podman not binding published port to IPv4 address in rootless mode, only IPv6.

[ad-on-is]

Maybe a stupid question, but I couldn't find any info on this one.

Say I run the following: podman run -d -p 8080:80 --name nginx nginx:latest

`netstat -tulpn`` gives the following

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp6       0      0 :::22                   :::*                    LISTEN      -
tcp6       0      0 :::8080                 :::*                    LISTEN      17201/rootlessport
udp        0      0 127.0.0.1:323           0.0.0.0:*                           -
udp6       0      0 ::1:323                 :::*                                -

As you can see, it only binds to the IPv6, but not IPv4. This results in not being able to access the server from the LAN (http://192.168.1.20:8080).

On the other hand, if I run the same command as sudo podman run -d -p 8080:80 --name nginx nginx:latest this works just fine, since it binds to IPv4

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      -
tcp6       0      0 :::22                   :::*                    LISTEN      -
udp        0      0 127.0.0.1:323           0.0.0.0:*                           -
udp6       0      0 ::1:323                 :::*                                -

Am I missing something here?

[Luap99]

netstat is deprecated and "lying" to you in this case, please use ss then you will see that we correctly bind mount dual stack (ipv4 and ipv6) in this case.
Running curl http://127.0.0.1:8080/ will prove that it correctly listens on ipv4.

You are likely missing that you have to open the port in your firewall. As rootless we have no permissions to reconfigure the firewall so this needs extra configuration on the system.

[ad-on-is]

Actually, I also couldn't access the website from another PC within the same LAN. That's how I noticed it in the first place.

So, if I understand correctly, running podman as root, does two things, it publishes the port AND modifies the firewall, right? This then makes sence.

Sorry, but I was confused by the fact that netstat "lied" to me, and the fact that rootles didn't modify the firewall, which led me to believe that it's not binding on both ports.

[bingoct]

i also meet this quesiotn in bedian12 (wsl2).

➜ podman -v
podman version 4.9.3
➜ podman run --rm -p 80:80 docker.io/svenstaro/miniserve:alpine -p 80 /
➜ ss -tlnp6
State    Recv-Q   Send-Q       Local Address:Port        Peer Address:Port   Process
LISTEN   0        4096                     *:80                     *:*       users:(("rootlessport",pid=8760,fd=11))
LISTEN   0        128                   [::]:29173               [::]:*
➜ ss -tlnp4
State        Recv-Q        Send-Q               Local Address:Port                Peer Address:Port       Process
LISTEN       0             128                        0.0.0.0:29173                    0.0.0.0:*

how if i use podman machine based on wsl2 ( fedora 39), it works well.

➜ podman -v
podman version 4.9.0
➜ ss -tlnp6
State    Recv-Q   Send-Q       Local Address:Port        Peer Address:Port   Process
LISTEN   0        4096                     *:80                     *:*       users:(("rootlessport",pid=1395,fd=11))
LISTEN   0        128                   [::]:29173               [::]:*
➜ ss -tlnp4
State    Recv-Q   Send-Q       Local Address:Port        Peer Address:Port   Process
LISTEN   0        4096               0.0.0.0:80             0.0.0.0:*       users:(("rootlessport",pid=1395,fd=11))
LISTEN   0        128                0.0.0.0:29173            0.0.0.0:*

For Linux, since the v6only_setting parameter is turned off by default, an IPv6 socket can handle IPv4 traffic as well.

However, there's an annoyance on WSL2: in NAT mode, WSL2 only maps IPv6 ports to ::1 on Windows. And Windows didn't handle ipv6 to ipv4 as default. so if i use http://127.0.0.1 on windows to visit my wsl web service, it fails.

so i just wants to know why podman machine based on wsl2 ( fedora 39) can published both on ipv4 and ipv6. This does not appear to be caused by different podman patch versions, and there is no difference observed in RELEASE_NOTES.

[Luap99]

Because there is special handling for WSL due the "incorrect" networking stack: https://github.com/containers/podman/blob/main/cmd/rootlessport/wsl.go

[bingoct]

thx, it works 😘

# in wsl
➜ echo "wsl" | sudo tee /etc/containers/podman-machine
➜ podman run --rm -p 80:80 docker.io/svenstaro/miniserve:alpine -p 80 /
➜ ss -tlnp
State          Recv-Q         Send-Q                   Local Address:Port                   Peer Address:Port         Process
LISTEN         0              4096                           0.0.0.0:80                          0.0.0.0:*             users:(("rootlessport",pid=16715,fd=5))
LISTEN         0              4096                              [::]:80                             [::]:*             users:(("rootlessport",pid=16715,fd=12))

➜ netstat -ano |rg :80 | rg LISTENING
  TCP    127.0.0.1:80           0.0.0.0:0              LISTENING       3696
  TCP    [::1]:80               [::]:0                 LISTENING       3696

[liuwenlang]

Why is this？
device: macmini m4