Private network namespaces for podman-in-podman (or K8s) #14394

ooraini · 2022-05-27T05:45:17Z

ooraini
May 27, 2022

I have managed to get private networks(and named ones) to work in podman inside a container with no unmasking. This works for rootless in rootful.

Start the container:

sudo podman run --user podman --security-opt label=disable --device /dev/net/tun -ti quay.io/podman/stable

Disabled default_sysctls

echo "default_sysctls=[]" >> /home/podman/.config/containers/containers.conf

Test private net:

podman run --rm --network private -ti --name webserver -p 8080:80 quay.io/libpod/banner
# works

Create named network:

podman network create foo

Use named network: (Error)

podman run --rm --network foo -ti --name webserver -p 8080:80 quay.io/libpod/banner

ERRO[0000] error loading cached network config: network "foo" not found in CNI cache 
WARN[0000] falling back to loading from existing plugins on disk 
ERRO[0000] Error tearing down partially created network namespace for container 405af495031f8ebb07d8708e2a76f41ea13c36caf5caa8d7de79d0a3cc730fac: error removing pod webserver_webserver from CNI network "foo": neither iptables nor ip6tables usable 
Error: error configuring network namespace for container 405af495031f8ebb07d8708e2a76f41ea13c36caf5caa8d7de79d0a3cc730fac: error adding pod webserver_webserver to CNI network "foo": failed to list chains: running [/usr/sbin/iptables -t nat -S --wait]: exit status 3: modprobe: FATAL: Module ip_tables not found in directory /lib/modules/4.18.0-372.9.1.el8.x86_64
iptables v1.8.7 (legacy): can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

This error is from CNI, I'm not sure why iptables is used in rootless(or is it normal?). The container image uses iptables-legacy and my host OS doesn't have the iptables module enabled. In another shell:

sudo podman exec -it --user root -l sh -c 'yum -y install iptables-nft && yum -y remove iptables-legacy'

Second attempt:

podman run --rm --network foo -ti --name webserver -p 8080:80 quay.io/libpod/banner

ERRO[0000] error loading cached network config: network "foo" not found in CNI cache 
WARN[0000] falling back to loading from existing plugins on disk 
Error: error configuring network namespace for container 9c3eae3310d98d3941b0a13244704ab8410026006ea787f9189febb11bdae623: error adding pod webserver_webserver to CNI network "foo": unable to enable route_localnet: open /proc/sys/net/ipv4/conf/cni-podman1/route_localnet: read-only file system

Also from CNI. Disable portMapping for the network foo:

sed -i 's/"portMappings": true/"portMappings": false/' /home/podman/.config/cni/net.d/foo.conflist

Third attempt:

podman run -d --rm --network foo -ti --name webserver -p 8080:80 quay.io/libpod/banner

curl localhost:8080
<html>
<head><title>404 Not Found</title></head>
<body>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx</center>
</body>
</html>


podman run -it --rm --network foo -ti quay.io/libpod/banner curl webserver:80
<html>
<head><title>404 Not Found</title></head>
<body>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx</center>
</body>
</html>

And it works. It also works in Kubernetes.

ooraini · 2022-05-27T05:46:58Z

ooraini
May 27, 2022
Author

ps aux output:

podman         1  0.0  0.4   4856  2172 pts/0    Ss+  05:37   0:00 /bin/bash
podman        45  0.0  0.0  54828     0 ?        S    05:37   0:00 podman
podman       894  0.0  0.3   4960  1828 pts/0    S    05:41   0:00 /usr/bin/slirp4netns --disable-host-loopback --mtu=65520 --enable-sandbox --enable-seccomp -c -r 3 --netns-type=path /tmp/podman-run-1000/netns/rootless-cni-ns tap0
podman       950  0.0  0.2   9748  1120 ?        S    05:41   0:00 /usr/sbin/dnsmasq -u root --conf-file=/tmp/podman-run-1000/containers/cni/dnsname/foo/dnsmasq.conf
podman       951  0.0  1.2 1201352 5848 pts/0    Sl   05:41   0:00 containers-rootlessport
podman       955  0.0  3.4 1053888 16292 pts/0   Sl   05:41   0:00 containers-rootlessport-child
podman       963  0.0  0.3  81832  1536 ?        Ssl  05:41   0:00 /usr/bin/conmon --api-version 1 -c cc0bf36858e7a286363844d3d13fdc1ce55dbda08ae7205eb099c0add16ddace -u cc0bf36858e7a286363844d3d13fdc1ce55dbda08ae7205eb099c0add16ddace -r /usr/bin/crun -b /home/podman/.loca
podman       966  0.0  0.1   7876   812 pts/0    Ss+  05:41   0:00 nginx: master process nginx -g daemon off;
100          968  0.0  0.2   8332  1236 pts/0    S+   05:41   0:00 nginx: worker process
root        1426  0.0  0.6   4856  3024 pts/1    Ss   05:46   0:00 bash
root        1448  0.0  0.8   8580  3784 pts/1    R+   05:46   0:00 ps aux

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Private network namespaces for podman-in-podman (or K8s) #14394

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Private network namespaces for podman-in-podman (or K8s) #14394

Uh oh!

ooraini May 27, 2022

Replies: 1 comment

Uh oh!

ooraini May 27, 2022 Author

ooraini
May 27, 2022

ooraini
May 27, 2022
Author