userspace network between containers

[tmds]

Creating a network requires root.

To avoid that, you can:

• put containers in a pod and communicate via "localhost"
• use the "--network host" network

Both options use ports from the same "host", so it is not possible to run multiple containers that have the same containerport, like when the same image is used to create multiple containers.

Can podman support creating a 'network' between containers that: doesn't require root, allows containers to bind to the same port, and map ports from the containers to the host?

Related slirp4netns issue: rootless-containers/slirp4netns#172

This would be useful also for https://github.com/containers/podman-compose.

[vrothberg]

Thanks for reaching out, @tmds!

I think that what you need is mentioned on podman.io "Container <-> Host Communication".

[tmds]

@vrothberg I'm looking for Container <-> Container communication.

This is what I'd like (similar to rootfull network):

• limit which containers can communicate (no communication with containers which are not part of the 'network')
• don't expose ports publically on the machine (bound to 0.0.0.0)
• port map container port, so the same image can run multiple times
• disallow access to any service running on the host (no --network host).

[vrothberg]

That doesn't work at the moment. Pulling in the slirp4netns specialists: @AkihiroSuda @giuseppe, what do you think?

[mheon]

I think this is something we need to look into in the future; the limitation on what we can do with networking in rootless is a major drawback.

[AkihiroSuda]

Duplicate: #1733

[AkihiroSuda]

Documented how to set up inter-namespace communication: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md#inter-namespace-communication

So, podman could support multi-container networks in two possible ways:

• Nest multiple network namespaces and vEths inside a singleton slirp4netns instance (rootless containers should have dedicated netns&veth under the singleton slirp4netns instance #1733)
• Use vde_plug (or its equivalent) for communication across multiple slirp4netns instances

Rootless Docker supports docker network create using the former one.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[AkihiroSuda]

POC scripts for allowing an equivalent of podman network create with Rootless Podman, by running CNI plugins inside a "sandbox" container that is similar to Kubernetes Pod sandboxes: https://github.com/AkihiroSuda/podman-network-create-for-rootless-podman

Haven't got DNS to work yet, but probably it shouldn't be difficult. (EDIT: now DNS works)

@giuseppe @rhatdan Do you think executing CNI inside a "sandbox" container is the right approach?

[giuseppe]

@giuseppe @rhatdan Do you think executing CNI inside a "sandbox" container is the right approach?

definitely. I've started working on the side on supporting it in rootless podman: https://github.com/giuseppe/libpod/tree/allow-rootless-cni

But before that, we need a new release of iptables with this patch: https://git.netfilter.org/iptables/commit/?id=5105e844c2ff6a3e320bf8cdadc5094d4eaef2b7

[AkihiroSuda]

. I've started working on the side on supporting it in rootless podman: https://github.com/giuseppe/libpod/tree/allow-rootless-cni

The branch doesn't seem to contain sandboxing code at the moment, is there anything I can help?

But before that, we need a new release of iptables with this patch:

Not necessarily if you execute sandbox as a container, or at least unshare mount namespace and mount a writable tmpfs on /run.