: 4930 (code=exited, status=1/FAILURE)
        CPU: 401ms

Manually
I took the ExecStart command to do more testing, when I run it, a podman ID is returned:

$ /usr/bin/podman run --name=nextcloud-aio-mastercontainer --replace --rm --cgroups=split --network=bridge --sdnotify=conmon -d -v /run/user/1002/podman/podman.sock:/var/run/docker.sock:ro -v nextcloud_aio_mastercontainer:/mnt/docker-aio-config --label io.containers.autoupdate=registry --publish 127.0.0.1:10002:80 --env APACHE_IP_BINDING=127.0.0.1 --env APACHE_PORT=10000 --env NEXTCLOUD_DATADIR=/mnt/data/nextcloud/Test --env NEXTCLOUD_MOUNT=/mnt/data/nextcloud/ --env TALK_PORT=10001 --env WATCHTOWER_DOCKER_SOCKET_PATH=/run/user/1002/podman/podman.sock --pull newer docker.io/nextcloud/all-in-one:latest
b5527c1a1d62a89f0fb17ddf7d8a721d4911e9faaccf1080281aaf7ded9ade14

Podman doesn't show any container nor images:

$ podman ps -a && podman images ls
CONTAINER ID  IMAGE                                            COMMAND     CREATED            STATUS                        PORTS       NAMES
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE

journalctl (from root user):

Dec 11 22:20:37 localhost.localdomain kernel: podman0: port 1(veth0) entered disabled state
Dec 11 22:20:37 localhost.localdomain systemd[1039]: nextcloud.service: Main process exited, code=exited, status=1/FAILURE
Dec 11 22:20:37 localhost.localdomain systemd[1039]: nextcloud.service: Failed with result 'exit-code'.
Dec 11 22:20:40 localhost.localdomain systemd[1039]: Started podman-4796.scope.
Dec 11 22:24:30 localhost.localdomain systemd[1039]: Starting NextCloud for CU00000 at nuage.ozenik.com...
Dec 11 22:24:31 localhost.localdomain systemd[1039]: Started rootless-netns-7c4a8ec0.scope.
Dec 11 22:24:31 localhost.localdomain kernel: podman0: port 1(veth0) entered blocking state
Dec 11 22:24:31 localhost.localdomain kernel: podman0: port 1(veth0) entered disabled state
Dec 11 22:24:31 localhost.localdomain kernel: device veth0 entered promiscuous mode
Dec 11 22:24:31 localhost.localdomain kernel: IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Dec 11 22:24:31 localhost.localdomain kernel: IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
Dec 11 22:24:31 localhost.localdomain kernel: podman0: port 1(veth0) entered blocking state
Dec 11 22:24:31 localhost.localdomain kernel: podman0: port 1(veth0) entered forwarding state
Dec 11 22:24:31 localhost.localdomain systemd[1039]: Started NextCloud for CU00000 at nuage.ozenik.com.
Dec 11 22:24:31 localhost.localdomain nextcloud[4816]: 6c4d088a9531a4ff9db436977183c1aa4383d9c5d19f066cc2398db9bca14222
Dec 11 22:24:32 localhost.localdomain kernel: podman0: port 1(veth0) entered disabled state
Dec 11 22:24:32 localhost.localdomain kernel: device veth0 left promiscuous mode
Dec 11 22:24:32 localhost.localdomain kernel: podman0: port 1(veth0) entered disabled state
Dec 11 22:24:32 localhost.localdomain systemd[1039]: nextcloud.service: Main process exited, code=exited, status=1/FAILURE
Dec 11 22:24:32 localhost.localdomain systemd[1039]: nextcloud.service: Failed with result 'exit-code'.
Dec 11 22:26:16 localhost.localdomain NetworkManager[978]: <info>  [1733955976.7391] dhcp4 (enp1s0): state changed new lease, address=192.168.122.230
Dec 11 22:26:16 localhost.localdomain systemd[1]: Starting Network Manager Script Dispatcher Service...
Dec 11 22:26:16 localhost.localdomain systemd[1]: Started Network Manager Script Dispatcher Service.
Dec 11 22:26:26 localhost.localdomain systemd[1]: NetworkManager-dispatcher.service: Deactivated successfully.
Dec 11 22:27:13 localhost.localdomain systemd[1039]: Started podman-5014.scope.
Dec 11 22:27:13 localhost.localdomain systemd[1039]: Started podman-5031.scope.

cat /etc/subuid shows Test:231072:65536

It's the first time I create a user dedicated for podman, pardon me if this issue is simple but I've spent my afternoon on this and I cannot figure this out :)

Any clues?
Thanks!

[Extarys]

I had to eat to find the solution.

-d is daemon, so I couldn't see the errors. Running the command manually made me realize SELinux is enforcing. I needed ,z to the socket and security_opt: ["label:disable"] (nextcloud aio requirement).

🎉