{ pkgs, lib, config, ... }: {
  virtualisation = {
    containers.enable = true;
    oci-containers.backend = "podman";
    podman = {
      enable = true;
      autoPrune = {
        enable = true;
        flags = [ "--all" "--filter 'until=24h'" "--force" ];
      };
      dockerCompat = true;
    };
  };

  networking.firewall.interfaces = let
    matchAll =
      if !config.networking.nftables.enable then "podman+" else "podman*";
  in { "${matchAll}".allowedUDPPorts = [ 53 ]; };

  # If you want to trigger this service manually, run sudo systemctl restart update-containers.service.
  systemd.services.updatecontainers = {
    serviceConfig = {
      Type = "oneshot";
      User = "portainer";
      ExecStart = lib.getExe (pkgs.writeShellScriptBin "update-containers" ''
        images=$(${pkgs.podman}/bin/podman ps -a --format="{{.Image}}" | sort -u)

        for image in $images; do
          ${pkgs.podman}/bin/podman pull "$image"
        done
      '');
    };
  };

  systemd.user.timers = {
    updatecontainers = {
      unitConfig.ConditionUser = "portainer";
      timerConfig = {
        Unit = "updatecontainers.service";
        OnCalendar = "Sun 02:03";
      };
      wantedBy = [ "timers.target" ];
    };
  };
}