netavark and rootless containers

[mskarbek]

Following cabal meeting - what about rootless networking? Right now if I want "proper" network inside rootless container I can start it with --network=none to skip slirp4netns and attach CNI configuration using cnitool as root. Will netavark have something to offer in that area?

[Luap99]

You can already use CNI rootless, just run podman network create mynet && podman run --network mynet alpine ip a. This will setup a special rootless network namespace which is used to execute the cni plugins. If you create more contianers on this network they can communicate just like rootful networking. The only difference is that the ips are not routable from the host and because we are in another namespace macvlan cannot use your host devices

For netavark the same commands will work as well.

[mheon]

I think the question is about avoiding rootless CNI in favor of CNI as root - I don't think we offer anything in that area. Worth a feature request, I think?