Incorrect IP for host.containers.internal when using a bridge network #22644

zanbaldwin · 2024-05-08T16:53:03Z

Issue Description

When running a container on a bridge network, the IP address listed in /etc/hosts file in the container for the hosts host.containers.internal and host.docker.internal is incorrect (even though the host can still be accessed using the correct IP address).

Steps to reproduce the issue

Assuming that I have a HTTP server running on port 1234 on my host machine that returns Host OK.
The image alpine-with-curl is the following Containerfile:

FROM "docker.io/library/alpine:latest"
RUN apk update && apk add curl

When not using a network, the correct IP address of 10.89.0.1 is in /etc/hosts and the cURL command succeeds.

> podman run --rm alpine-with-curl sh -c "cat /etc/hosts && curl http://host.containers.internal:1234"

127.0.0.1       localhost localhost.localdomain localhost4 localhost4.localdomain4
::1     localhost localhost.localdomain localhost6 localhost6.localdomain6
10.89.0.1       host.containers.internal host.docker.internal
192.168.1.174   e2930c13c971 brave_torvalds
Host OK

When attaching the container to a bridge network, an incorrect IP address of 192.168.1.174 is in /etc/hosts and the cURL command fails (that IP happens to be the ethernet address of the host on my home network).

> podman network create demo_network
> podman run --rm --network demo_network alpine-with-curl sh -c "cat /etc/hosts && curl http://host.containers.internal:1234"

127.0.0.1       localhost localhost.localdomain localhost4 localhost4.localdomain4
::1     localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.174   host.containers.internal host.docker.internal
10.89.5.3       5309716d0649 affectionate_jennings
curl: (7) Failed to connect to host.containers.internal port 1234 after 0 ms: Couldn't connect to server

However, using the 10.89.0.1 from before does work:

> podman run --rm --network demo_network alpine-with-curl sh -c "cat /etc/hosts && curl http://10.89.0.1:1234"

127.0.0.1       localhost localhost.localdomain localhost4 localhost4.localdomain4
::1     localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.174   host.containers.internal host.docker.internal
10.89.5.5       8b18f72239cd romantic_mclaren
Host OK

Describe the results you received

Unable to determine from inside the container the correct IP to use to access the host (eg, for remote debugging tools, etc).

Describe the results you expected

I expect the correct IP to access the host from inside the container to be in /etc/hosts.

If this is by design, perhaps for security reasons regarding mixing host and bridge networks, then I would expect using the 10.89.0.1 address to not be able to access the host at all, rather than by obfuscating the value in /etc/hosts.

podman info output

podman info

host:
  arch: amd64
  buildahVersion: 1.35.3
  cgroupControllers:
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.10-1.fc40.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: '
  cpuUtilization:
    idlePercent: 99.36
    systemPercent: 0.25
    userPercent: 0.39
  cpus: 32
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: silverblue
    version: "40"
  eventLogger: journald
  freeLocks: 2025
  hostname: tuffed.home
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
  kernel: 6.8.8-300.fc40.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 56235401216
  memTotal: 66506686464
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.10.0-1.fc40.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.10.0
    package: netavark-1.10.3-3.fc40.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.10.3
  ociRuntime:
    name: crun
    package: crun-1.14.4-1.fc40.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.14.4
      commit: a220ca661ce078f2c37b38c92e66cf66c012d9c1
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20240426.gd03c4e2-1.fc40.x86_64
    version: |
      pasta 0^20240426.gd03c4e2-1.fc40.x86_64
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.2-2.fc40.x86_64
    version: |-
      slirp4netns version 1.2.2
      commit: 0ee2d87523e906518d34a6b423271e4826f71faf
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.3
  swapFree: 8589930496
  swapTotal: 8589930496
  uptime: 1h 8m 2.00s (Approximately 0.04 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  localhost:5000:
    Blocked: false
    Insecure: true
    Location: localhost:5000
    MirrorByDigestOnly: false
    Mirrors: null
    Prefix: localhost:5000
    PullFromMirror: ""
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /var/home/zan/.config/containers/storage.conf
  containerStore:
    number: 15
    paused: 0
    running: 5
    stopped: 10
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/home/zan/.local/share/containers/storage
  graphRootAllocated: 998483427328
  graphRootUsed: 62332846080
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 170
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /var/home/zan/.local/share/containers/storage/volumes
version:
  APIVersion: 5.0.2
  Built: 1713312000
  BuiltTime: Wed Apr 17 02:00:00 2024
  GitCommit: ""
  GoVersion: go1.22.1
  Os: linux
  OsArch: linux/amd64
  Version: 5.0.2

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Additional environment details

Have only tested this issue on x86_64.

