containers / containers/crun

krun: Can't Port Forward Privileged Ports with `passt`

Open
#2,251 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
4.1k
Forks
444
Avg merge
1d 18h
Merged PRs (30d)
43

Description

Trying to forward a privileged port in a container does not seem to work with `krun`+`passt`. For example, both the following work:

```sh
podman run --rm -p 10000:100 alpine nc -l -p 100 # regular container
podman run --runtime krun --rm -p 10000:100 alpine nc -l -p 100 # krun with TSI
```

However, this does not:

```sh
podman run --runtime krun --annotation krun.use_passt=1 --rm -p 10000:100 alpine nc -l -p 100
```

Reading or writing after connecting to the host forwarded port (`:10000` in this example) fails with an `ECONNRESET`:

```
$ strace bash -c 'echo "hello, container" >/dev/tcp/localhost/10000'
...
connect(3, {sa_family=AF_INET6, sin6_port=htons(10000), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 0
...
writev(1, [{iov_base="hello, container", iov_len=16}, {iov_base="\n", iov_len=1}], 2) = -1 ECONNRESET (Connection reset by peer)
...
```

Port forwarding of a non-privileged port does not have any issues:

```sh
podman run --runtime krun --annotation krun.use_passt=1 --rm -p 10000:1024 alpine nc -l -p 1024
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the krun.use_passt=1 command forwarding host port 10000 to container port 100, then compare it with the working TSI and non-privileged-port cases. Trace the passt port-forwarding path for privileged ports; done means connections to the forwarded privileged port no longer reset while the existing cases continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.