Rootless pasta Caddy reverse proxy

[rajalah71]

I have a test container running with pasta on host (microOS) 192.168.1.220 as follows:

podman run --detach \
  --name test \
  -p 7000:80 \
  quay.io/libpod/banner:latest

Which I can access from another computer (same network as microOS) with:

curl 192.168.1.220:7000

I have Caddy running with pasta also on microOS host as:

podman run \
	-d \
        --name caddy \
        --volume /var/storage/caddy/caddy_data:/data:Z \
        --volume /var/storage/caddy/Caddyfile:/etc/caddy/Caddyfile:Z \
        --volume /var/storage/caddy/caddy_config:/config:Z \
	--volume /var/storage/caddy/access.log:/var/log/caddy/access.log:z \
	--volume /var/storage/caddy/geoip/data/GeoLite2-Country.mmdb:/home/GeoLite2-Country.mmdb:Z \
        -p 8080:80 \
        -p 8443:443 \
        localhost/my-caddy:latest

With Caddyfile:

{
	log {
		output file /var/log/caddy/access.log
		format json
	}
}

test.example.com {
	reverse_proxy 192.168.1.220:7000
}

But the test.example.com doesn't open the banner page, just a blank page. I had a working installation of this with slirp4netns, but I wan't to try and learn pasta insead.

I suspect the problem lies with the reverse proxy address/ports.

Can anybody give me a hand with this?

[eriksjolund]

With Podman built from the git main branch combined with a recent Pasta version you could specify host.containers.internal as hostname.

I built the Podman git main branch some weeks ago (git commit: 649730c).

1. Run command

   ~/installpodman/bin/podman run \
           --detach \
           --name test \
           -p 7000:80 \
          quay.io/libpod/banner:latest
   

2. Create the file ~/Caddyfile containing

   {
   	log {
   		output file /var/log/caddy/access.log
   		format json
   	}
   }
   
   http://test.example.com {
   	reverse_proxy host.containers.internal:7000
   }
   

3. Run command

    ~/installpodman/bin/podman run \
           --detach \
           --name caddy \
           --publish 8080:80 \
           --volume ~/Caddyfile:/etc/caddy/Caddyfile:Z \
           docker.io/library/caddy caddy run --config /etc/caddy/Caddyfile 
   

4. Run command

   curl -s --resolve test.example.com:8080:127.0.0.1 \
        http://test.example.com:8080
   

   The following output is printed:

      ___          __              
     / _ \___  ___/ /_ _  ___ ____ 
    / ___/ _ \/ _  /  ' \/ _ `/ _ \
   /_/   \___/\_,_/_/_/_/\_,_/_//_/
   
   

about the system

Fedora CoreOS 42.20240830.91.0

$ rpm -q passt
passt-0^20240821.g1d6142f-1.fc42.aarch64

$ ~/installpodman/bin/podman --version
podman version 5.3.0-dev

References

https://github.com/eriksjolund/podman-networking-docs?tab=readme-ov-file#outbound-tcpudp-connections-to-the-hosts-main-network-interface-eg-eth0

If you want to use an older Podman version you could try specifying the pasta option --map-guest-addr
https://github.com/eriksjolund/podman-networking-docs?tab=readme-ov-file#about-the-pasta-option---map-guest- addr but you need to use a pasta version with support for the the option --map-guest-addr . It was added to pasta quite recently.

Extra tip: If you want to run Caddy with socket activation take look here:

https://github.com/eriksjolund/podman-caddy-socket-activation

[rajalah71]

Okay I just might wait for podman 5.3 then.

I just wonder, would I have to call a port when trying to access a website? That is not a long term solution either :/

EDIT: I am just a little confused about your step 4 curl commands :D

[eriksjolund]

Curl has a --resolve option to "fake" normal domain name resolution.

curl -s --resolve test.example.com:8080:127.0.0.1 \
     http://test.example.com:8080

I could also have written

curl -s http://test.example.com:8080

assuming test.example.com can be looked up via normal name resolution (for example with DNS or /etc/hosts).

Another thing: I used port 8080 because

$ cat /proc/sys/net/ipv4/ip_unprivileged_port_start
1024

and I ran the test as an unprivileged user.

Edit: By the way, instead of 127.0.0.1 I should have used the IP address of the host's main network interface (that is connected to the internet). It should give the same result, though.

[rajalah71]

Thanks for the replies.

I tried to follow your links on --map-guest-addr but I couldn't find out how and where to actually use it.

On each container? Or just Caddy?

[rajalah71]

I managed to get this work by adding "--network pasta" to both of the containers and reverse proxying to host.containers.internal:7000.

This is on Podman 5.2.3 for future reference.

Without specifying --network pasta this didn't work even though by inspecting both of them they defaulted to pasta anyway?

Does the host.containers.internal have some security draws backs?

[rajalah71]

Updated to Podman 5.2.4 and the solution doesn't work anymore??

[eriksjolund]

Without specifying --network pasta this didn't work even though by inspecting both of them they defaulted to pasta anyway?
Does the host.containers.internal have some security draws backs?

I don't know.
Maybe someone else knows?

[eriksjolund]

I tried it out the --map-guest-addr solution on Fedora CoreOS 41.20241006.1.1

Podman version:

$ rpm -q podman
podman-5.2.4-1.fc41.aarch64

1. Run command

   podman run \
           --detach \
           --name test \
           -p 7000:80 \
          quay.io/libpod/banner:latest
   

2. Create the file ~/Caddyfile containing

   {
   	log {
   		output file /var/log/caddy/access.log
   		format json
   	}
   }
   
   http://test.example.com {
   	reverse_proxy 11.11.11.11:7000
   }
   

   (The IPv4 address 11.11.11.11 was arbitrarily chosen)
3. Run command

    podman run \
           --detach \
           --name caddy \
           --publish 8080:80 \
           --volume ~/Caddyfile:/etc/caddy/Caddyfile:Z \
           docker.io/library/caddy caddy run --config /etc/caddy/Caddyfile 
   

4. Run command

   hostname -I
   

   The following output is printed

   10.0.2.15 fec0::8740:5b5b:70fe:d909
   

   (The IPv4 address 10.0.2.15 is detected as being the host's primary network interface)
5. Run command

   curl -s --resolve test.example.com:8080:10.0.2.15 \
        http://test.example.com:8080
   

   The following output is printed:

      ___          __              
     / _ \___  ___/ /_ _  ___ ____ 
    / ___/ _ \/ _  /  ' \/ _ `/ _ \
   /_/   \___/\_,_/_/_/_/\_,_/_//_/
   
   

Side note: podman 5.3.0 (not yet released) will support host.containers.internal and host.docker.internal out of the box. (Podman 5.3.0 will use --map-guest-addr under the hood)