Additional information

/etc/containers/containers.conf

[containers]
default_sysctls = [
  "net.ipv4.ping_group_range=0 0",
]

[network]
network_backend = "netavark"
default_rootless_network_cmd = "pasta"
#pasta_options = ["--map-gw"]

[engine]
network_cmd_options = [
    "allow_host_loopback=true"
]

The text was updated successfully, but these errors were encountered:

mheon · 2024-05-09T14:24:01Z

Are you running rootless?

zanbaldwin · 2024-05-09T21:55:42Z

Are you running rootless?

Yes, I'm running rootless.

When did this start happening?

I noticed this bug after I upgraded to Fedora Silverblue 40.

I installed Silverblue 39 on a virtual machine and can confirm that it works as expected (the correct IP address appears in /etc/hosts even when using a bridge network).

podman info on Silverblue 39

host:
  arch: amd64
  buildahVersion: 1.32.0
  cgroupControllers:
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.7-3.fc39.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.7, commit: '
  cpuUtilization:
    idlePercent: 94.91
    systemPercent: 2.55
    userPercent: 2.54
  cpus: 16
  databaseBackend: boltdb
  distribution:
    distribution: fedora
    variant: silverblue
    version: "39"
  eventLogger: journald
  freeLocks: 2048
  hostname: fedora
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
  kernel: 6.5.6-300.fc39.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 597123072
  memTotal: 12226416640
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.7.0-2.fc39.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.7.0
    package: netavark-1.7.0-2.fc39.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.7.0
  ociRuntime:
    name: crun
    package: crun-1.9-1.fc39.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.9
      commit: a538ac4ea1ff319bcfe2bf81cb5c6f687e2dc9d3
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20230908.g05627dc-1.fc39.x86_64
    version: |
      pasta 0^20230908.g05627dc-1.fc39.x86_64
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: false
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.1-1.fc39.x86_64
    version: |-
      slirp4netns version 1.2.1
      commit: 09e31e92fa3d2a1d3ca261adaeb012c8d75a8194
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.3
  swapFree: 8589668352
  swapTotal: 8589930496
  uptime: 0h 7m 0.00s
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /var/home/zan/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/home/zan/.local/share/containers/storage
  graphRootAllocated: 41872785408
  graphRootUsed: 11849957376
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 2
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /var/home/zan/.local/share/containers/storage/volumes
version:
  APIVersion: 4.7.0
  Built: 1695838680
  BuiltTime: Wed Sep 27 20:18:00 2023
  GitCommit: ""
  GoVersion: go1.21.1
  Os: linux
  OsArch: linux/amd64
  Version: 4.7.0

Luap99 · 2024-05-13T10:12:37Z

Duplicate of #22653
The other one has more comments/context

zanbaldwin added the kind/bug Categorizes issue or PR as related to a bug. label May 8, 2024

Luap99 closed this as not planned Won't fix, can't repro, duplicate, stale May 13, 2024

stale-locking-app bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Aug 12, 2024

stale-locking-app bot locked as resolved and limited conversation to collaborators Aug 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Incorrect IP for host.containers.internal when using a bridge network #22644

Incorrect IP for host.containers.internal when using a bridge network #22644

zanbaldwin commented May 8, 2024 •

edited

Loading

mheon commented May 9, 2024

zanbaldwin commented May 9, 2024

Luap99 commented May 13, 2024

Incorrect IP for host.containers.internal when using a bridge network #22644

Incorrect IP for host.containers.internal when using a bridge network #22644

Comments

zanbaldwin commented May 8, 2024 • edited Loading

Issue Description

Steps to reproduce the issue

Describe the results you received

Describe the results you expected

podman info output

Podman in a container

Privileged Or Rootless

Upstream Latest Release

Additional environment details

Additional information

mheon commented May 9, 2024

zanbaldwin commented May 9, 2024

When did this start happening?

Luap99 commented May 13, 2024

zanbaldwin commented May 8, 2024 •

edited

Loading