how to replace slirp4netns with pasta for custom networks?

[iKloudly]

Hi, I'm not sure if I understand how Network Backend works, but I'm currently using:

[vagrant@yellow ~]$ cat /etc/os-release 
NAME="Red Hat Enterprise Linux"
VERSION="9.2 (Plow)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="9.2"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Red Hat Enterprise Linux 9.2 (Plow)"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9"
BUG_REPORT_URL="https://bugzilla.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
REDHAT_BUGZILLA_PRODUCT_VERSION=9.2
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.2"

[vagrant@yellow ~]$ podman --version
podman version 4.9.4-rhel

I've done:

1. sudo yum install -y podman passt
2. cp /usr/share/containers/containers.conf /etc/containers/containers.conf
3. modified /etc/containers/containers.conf for the line #default_rootless_network_cmd = "" to be default_rootless_network_cmd = "pasta" instead
4. podman system reset

After the reset, I checked ps aux | grep pasta, and I saw:

[vagrant@yellow ~]$ ps aux | grep pasta
vagrant    28772  0.0  0.5  74408 43108 ?        Ss   20:15   0:00 /usr/bin/pasta --config-net -t none -u none -T none -U none --no-map-gw --netns /proc/28759/ns/net
vagrant    29736  0.0  0.5  74408 42976 ?        Ss   20:15   0:00 /usr/bin/pasta --config-net -t none -u none -T none -U none --no-map-gw --netns /proc/29723/ns/net
vagrant    33237  0.0  0.5  74404 43140 ?        Ss   20:16   0:00 /usr/bin/pasta --config-net -t none -u none -T none -U none --no-map-gw --netns /proc/33224/ns/net
vagrant    33598  0.0  0.5  74404 43364 ?        Ss   20:16   0:00 /usr/bin/pasta --config-net -t none -u none -T none -U none --no-map-gw --netns /proc/33586/ns/net

Although I haven't started any containers (weird O_O).
Anyhow, then I've done:

podman run -d --name busybox-pasta --network pasta busybox sh -c "while true; do sleep 3600; done"

which then I was able to see:

[vagrant@yellow ~]$ ps aux | grep pasta
vagrant    28772  0.0  0.5  74408 43108 ?        Ss   20:15   0:00 /usr/bin/pasta --config-net -t none -u none -T none -U none --no-map-gw --netns /proc/28759/ns/net
vagrant    29736  0.0  0.5  74408 42976 ?        Ss   20:15   0:00 /usr/bin/pasta --config-net -t none -u none -T none -U none --no-map-gw --netns /proc/29723/ns/net
vagrant    33237  0.0  0.5  74404 43140 ?        Ss   20:16   0:00 /usr/bin/pasta --config-net -t none -u none -T none -U none --no-map-gw --netns /proc/33224/ns/net
vagrant    33598  0.0  0.5  74404 43364 ?        Ss   20:16   0:00 /usr/bin/pasta --config-net -t none -u none -T none -U none --no-map-gw --netns /proc/33586/ns/net
vagrant    35752  0.0  0.5  74408 40632 ?        Ss   20:46   0:00 /usr/bin/pasta --config-net -t none -u none -T none -U none --no-map-gw --netns /run/user/1000/netns/netns-8ceeeabd-9c1c-97a2-c013-b1a9f17259d0
vagrant    35755  0.0  0.0  11220  2128 ?        Ss   20:46   0:00 /usr/bin/conmon --api-version 1 -c 5da56bc9410f9495754f1de021b46496ee8d7a166062174a4e44ea5ad2cfe7d7 -u 5da56bc9410f9495754f1de021b46496ee8d7a166062174a4e44ea5ad2cfe7d7 -r /usr/bin/runc -b /home/vagrant/.local/share/containers/storage/overlay-containers/5da56bc9410f9495754f1de021b46496ee8d7a166062174a4e44ea5ad2cfe7d7/userdata -p /run/user/1000/containers/overlay-containers/5da56bc9410f9495754f1de021b46496ee8d7a166062174a4e44ea5ad2cfe7d7/userdata/pidfile -n busybox-pasta --exit-dir /run/user/1000/libpod/tmp/exits --full-attach -s -l journald --log-level warning --syslog --runtime-arg --log-format=json --runtime-arg --log --runtime-arg=/run/user/1000/containers/overlay-containers/5da56bc9410f9495754f1de021b46496ee8d7a166062174a4e44ea5ad2cfe7d7/userdata/oci-log --conmon-pidfile /run/user/1000/containers/overlay-containers/5da56bc9410f9495754f1de021b46496ee8d7a166062174a4e44ea5ad2cfe7d7/userdata/conmon.pid --exit-command /usr/bin/podman --exit-command-arg --root --exit-command-arg /home/vagrant/.local/share/containers/storage --exit-command-arg --runroot --exit-command-arg /run/user/1000/containers --exit-command-arg --log-level --exit-command-arg warning --exit-command-arg --cgroup-manager --exit-command-arg systemd --exit-command-arg --tmpdir --exit-command-arg /run/user/1000/libpod/tmp --exit-command-arg --network-config-dir --exit-command-arg  --exit-command-arg --network-backend --exit-command-arg netavark --exit-command-arg --volumepath --exit-command-arg /home/vagrant/.local/share/containers/storage/volumes --exit-command-arg --db-backend --exit-command-arg sqlite --exit-command-arg --transient-store=false --exit-command-arg --runtime --exit-command-arg runc --exit-command-arg --storage-driver --exit-command-arg overlay --exit-command-arg --events-backend --exit-command-arg journald --exit-command-arg container --exit-command-arg cleanup --exit-command-arg 5da56bc9410f9495754f1de021b46496ee8d7a166062174a4e44ea5ad2cfe7d7
vagrant    35782  0.0  0.0   6408  2180 pts/0    R+   20:46   0:00 grep --color=auto pasta

