How to bind only to localhost when using host network ?

[nipil]

How can i tell the container to bind only to localhost when using host network ?

I only know how to bind only to localhost when forwarding ports :

$ podman run --rm -p 127.0.0.1:8080:80 -it nginx
$ sudo ss -plant | grep LISTEN
LISTEN 0      4096       127.0.0.1:8080        0.0.0.0:*     users:(("rootlessport",pid=49240,fd=11))

And how to bind to host network but it binds to all interfaces :

$ podman run --rm --network host -it nginxinc/nginx-unprivileged
$ sudo ss -plant | grep LISTEN
LISTEN 0      511          0.0.0.0:8080        0.0.0.0:*     users:(("nginx",pid=49499,fd=6),...

And i know how to modify the container program itself, to listen only to localhost (which works as intended) :

$ podman run --rm --network host -v ./default.conf:/etc/nginx/conf.d/default.conf -i -t nginxinc/nginx-unprivileged
$ sudo ss -plant | grep LISTEN
LISTEN 0      511        127.0.0.1:8080        0.0.0.0:*     users:(("nginx",pid=50555,fd=7)...
LISTEN 0      511            [::1]:8080           [::]:*     users:(("nginx",pid=50555,fd=6), ...

But how can i limit to localhost in host mode, when a process in a container tries to bind to any address or interface ?

Nicolas

[sbrivio-rh]

There's no way to do so externally, but you can configure nginx to do so, say:

server {
  listen 127.0.0.1:8080;
  ...
}

[nipil]

It makes sense ! As i understand now, in network mode the application is indeed configuring its listening socket completely on its own and how it chooses (except what might be forbidden in rootless mode). Thanks @sbrivio-rh for your quick feedback.