Ports forwarded on loopback addresses other than 127.0.0.1 are not available on Windows host

chris-vroegop-lloyds commented 5 months ago

Issue Description

Steps to reproduce the issue

Run the following

podman run -it --rm -d -p 127.0.0.1:80:80 --name web nginx
podman run -it --rm -d -p 127.0.0.2:80:80 --name web2 nginx

Describe the results you received

From a browser in the Windows host, I can see an nginx page at http://127.0.0.1 but I get ERR_CONNECTION_REFUSED at http://127.0.0.2.

Describe the results you expected

In the latest Docker Desktop, if I run

docker run -it --rm -d -p 127.0.0.1:80:80 --name web nginx
docker run -it --rm -d -p 127.0.0.2:80:80 --name web2 nginx

I can see nginx pages at http://127.0.0.1 and http://127.0.0.2.

podman info output

host:
  arch: amd64
  buildahVersion: 1.36.0-dev
  cgroupControllers: []
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: conmon-2.1.10-1.20240313132120223048.main.19.gaffab49.fc39.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: '
  cpuUtilization:
    idlePercent: 97.41
    systemPercent: 1.28
    userPercent: 1.32
  cpus: 12
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: container
    version: "39"
  eventLogger: journald
  freeLocks: 2046
  hostname: LLIGBRPF4Z3WQ7
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
  kernel: 5.15.146.1-microsoft-standard-WSL2
  linkmode: dynamic
  logDriver: journald
  memFree: 6367543296
  memTotal: 16604450816
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.10.0-1.20240416130217851236.main.35.g0e82e2e.fc39.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.11.0-dev
    package: netavark-1.10.1-1.20240416130332582612.main.80.g01da96c.fc39.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.11.0-dev
  ociRuntime:
    name: crun
    package: crun-1.14.4-1.20240417160155988547.main.31.g37670c8.fc39.x86_64
    path: /usr/bin/crun
    version: |-
      crun version UNKNOWN
      commit: 69e6a9531a121b9c27463b067095d95801f268db
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20240326.g4988e2b-1.fc39.x86_64
    version: |
      pasta 0^20240326.g4988e2b-1.fc39.x86_64
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: true
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 4294967296
  swapTotal: 4294967296
  uptime: 1h 50m 5.00s (Approximately 0.04 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /home/user/.config/containers/storage.conf
  containerStore:
    number: 2
    paused: 0
    running: 2
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/user/.local/share/containers/storage
  graphRootAllocated: 1081101176832
  graphRootUsed: 816816128
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/user/.local/share/containers/storage/volumes
version:
  APIVersion: 5.1.0-dev-4817811cb
  Built: 1713312000
  BuiltTime: Wed Apr 17 01:00:00 2024
  GitCommit: ""
  GoVersion: go1.21.9
  Os: linux
  OsArch: linux/amd64
  Version: 5.1.0-dev-4817811cb

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Additional environment details

No response

Additional information

I suspect this is a WSL2 networking issue.

github-actions[bot] commented 3 months ago

A friendly reminder that this issue had no activity for 30 days.

chrchr commented 2 months ago

I get the same result Alpine Linux on bare metal, i.e., no virtualization and no WSL. It works as expected with Docker.

Luap99 commented 1 month ago

I get the same result Alpine Linux on bare metal

This should work fine on linux both rootless and as root

$ sudo bin/podman run -d -p 127.0.0.2:8080:80 nginx
6489dce2d37248338a0dd47735f0259143ee18b3bb0b9a3054a222e102daba25
$ curl 127.0.0.2:8080
<!DOCTYPE html>
...

Windows WSL is however a whole other story. We do not do port forwarding on the windows side that is all handled by the WSL build in forwarding logic and if this doesn't support other loopback addresses then this is not something we can fix. There would be the way to use a user space forwarder there which might be what docker is doing but I am not sure how much work this would be

containers / podman