Re: Connecting back to the host through a dummy veth interface

[Felix Rubio <felix@kngnt.org>]

Hey Stefano,

Thank you for your answer! I know I can run rootful containers, and that then 
I can access the host's network ns. However, this exposes a number of 
potential issues:
* In case the an attacker manages to break out of the container, gets root
* That enables connecting back to the host loopback, but then from that 
container any service listening to the loopback can be reached as well.

The reason for looking for a way of binding those services to 10.255.255.1 (so 
that only exposed services will be in that interface) and running fully 
rootless, if works, provides a more secure system... in general.

About the mapped ports, I am a bit lost: for what I have tested, running 
rootless disables the possibility to connect back to the host, right?

Regards, and thank you!
Felix

On Saturday, 20 December 2025 15:12:24 Central European Standard Time Stefano 
Brivio wrote:
> Hi Felix,
> 
> On Thu, 18 Dec 2025 13:32:36 +0100
> 
> Felix Rubio <felix@kngnt.org> wrote:
> > Hi everybody,
> > 
> > I am trying to run a number of rootless podman pods and containers by 
different
> > users, while still being able to talk to each other. To this end I am 
creating
> > a dummy veth interface and publishing all the exposed ports there (this 
works:
> > I can communicate from other host services with those containers), and I 
am
> > also trying to set that dummy veth interface as the default gateway for 
the
> > pods/containers (with the expectation that then they will be able to reach
> > each other). However, this is not working... and I am pretty lost.
> > 
> > For example, I am running the following command, trying to connect a ldap
> > client container to a ldap server container, unsuccessfully.
> > 
> > podman run --rm --dns=10.255.255.1 --network=pasta:--outbound-
> > if4=cluster_dns0,--gateway=10.255.255.1 --add-
host=ldap.host.internal:host-gateway sh -c "ip add && ip route &&
> > ldapwhoami -H ldaps:// ldap.host.internal:1636"
> > 
> > Is this something impossible to do, or am I doing something wrong?
> 
> Sorry, I'm a bit swamped at the moment, and I plan to get back to you
> in a bit, but meanwhile, I think the dummy veth trick is unnecessarily
> complicated.
> 
> I think you could simply connect "to the host" and redirect from there
> to the containers by means of mapped ports. See:
> 
>   https://blog.podman.io/2024/10/podman-5-3-changes-for-improved-networking-experience-with-pasta/
> 
> for a couple of details. But I'll try to come up with a full example
> next.


-- 
Felix Rubio