How to publish port of a single container inside multi-container pod (rootless)?

[phandox]

Hi,

I use slirp4net network mode and rootless containers. I used Podman versions 3.4.4 and 4.3.1.

I have 1 pod, with 2 containers (nginx container + postgres DB container in single pod).

I would like to use hosts 8080 port to connect to 80 on nginx. I used --publish during pod creation and this works. However, it reports that it published it also on postgres DB container. For this container I don't want any ports to be published.

Is there a way to target only 1 container in pod for publishing?

Here are steps to replicate it:

podman pod create -p 8080:80 nginx-exposed 
4fde03f8ac9816a4cbd1b4c434adec711952ace17caeeaf79cd62e958e77386a

podman run -d --pod nginx-exposed docker.io/library/nginx:latest
b4ef0dc9fa581a3c849e8e1b91e672f2b7962db0c8f7657851d67533132cd58e

podman run -d --pod nginx-exposed -e POSTGRES_PASSWORD=dummy docker.io/library/postgres:latest 
830b0fc55c2800ebcb4cb6f718afc94381f94637cc77eca45a3afab436186d4a

podman ps 
CONTAINER ID  IMAGE                              COMMAND               CREATED         STATUS             PORTS                 NAMES
7874a7a3e7cd  localhost/podman-pause:4.3.1-0                           53 seconds ago  Up 36 seconds ago  0.0.0.0:8080->80/tcp  4fde03f8ac98-infra
b4ef0dc9fa58  docker.io/library/nginx:latest     nginx -g daemon o...  36 seconds ago  Up 36 seconds ago  0.0.0.0:8080->80/tcp  serene_zhukovsky
830b0fc55c28  docker.io/library/postgres:latest  postgres              8 seconds ago   Up 9 seconds ago   0.0.0.0:8080->80/tcp  jovial_mclean

podman port serene_zhukovsky 
80/tcp -> 0.0.0.0:8080

podman port jovial_mclean 
80/tcp -> 0.0.0.0:8080

[Luap99]

That is how a pod works, you share one network namesapce so there is only one way to forward ports into it. Any container process can use the ports but only once, so if nginx already bound to 80 then postgres would not able to bind 80 as it is in already in use.

[phandox]

Thank you, it all makes sense. Since they share 1 network namespace, the port has to be exposed to both containers.