RHEL8 and rootful network issues

[smalenfant]

Under Rocky Linux 9 and RHEL8, podman container created with default "podman" network doesn't seem to be working by default (cni backend). I've tried multiple thing but it seems like this should work out of the box. From captures, looks like it's not being natted and never makes it out of the server.

This used to work by default with docker.

I've searched and tried things for hours with no success. It works when creating a rootless container due to using slirp4netns but the container needs to run as root.

It works with netavark but the vendor requires CNI.

# podman network inspect podman
[
     {
          "name": "podman",
          "id": "2f259bab93aaaaa2542ba43ef33eb990d0999ee1b9924b557b7be53c0b7a1bb9",
          "driver": "bridge",
          "network_interface": "cni-podman0",
          "created": "2024-09-25T16:26:39.889489567Z",
          "subnets": [
               {
                    "subnet": "10.88.0.0/16",
                    "gateway": "10.88.0.1"
               }
          ],
          "ipv6_enabled": false,
          "internal": false,
          "dns_enabled": false,
          "ipam_options": {
               "driver": "host-local"
          }
     }
]

iptables output:

# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 7484  764K CNI-FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* CNI firewall plugin rules */

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain CNI-FORWARD (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 7484  764K CNI-ADMIN  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* CNI firewall plugin admin overrides */
 3282  447K ACCEPT     all  --  *      *       0.0.0.0/0            10.88.0.9            ctstate RELATED,ESTABLISHED
 3286  218K ACCEPT     all  --  *      *       10.88.0.9            0.0.0.0/0           

Chain CNI-ADMIN (1 references)
 pkts bytes target     prot opt in     out     source               destination         

[Luap99]

We no longer support CNI upstream as we removed/disabled the CNI integration code with v5.0.