How do I configure podman to allow containers to reach each other by name?

[marshallwp]

I've been working with podman for almost 5 years now, but there's one thing I've never managed to do: allow two containers, connected by a network, reach each other by name and/or network-alias. This applies to all network configurations I've tried, including internal networks and ones using both CNI and netavark.

Can anyone give me a dead simple example of connecting two containers by name on an explicitly defined network while one container also uses a non-internal network? Ideally this would be defined in Quadlets and use netavark-based networking, but at this point just having something that works to go off of would be appreciated.

I'm running podman v5.2.2 at the moment.

[Luap99]

$ podman run --name con1 --network testnet -d quay.io/libpod/testimage:20241011 sleep 1000
32b288aa5544e1789a59094f8b868f101326a927d2f8f96c6d5afca7ce1b526d
$ podman run --rm --network testnet quay.io/libpod/testimage:20241011 nslookup con1
Server:		10.89.2.1
Address:	10.89.2.1:53

Non-authoritative answer:
Name:	con1.dns.podman
Address: 10.89.2.2

Non-authoritative answer:

This should just work as long as you are using bridge networks and make sure the networks shows "dns_enabled": true, when you inspect it so it uses aardvark-dns to resolve the container names

[marshallwp]

@Luap99, thank you so much. That has been bugging me for years.

[marshallwp]

Your example worked for rootless containers, so thank you! Any idea how to get it working with rootful ones? It still failed when I tried to use rootful networking.

[marshallwp]

Not to my knowledge (it's a fresh VM dedicated to the grouping of containers I'm trying to use), but it's good to know that's something I should be looking for. Will see what I can find; might be getting intercepted by an nftables rule.

[marshallwp]

Yep that was it. Had to add

chain input {
    ip saddr 10.89.0.0/24 meta l4proto udp ip daddr 10.89.0.1 udp dport 53 counter accept comment "Podman internal aardvark-dns DNS server"
}

To my nftables ruleset to get it working.

[Luap99]

Do you have another table/chain dropping all packages? The rules created by podman should add an accept rule by default for this but I think with nftables it may not be good enough because a single drop from any other table would overwrite the explicit accept in the netavark rules.

[marshallwp]

Our default nftables rules include a rule to drop all incoming traffic on port 53 because "the VM is not a router" (config file comment). As I've discovered, the VM very much is a router, at least insofar as podman container networking is concerned. I believe that rootless podman DNS worked because it used a port other than 53 for this.

[Luap99]

rootless dns would still use port 53 but that is inside a new unprivileged network namespace we create (called rootless-netns) which therefore has an empty ruleset besides the entavark rules.
you can check podman unshare --rootless-netns ss -tulpn when running a container with dns enabled. podman unshare --rootless-netns just enters said namespace so you can use the to connect to rootless containers via ip which does not work directly from the host otherwise.

Consider this rootless architecture diagram #22943 (comment)