Can't listen on port with --network ns?

[simolus3]

I'm trying to understand container networking with a simple example where I manage the network namespace myself and let a container join it. However, it seems like listening on the loopback interface in the namespace has no effect in the container and I don't understand why.

# running this as root
ip netns add test
ip -n test link set lo up

ip netns exec test nc -l 4040
ip netns exec test nc 127.0.0.1 4040 # works!

When I try to do the same in a container however, it seems as listening has no effect:

podman run -ti --network ns:/var/run/netns/test --name test docker.io/library/alpine nc -l 4040
podman exec -ti test nc 127.0.0.1 4040 # doesn't work, immediately exists with 1

Interestingly, when I run nc -l 4040 in the namespace but outside of the container, I can connect inside the container just fine. It just seems like listening on the loopback interface in the container doesn't work. What am I missing?

[mheon]

Are you running Podman as root or rootless?

[simolus3]

I ran all commands as root. Otherwise I wouldn't be able to do --network ns I think?

[mheon]

Out of curiousity: what OCI runtime are you using (should be reported in podman info).

My current suspicion is that podman exec is not properly joining the network namespace of the container, which could be an OCI runtime bug.

[simolus3]

Thanks for looking into this! podman info says my OCI runtime is crun.

My current suspicion is that podman exec is not properly joining the network namespace of the container

FWIW both of these work:

• Listening in the namespace, but outside of the container; connecting in podman run
• Listening in the namespace, but outside of the container, starting a new detached container in the same namespace, then connecting through a separate podman exec call in the same container.

It's just that doing nc -l in the container (both through podman run and through podman exec) seems to create a socket server I can't connect to (both inside and outside of the container in the same network ns).

[Luap99]

Your test is wrong. The nc binary from the alpine image does not listen on port 4040. You have to use nc -l -p 4040 to make it use the correct port.
You can check with podman exec test netstat -tlp

[simolus3]

You're right, thank you so much! Apologies for the confusion then.