krun: Can't Port Forward Privileged Ports with `passt`
- Dominant language
- C
- Stars
- 4.1k
- Forks
- 444
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 43
Description
Trying to forward a privileged port in a container does not seem to work with `krun`+`passt`. For example, both the following work:
```sh
podman run --rm -p 10000:100 alpine nc -l -p 100 # regular container
podman run --runtime krun --rm -p 10000:100 alpine nc -l -p 100 # krun with TSI
```
However, this does not:
```sh
podman run --runtime krun --annotation krun.use_passt=1 --rm -p 10000:100 alpine nc -l -p 100
```
Reading or writing after connecting to the host forwarded port (`:10000` in this example) fails with an `ECONNRESET`:
```
$ strace bash -c 'echo "hello, container" >/dev/tcp/localhost/10000'
...
connect(3, {sa_family=AF_INET6, sin6_port=htons(10000), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 0
...
writev(1, [{iov_base="hello, container", iov_len=16}, {iov_base="\n", iov_len=1}], 2) = -1 ECONNRESET (Connection reset by peer)
...
```
Port forwarding of a non-privileged port does not have any issues:
```sh
podman run --runtime krun --annotation krun.use_passt=1 --rm -p 10000:1024 alpine nc -l -p 1024
```
Contributor guide
Research direction
Reproduce the failure with the krun.use_passt=1 command forwarding host port 10000 to container port 100, then compare it with the working TSI and non-privileged-port cases. Trace the passt port-forwarding path for privileged ports; done means connections to the forwarded privileged port no longer reset while the existing cases continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100