5:33 a.m.
Hi all,
We have a bunch of rootless containers running as a non-privileged user on a Ubuntu 22.04
server under Podman 4.5.0.
One of them is running Browserless Chrome to render PDFs of the output of a Django-served
URL of another container.
The Django container is set up so that its CSS/JS/etc. static files are stored on the host
machine and served by the host's Nginx. To correctly display the styles, Chrome
therefore needs to access the endpoint via the public URL of the site.
This is not working, because any connection attempts to the public IP from within any of
the running containers fail with a Connection Refused error:
- - - -
$ curl -vvv https://our.nice.site
* Trying <redacted IPv6>:443...
* connect to <redacted IPv6> port 443 failed: Connection refused
* Trying <redacted IPv4>:443...
* connect to <redacted IPv4> port 443 failed: Connection refused
* Failed to connect to our.nice.site port 443: Connection refused
* Closing connection 0
curl: (7) Failed to connect to our.nice.site port 443: Connection refused
- - - -
The host itself is, of course, able to access itself with the public URL/IP just fine;
this only occurs inside the containers. The containers are also able to access any other
public URL, just not the one pointing to the host's own public IP.
We're using pasta networking. All containers are set up with quadlet. Here's the
Chrome container's quadlet generator:
- - - -
[Unit]
Description=Browserless Chrome
Wants=network-online.target
After=network-online.target
[Container]
Image=browserless/chrome:1.59.0-chrome-stable
ContainerName=browserless-chrome
Network=pasta:-t,auto,-T,auto
LogDriver=journald
[Install]
WantedBy=default.target
- - - -
All the other containers also use "Network=pasta:-t,auto,-T,auto". I tried to
add --map-gw to the command line, since it seemed possibly relevant, but without success.
"Network=pasta:--map-gw,-t,auto,-T,auto" failed on container startup with this
error:
Error: failed to start pasta:
Port forwarding mode 'none' conflicts with previous mode
"Network=pasta:-t,auto,-T,auto,--map-gw" started the container fine, but did not
fix the Connection Refused error.
Finally, the contents of containers.conf:
- - - -
[containers]
log_driver="journald"
tz="local"
[network]
network_backend="netavark"
[engine]
runtime="crun"
- - - -
Is this a bug, a misconfiguration on my part, or an intentional security feature of Podman
networking and/or Podman with pasta, specifically? Is there any way for the containers to
access the hosts's public IP? If not, we'll need to arrange some kind of awkward
static file serving container for use by the Chrome container, but we'd really like to
avoid that.
- JL