Home / server / Questions / 1151515
Accepted
Jori Mäntysalo
Asked: 2024-01-15 19:05:33 +0800 CST

Unshare and port forwarding into namespace

  • 772

I am playing with unshare to better understand containers. As a normal user, is it possible to make a namespace where a program could listen, say, port 123 and on the "main" namespace a port 1234 would be redirected to it?

I guess it should be, as Podman is rootless container engine and can do it. Looking man veth did not help.

network-namespace

1 Answers

  1. Best Answer

    Podman works by using slirp4netns to manage a tap device inside the unprivileged container. From the README for slirp4netns:

    Starting with Linux 3.8, unprivileged users can create network_namespaces(7) along with user_namespaces(7). However, unprivileged network namespaces had not been very useful, because creating veth(4) pairs across the host and network namespaces still requires the root privileges. (i.e. No internet connection)

    slirp4netns allows connecting a network namespace to the Internet in a completely unprivileged way, by connecting a TAP device in a network namespace to the usermode TCP/IP stack ("slirp").

    In order to achieve your goal, you would need to do something similar.

    • 1