Rootfull priveleged ports

[SirTeddyBear]

I'm using RaspianOS (bookworm), it's not posible to map ports below 1024 using root, i understand that is not posible in "rootless" mode.

I installed firewalld to deal with this issue and redirect ports, ports < 1024 redirect to ports > 1024, but it's not working, iptables rules are not standard because NETAVARK.

I read some threads for Pihole but didn't resolve the issue, may be intended for fedora systems and not for RaspbianOS.

I tried sysctl without any luck.

[eriksjolund]

I tried sysctl without any luck.

So you already tried configuring ip_unprivileged_port_start?

I wrote some documentation about how to configure ip_unprivileged_port_start:
https://github.com/eriksjolund/podman-networking-docs?tab=readme-ov-file#configure-ip_unprivileged_port_start

[SirTeddyBear]

Thanks for the link. It's fine for rootless because you can map ports and filter by user, but i'm launching the containers as root, so as far i know podman would be able to map priveleged port as root.

[rhatdan]

If you try to bind to a port in rootless mode < 1024 outside of a container can you? Does your root account in include CAP_NET_BIND_SERVICE?

[SirTeddyBear]

I resolved editing /usr/share/containers/containers.conf:

#network_config_dir = "/etc/cni/net.d/"

# Port to use for dns forwarding daemon with netavark in rootful bridge
# mode and dns enabled.
# Using an alternate port might be useful if other dns services should
# run on the machine.
#
dns_bind_port = 5382

default dns port is 53. I changed for a different one and did the trick.