How come rootless containers don't require packet forwarding on the host?

[adrian5]

I noticed that with podman, rootless containers have internet connectivity without enabling the host's packet forwarding:

$ sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 0

$ nft list ruleset
chain Fwd {
    type filter hook forward priority filter; policy drop;
}

Is this because the TAP interface the containers use is (so to speak) one level below the IP/packet layer, bypassing that need?

[mheon]

I wouldn't say it operates below the IP/packet layer - more that it manually replicates the NAT/forwarding performed by the kernel in root containers.

[adrian5]

I see. Documentation on tun/tap seems sparse and articles mostly cover the use of bridge interfaces which I don't think are involved here. But delving further into this risks veering off-topic, so thanks!