Possible to use internal network with pasta?

[oxan]

I want to run a container without network access (in rootless mode), but publish a port from the container (so I can't use --network=private). According to the internet, this can be achieved using:

podman network create --internal mynetwork
podman run --network=mynetwork

I've set default_rootless_network_cmd="pasta" and don't have slirp4netns installed. The podman run command above gives an error:

Error: failed to start rootless-netns slirp4netns: could not find slirp4netns, the network namespace can't be configured: exec: "slirp4netns": executable file not found in $PATH

Is this a bug, unsupported or am I doing something wrong?

[Luap99]

This will work with Podman 5.0

[Luap99]

Note the fact that this works rootless is a implementation detail. As root a --internal networks do not have ports forwarded at all.
So this behaviour could change in the future.

[oxan]

Note the fact that this works rootless is a implementation detail. As root a --internal networks do not have ports forwarded at all.

I'm not sure I understand, what exactly is an implementation detail? That --internal network works as rootless user (from Podman 5.0 on), or something else?

(I see that I left it out in my original post, but of course I'll add a --publish option to the podman run invocation for every port I want to publish.)

[Luap99]

For root port forwarding does not work when using --internal networks. For rootless they do work but this is a implementation detail with how we do port forwarding as rootless, this may change in the future if we switch to pasta for port forwarding.

[oxan]

Ah ok, thanks, that's clear. Is there another, prefered way to run a container isolated from the network, only allowing inbound connections?