So I can see that I've started this container using the pasta network.

However, I have a custom network that I created:

[vagrant@yellow ~]$ podman network create --subnet 192.100.101.1/24 RED
RED
[vagrant@yellow ~]$ podman network inspect RED
[
     {
          "name": "RED",
          "id": "63e0990ee58dd1e36771b9dcf46df66fd97b4be079e7d0a383e06f7e2be43112",
          "driver": "bridge",
          "network_interface": "podman1",
          "created": "2024-06-11T20:47:12.761579685Z",
          "subnets": [
               {
                    "subnet": "192.100.101.0/24",
                    "gateway": "192.100.101.1"
               }
          ],
          "ipv6_enabled": false,
          "internal": false,
          "dns_enabled": true,
          "ipam_options": {
               "driver": "host-local"
          }
     }
]

And I'd like to use this network for my flask application container, so something like:
podman run -d --name RED-container --network RED -P localhost/flask-app

but if I deploy the container like that (specifying RED as network), it'd spawn the container with slirp4netns network still, because after deploying the container I can check:

[vagrant@yellow ~]$ ps aux | grep slirp
vagrant    35828  0.0  0.0   4940  2760 pts/0    S    20:48   0:00 /usr/bin/slirp4netns --disable-host-loopback --mtu=65520 --enable-sandbox --enable-seccomp --enable-ipv6 -c -r 3 --netns-type=path /run/user/1000/netns/rootless-netns-bc09e53cdfbc5f1a303d tap0

which wasn't visible before.

So my busybox did run with pasta network backend, but my flask-app still ran with slirp4netns even though I specified default_rootless_network_cmd = "pasta"

Is there a way for me to do something like podman run -d --name RED-container --network pasta RED -P localhost/flask-app where I can both specify pasta AND the custom network I created?
Or am I misunderstanding the concept of network backend (it's not supposed to be used w/ a custom defined network..?)

Any explanations would be highly appreciated, thank you so much in advance!

[Luap99]

use podman 5.0 where pasta support for the rootless-netns logic was added

[Luap99]

That makes me wonder though, are you saying that version < v5.0.0 all do not support rootless-netns logic for pasta, although it can still use pasta?

--network pasta works before 5.0, --network bridge also does but it was hard coded to slirp4netns until 5.0 so the setting has no effect

[Luap99]

Also podman 5.X should be part of the next RHEL 9.5 release

[iKloudly]

Interesting! Thank you for that.

I've tried to dig into the source code to find where how --network flag works (or how it's hard-coded in I guess) actually, but didn't have much luck. Is it possible for you to share the path to this harded coded codes by any chance?
Thanks once again..!

[Luap99]

well you first have to make sure you look at the old 4.X code, if you just look at the current code it will of course work

here is the PR that added pasta support to the rootless netns containers/common#1846

[iKloudly]

This is awesome, thank you so much once again.
For the last time, if I may..
So it seems like as for my rootful podman, it is currently using netavark as its default networkBackend.
Does netavark use iptables? Just wondering how the network is "under the hood".

Again, thank you very, very much for all your help. It's been extremely helpful <3.

[jacobwhall]

Now that 5.x is released, I'd like to know how to do the same thing, but in reverse: I have an existing custom network and I don't want my rootless containers to switch to pasta.

[Luap99]

As mentioned under the pasta section here there is containers.conf field to switch the default.

But there is no way to only have this for one custom network, there is only one pasta/slirp4netns process for all networks, see #22943 (comment)

[jacobwhall]

Thanks for the clarification, I hadn't fully understood that it was one process for all networks.