Disabling host access from containers with pasta networking

[aze31130]

Hello Podman community!

I'm deploying multiple services with Podman and noticed that all my containers are able to reach the host and access its exposed services using the host.containers.internal (169.254.1.2) address.

Example:

# On host
► sudo systemctl start sshd
► podman run --rm -it netshoot

# Inside container
db127ff8623f  ~  nc -vz host.containers.internal 22
Connection to host.containers.internal (169.254.1.2) 22 port [tcp/ssh] succeeded!

After checking the pasta configuration, I saw that Podman starts pasta with both --no-map-gw and --map-guest-addr 169.254.1.2, which appears to enable this container-to-host connectivity:

# On host
► ps auxww | grep pasta

/usr/bin/pasta --config-net --pid /run/user/1000/containers/networks/rootless-netns/rootless-netns-conn.pid --dns-forward 169.254.1.1 -t none -u none -T none -U none --no-map-gw --quiet --netns /run/user/1000/containers/networks/rootless-netns/rootless-netns --map-guest-addr 169.254.1.2

Is there a safe way to disable or remove the --map-guest-addr 169.254.1.2 argument so that containers cannot reach the host?
Should container-to-host communication (via host.containers.internal) be enabled by default or is this considered expected behavior ?

Thanks in advance for any insights!

[eriksjolund]

See answer from @sbrivio-rh here:
https://www.reddit.com/r/podman/comments/1kiez3d/restrict_access_to_the_host_nonroot_pasta/

[aze31130]

Hello eriksjolund,

Thank you for your response. After checking in the cli that --map-guest-addr none effectively prevents the connection, I added it to my /etc/containers/containers.conf file.

# Before
► ps auxww | grep pasta
/usr/bin/pasta --config-net --pid /run/user/1000/containers/networks/rootless-netns/rootless-netns-conn.pid --dns-forward 169.254.1.1 -t none -u none -T none -U none --no-map-gw --quiet --netns /run/user/1000/containers/networks/rootless-netns/rootless-netns --map-guest-addr 169.254.1.2

# After
► ps auxww | grep pasta
/usr/bin/pasta --config-net --map-guest-addr none --pid /run/user/1000/containers/networks/rootless-netns/rootless-netns-conn.pid --dns-forward 169.254.1.1 -t none -u none -T none -U none --no-map-gw --quiet --netns /run/user/1000/containers/networks/rootless-netns/rootless-netns

Problem solved, you're a legend !