Behavior of Podman remote client with ports published

[rm3l]

Hi there!

Not sure if this is a bug or an expected behavior.

I tried to use the Podman remote CLI to create resources and have the container ports exposed on the host running the remote CLI. Simple repro steps:

# Adding the system connection
$ podman-remote system connection add work-laptop \             
  --default \                                                                                              
  --identity ~/.ssh/id_rsa \                                                                               
  ssh://[email protected]

# Checking that it works
$ podman-remote version                                         
Client:       Podman Engine                                                                                
Version:      4.6.2                                                                                        
API Version:  4.6.2                                                                                        
Go Version:   go1.20.5                                                                                     
Git Commit:   5db42e86862ef42c59304c38aa583732fd80f178                                                     
Built:        Mon Aug 28 20:02:15 2023
OS/Arch:      linux/amd64

Server:       Podman Engine
Version:      4.6.2
API Version:  4.6.2
Go Version:   go1.20.7
Built:        Tue Sep 12 22:07:22 2023
OS/Arch:      linux/amd64

# Create container
$ podman-remote container run --rm -p 8080:80 docker.io/library/nginx

/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh

$ podman-remote ps
CONTAINER ID  IMAGE                           COMMAND               CREATED        STATUS        PORTS                 NAMES
efb44ca8d560  docker.io/library/nginx:latest  nginx -g daemon o...  4 minutes ago  Up 4 minutes  0.0.0.0:8080->80/tcp  wizardly_heyrovsky

# Now when trying to connect to port 8080 on the host running the Podman remote client,
# we can see that the port is not open:
$ curl http://localhost:8080
curl: (7) Failed to connect to localhost port 8080 after 0 ms: Connection refused

$ sudo lsof -Pi :8080
$ 

As expected however, the port is accessible on the backend host:

$ curl -i http://work-laptop.lan:8080                                                                            
HTTP/1.1 200 OK                                                                                            
Server: nginx/1.25.2                                                                                       
Date: Tue, 19 Sep 2023 10:40:25 GMT                                                                        
Content-Type: text/html
Content-Length: 615
Last-Modified: Tue, 15 Aug 2023 17:03:04 GMT
Connection: keep-alive
ETag: "64dbafc8-267"
Accept-Ranges: bytes

[...]

So my question is: is this the expected behavior of the Podman remote CLI (ports not being opened on the client side)? I've probably missed that, but I couldn't find any relevant documentation on this.
I was thinking that, since communication with the Podman backend is over SSH, maybe having the remote CLI automatically open up an SSH tunnel right after the container is created remotely would make it possible to access those ports from the client host.

Thanks.

[Luap99]

Basically all resources are only created on the server side, ports,volumes, etc... The remote client just talks vie the libpod API to the server. There is no special magic used to forward ports or volumes to the remote client.
Also since this needs to be configured on the client there is basically no way to remove the port when a container exits as the remote client process does not stick around, i.e. when podman-remote run -d ... is used.

The exception is podman machine which will forward ports to the host of the VM and can mount volumes from the host into the VM.
But this only works for HOST<->VM communications and not generic remote connections.

[rm3l]

Alright, I see. Thanks for the clarifications, which make a lot of sense.
Unless I missed it, this behavior was not that clear when I read the podman-remote documentation. Would it make sense to make this more explicit in the documentation?

[Luap99]

Sure we can update the docs, if you have specific wording in mind feel free to open a PR.