Is the IP address 10.0.2.100 special?

[eriksjolund]

I tested these commands as a normal user with Podman version 3.1.2.

1. podman run -p 8081:80 --name nginxtest -d docker.io/library/nginx
2. curl localhost:8081
3. podman logs nginxtest

In the output I could see

10.0.2.100 - - [26/May/2021:12:04:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-"

Is the IP address 10.0.2.100 special?
Can I expect that nginx always will see the requests as coming from 10.0.2.100 when I run the Podman commands in this way?

Reading the GitHub comment
#9052 (comment)
I get the impression that could be the case.

I couldn't find so much information about the IP address 10.0.2.100 in the Podman repository:

[esjolund@laptop podman]$ grep -r 10.0.2.100 .
./docs/source/markdown/podman-unshare.1.md:    inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0
./vendor/github.com/rootless-containers/rootlesskit/pkg/port/portutil/portutil.go:// e.g. "127.0.0.1:8080:80/tcp", or "127.0.0.1:8080:10.0.2.100:80/tcp"
./vendor/github.com/rootless-containers/rootlesskit/pkg/port/port.go:	// - slirp4netns driver: slirp4netns's child IP, e.g., 10.0.2.100
./vendor/github.com/rootless-containers/rootlesskit/pkg/api/openapi.yaml:          example: "10.0.2.100"
[esjolund@laptop podman]$ 

I would guess this might be be related:
IP will be set to 10.0.2.100 (network address + 100) by default
(A quote from https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)

[mheon]

This is a consequence of the rootlesskit port forwarding backend for slirp4netns, which does not preserve source IP. You can switch to the (older, somewhat buggier, lower-performance) slirp4netns port forwarding backend which does preserve source IP if you need this via --net=slirp4netns:port_handler=slirp4netns

[eriksjolund]

Interesting!

I tried out adding the command-line option --net=slirp4netns:port_handler=slirp4netns

1. podman run -p 8083:80 --net=slirp4netns:port_handler=slirp4netns --name nginxtest2 -d docker.io/library/nginx
2. curl localhost:8083
3. podman logs nginxtest2

In the output I could see this line:

10.0.2.2 - - [26/May/2021:15:58:06 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-"

The IP address is now different (10.0.2.2 instead of 10.0.2.100).

Some background information:

I plan to run Nginx on the host as an HTTP reverse proxy that would also terminate TLS. As back end Gunicorn will be running in a container that is started from a Systemd user service (ExecStart=/usr/bin/podman run ... ).

It seems Gunicorn would like to know the IP address of the HTTP reverse proxy.
I would therefore need to specify the IP address with the Gunicorn command-line option --forwarded-allow-ips (see https://docs.gunicorn.org/en/stable/settings.html)

I guess I would then need to specify 10.0.2.100.

The other alternative, using the slirp4netns port forwarding backend, seems less attractive if it is older, somewhat buggier, lower-performance. Especially the part somewhat buggier sounds a bit scary.

(Note, in the examples above, nginx was running in a container. Just to avoid confusing I could clarify that, that is not how the actual set up will look like. There nginx will be running directly on the host)

[Luap99]

10.0.2.2 is the real remote address in this case since the request was made from localhost. If you connect from a different machine on your network you should see the correct source ip in the nginx log.

[caffeineaddiction]

random note for future readers:
Info on slirp4netns - https://podman.io/community/meeting/notes/2021-10-05/Podman-Rootless-Networking.pdf
Info on how to possibly achive the same goal w/ out slirp4netns https://lists.podman.io/archives/list/[email protected]/thread/W6MCYO6RY5YFRTSUDAOEZA7SC2EFXRZE/

[eriksjolund]

another note for future readers:
It's possible to see the source IP address (aka the peer IP address) if the listening socket came from socket activation.

A question is whether Nginx supports socket activation. I created a new discussion topic about that #15354

[EvanCarroll]

Is there a hostname that resolves to 10.0.2.100 so at least we don't have to ask this question when someone hard codes this ip address everywhere?

[EvanCarroll]

Answer: the pod name resolves to the ip address of all containers in the pod. nice.