Pause container not in the pod

[mispp]

When i start a pod using qublet, additional pause containers are created, one for every pod. What i red online is that they are there to keep network namespace alive if all other containers within the pod die.

If these are supposed to keep a pod network namespace alive, shouldnt they be in the pod?

Screenshot of the issue: the 3 top containers with suffix "-service" are outside of the pods. Pods with podman inspect show there are more containers inside (one being infra).

Used yaml which is started with systemd /etc/containers/systemd/vaultwarden.yaml:

apiVersion: v1
kind: Pod
metadata:
  annotations:
    bind-mount-options: /var/run/podman/podman.sock:z
  creationTimestamp: "2024-02-18T16:02:00Z"
  labels:
    app: forgejo
    traefik.enable: true
    traefik.http.routers.forgejo.entrypoints: websecure
    traefik.http.routers.forgejo.rule: "Host(`git.my.localdomain.net`)"
    traefik.http.routers.forgejo.service: forgejo
    traefik.http.routers.forgejo.tls: true
    traefik.http.routers.forgejo.tls.certresolver: lets-encr-porkbun
    traefik.http.services.forgejo.loadbalancer.server.port: 3000
  name: forgejo-pod
spec:
  containers:
  - image: codeberg.org/forgejo/forgejo:1.21
    name: forgejo
    env:
    - name: FORGEJO__database__DB_TYPE
      value: postgres
    - name: FORGEJO__database__HOST
      value: localhost:5432
    - name: FORGEJO__database__NAME
      value: forgejo
    - name: FORGEJO__database__USER
      value: forgejo
    - name: FORGEJO__database__PASSWD
      value: xxxxx
    - name: MIN_PASSWORD_LENGTH
      value: 4
    volumeMounts:
    - mountPath: /data:z
      name: app-data-0
      readOnly: false
    - mountPath: /etc/localtime
      name: etc-localtime-2
      readOnly: true
  - image: postgres:latest
    name: forgejo-db
    env:
    - name: POSTGRES_USER
      value: forgejo
    - name: POSTGRES_PASSWORD
      value: xxxxx
    - name: POSTGRES_DB
      value: forgejo
    volumeMounts:
    - mountPath: /var/lib/postgresql/data:z
      name: db-data-1
      readOnly: false
    - mountPath: /etc/localtime
      name: etc-localtime-2
      readOnly: true
  restartPolicy: Always
  volumes:
  - hostPath:
      path: /data/forgejo/app
      type: Directory
    name: app-data-0
  - hostPath:
      path: /data/forgejo/db
      type: Directory
    name: db-data-1
  - hostPath:
      path: /etc/localtime
      type: File
    name: etc-localtime-2

And systemd / qublet unit file /etc/containers/systemd/vaultwarden.kube:

[Unit]
Description=The sleep container
After=network.target

[Kube]
Yaml=forgejo.yaml

[Install]
WantedBy=multi-user.target default.target

Details of podman pod inspect e2c

{
     "Id": "e2cee9559b01d9b2c2f0bf97165b252185e37fa195c20f8b94181676746a3231",
     "Name": "forgejo-pod",
     "Created": "2024-02-18T19:24:32.096303296+01:00",
     "ExitPolicy": "stop",
     "State": "Running",
     "Hostname": "forgejo-pod",
     "Labels": {
          "app": "forgejo",
          "traefik.enable": "true",
          "traefik.http.routers.forgejo.entrypoints": "websecure",
          "traefik.http.routers.forgejo.rule": "Host(`git.my.localdomain.net`)",
          "traefik.http.routers.forgejo.service": "forgejo",
          "traefik.http.routers.forgejo.tls": "true",
          "traefik.http.routers.forgejo.tls.certresolver": "lets-encr-porkbun",
          "traefik.http.services.forgejo.loadbalancer.server.port": "3000"
     },
     "CreateCgroup": true,
     "CgroupParent": "machine.slice",
     "CgroupPath": "machine.slice/machine-libpod_pod_e2cee9559b01d9b2c2f0bf97165b252185e37fa195c20f8b94181676746a3231.slice",
     "CreateInfra": true,
     "InfraContainerID": "8dd518b5d122718583f9e7b1f91457abe2a804ef39e2079c0009839568c2c284",
     "InfraConfig": {
          "PortBindings": {},
          "HostNetwork": false,
          "StaticIP": "",
          "StaticMAC": "",
          "NoManageResolvConf": false,
          "DNSServer": null,
          "DNSSearch": null,
          "DNSOption": null,
          "NoManageHosts": false,
          "HostAdd": null,
          "Networks": [
               "podman-default-kube-network"
          ],
          "NetworkOptions": null,
          "pid_ns": "private",
          "userns": "host",
          "uts_ns": "private"
     },
     "SharedNamespaces": [
          "uts",
          "ipc",
          "net"
     ],
     "NumContainers": 3,
     "Containers": [
          {
               "Id": "8dd518b5d122718583f9e7b1f91457abe2a804ef39e2079c0009839568c2c284",
               "Name": "e2cee9559b01-infra",
               "State": "running"
          },
          {
               "Id": "d2aece5b814f7712ce2654ec8a3a27d4d02ae24d8b84724c51d09f2a67a1247f",
               "Name": "forgejo-pod-forgejo",
               "State": "running"
          },
          {
               "Id": "f0285eac03bd3ef337204f386bad43afa567304a246222c6fa0bbb2d7d2d0482",
               "Name": "forgejo-pod-forgejo-db",
               "State": "running"
          }
     ],
     "RestartPolicy": "always",
     "LockNumber": 5
}