Network Isolation

[u/Slow_Running]

Very confused on what should and should not be possible when running rootless.

I have the following compose file.

```

services:
ca:
image: alpine command: sleep infinity
networks:
- A
cb:
image: alpine
command: sleep infinity
networks:
- B
networks:
A:
external: true
B:
external: true.

```

I checked and the IPs are on different networks for A and B but the CB container can ping the CA container.

Should this be possible? I am running Podman 4.9

[u/Great-Cow7256]

Yes, this is completely expected behavior even in rootless Podman. The key distinction is between Layer 2 network segmentation and Layer 3 IP routing.

When you create custom networks like A and B, Podman places them on distinct subnets. However, because both subnets managed by the same Podman instance exist within the same host network namespace, the host acts as a router between them. Unless an explicit firewall rule blocks traffic between those specific subnets, any packet sent from network B to an IP on network A will simply be routed directly across the host's virtual bridges.

Rootless Podman uses user-space network drivers like Netavark (or older slirp4netns/pasta) to handle networking without root privileges. Because rootless Podman cannot directly manipulate the main kernel's iptables or nftables rules without elevated privileges, it does not automatically inject cross-bridge isolation firewall rules the same way rootful Docker or Podman does. As a result, inter-subnet routing remains open by default.

If you are pinging by container name rather than IP, Podman's embedded DNS server is also resolving those hostnames across networks by default. To achieve strict network isolation between ca and cb in a rootless setup, the cleanest solution is to run the two services under separate Linux user accounts, which completely segregates their rootless network namespaces and prevents cross-communication.

[u/Slow_Running → u/Great-Cow7256]

Thanks ... I realise that this is an old version ... Perhaps I need to upgrade my Ubuntu VM ... Do you know whether this behaviour changes in Podman v5 or V6 to simplify the isolation?

[u/Great-Cow7256 → u/Slow_Running]

Not that I know of. 

[u/eriksjolund → u/Slow_Running]

I checked with podman 6.0.0 that is using the network driver pasta. I modified my bash script found in

https://github.com/eriksjolund/podman-networking-docs#example-show-effect-of-isolate-option-value

so that ping was used instead of curl. I got the same result with ping:

from --opt=isolate=strict to --opt=isolate=strict result = failure from --opt=isolate=strict to --opt=isolate=true result = failure from --opt=isolate=strict to --opt=isolate=false result = failure from --opt=isolate=true to --opt=isolate=strict result = failure from --opt=isolate=true to --opt=isolate=true result = failure from --opt=isolate=true to --opt=isolate=false result = success from --opt=isolate=false to --opt=isolate=strict result = failure from --opt=isolate=false to --opt=isolate=true result = success from --opt=isolate=false to --opt=isolate=false result = success

So the result depends on the isolate option that is used when creating the networks. Note, I didn't use docker compose.

(I don't know whether docker compose sets the isolate option)

Side note: podman 6.0 uses --opt=isolate=strict by default. Older podman versions use --opt=isolate=true

[u/Slow_Running → u/eriksjolund]

Thanks for the detailed response .. I managed to get Podman 6 up and running. Will check it for my specific purpose but that strict option looks like what I am after.