Setting up rootless container connection to host using Pasta

[KazWar]

I'm struggling with setting up a simple connection to my host networks database using Pasta. It works fine when I use the host network setting, but I've red that that one is considered unsecure so i'm hoping to use a better alternative. However unfortunately I've got extremely limited experience with Podman, docker or containerization in general. So help would be greatly appreciated.

In general I think that I have the correct pieces, but either I'm misconfiguring something, or just greatly misunderstanding something. As a note I started with Podman 4.9 (Highest Ubuntu apt-get installed) and went over to 5.3 by building from source, alongside upgrading crun & passt itself to allow for --map-guest-addr. So I possibly imagine a high likelihood of having missed something in that migration which could be the source of the problem.

The problem

Using

podman run -dt --name kimai2 -p 8001:8001 -p 9000:80 --network pasta:--map-guest-addr,10.0.0.1 -e 'DATABASE_URL=mysql://kimai:[email protected]:3306/kimai?charset=utf8mb4&serverVersion=10.11.8' docker.io/kimai/kimai2:apache

I am unable to get a connection to my hosts database. The container with the following log error

+ sleep 3
+ php /dbtest.php host.containers.internal kimai 3306 kimai MyPasswordHere
+ echo Checking DB: 10 Connection timed out (?)

If I grep into the hosts, I can see the host.containers.internal inside the container

So other than that I have no idea what is missing.

Podman info

kazik@hosting:/$ podman info
host:
  arch: amd64
  buildahVersion: 1.38.0-dev
  cgroupControllers:
  - cpu
  - memory
  - pids
  cgroupManager: cgroupfs
  cgroupVersion: v2
  conmon:
    package: conmon_2.1.10+ds1-1build2_amd64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: unknown'
  cpuUtilization:
    idlePercent: 99.91
    systemPercent: 0.03
    userPercent: 0.06
  cpus: 16
  databaseBackend: sqlite
  distribution:
    codename: noble
    distribution: ubuntu
    version: "24.04"
  eventLogger: file
  freeLocks: 2040
  hostname: MyHostName
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1010
      size: 1
    - container_id: 1
      host_id: 165536
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1010
      size: 1
    - container_id: 1
      host_id: 165536
      size: 65536
  kernel: 6.8.0-47-generic
  linkmode: dynamic
  logDriver: k8s-file
  memFree: 59854606336
  memTotal: 66490650624
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns_1.4.0-5_amd64
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 1.4.0
    package: netavark_1.4.0-4_amd64
    path: /usr/lib/podman/netavark
    version: netavark 1.4.0
  ociRuntime:
    name: crun
    package: Unknown
    path: /usr/local/bin/crun
    version: |-
      crun version 1.18.2.0.0.0.1-0183
      commit: 01830cb038fe970fbd86856fe746fbea0eabfe28
      rundir: /run/user/1010/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
  os: linux
  pasta:
    executable: /usr/local/bin/pasta
    package: Unknown
    version: |
      pasta 2024_10_30.ee7d0b6
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1010/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns_1.2.1-1build2_amd64
    version: |-
      slirp4netns version 1.2.1
      commit: 09e31e92fa3d2a1d3ca261adaeb012c8d75a8194
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.5
  swapFree: 33268166656
  swapTotal: 33268166656
  uptime: 74h 11m 57.00s (Approximately 3.08 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /home/kazik/.config/containers/storage.conf
  containerStore:
    number: 1
    paused: 0
    running: 0
    stopped: 1
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/kazik/.local/share/containers/storage
  graphRootAllocated: 468702478336
  graphRootUsed: 17910800384
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 5
  runRoot: /run/user/1010/containers
  transientStore: false
  volumePath: /home/kazik/.local/share/containers/storage/volumes
version:
  APIVersion: 5.3.0-dev
  Built: 1730420647
  BuiltTime: Fri Nov  1 01:24:07 2024
  GitCommit: de990415a2457ebedc07afe86f079e842fa1ba0a
  GoVersion: go1.22.6
  Os: linux
  OsArch: linux/amd64
  Version: 5.3.0-dev

Ip addr

Obfuscated Server ip. Docker0 is presumably left behind by previously installed docker extension.

kazik@hosting:/$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
       valid_lft forever preferred_lft forever
2: enp6s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether MyMACAddress brd ff:ff:ff:ff:ff:ff
    inet MyServerIP/32 scope global enp6s0
       valid_lft forever preferred_lft forever
    inet6 MyMACAddress::2/64 scope global
       valid_lft forever preferred_lft forever
    inet6 MyMACAddress:5025/64 scope link
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:1d:df:1e:d7 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever

IP Route

Obfuscated Server ip. 172.17.0.0/16 is presumably left behind by previously installed docker extension.

kazik@hosting:/$ ip route
default via XX.XX.XX.XX dev enp6s0 proto static onlink
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown

Network inspect

[sbrivio-rh]

It works fine when I use the host network setting

Is your database server configured to only accept connections from/to a loopback address? In that case, you would need to replace --map-guest-addr with --map-host-loopback, so that the source and destination addresses are loopback addresses, instead of global addresses configured on the host.