From 0994285f53f652fb9095d77275729297e422e55d Mon Sep 17 00:00:00 2001 From: Manuel Menegazzo Date: Fri, 4 Sep 2026 16:31:06 +0200 Subject: [PATCH] Handled podman netns = host configuration Signed-off-by: Manuel Menegazzo --- pkg/standalone/container.go | 13 +++++++++++++ pkg/standalone/standalone.go | 4 ++++ pkg/standalone/standalone_test.go | 5 +++++ 3 files changed, 22 insertions(+) diff --git a/pkg/standalone/container.go b/pkg/standalone/container.go index 545f7300a7..c6405afe17 100644 --- a/pkg/standalone/container.go +++ b/pkg/standalone/container.go @@ -98,6 +98,19 @@ func confirmContainerIsRunningOrExists(containerName string, isRunning bool, run return true, nil } +// publishPortNetworkArgs returns the extra network args needed so that -p +// mappings are honoured when the CLI does not pass an explicit --network. +// podman applies the containers.conf netns default (e.g. netns="host"), which +// silently drops every -p; "private" forces a fresh netns (bridge for rootful, +// pasta/slirp4netns for rootless), i.e. podman's own default. docker has no +// such override and does not accept "private", so it gets nothing. +func publishPortNetworkArgs(runtimeCmd string) []string { + if runtimeCmd == string(utils.PODMAN) { + return []string{"--network", "private"} + } + return nil +} + func isContainerRunError(err error) bool { if exitError, ok := err.(*exec.ExitError); ok { exitCode := exitError.ExitCode() diff --git a/pkg/standalone/standalone.go b/pkg/standalone/standalone.go index 5f505ca62e..9cd850a820 100644 --- a/pkg/standalone/standalone.go +++ b/pkg/standalone/standalone.go @@ -437,6 +437,7 @@ func runZipkin(wg *sync.WaitGroup, errorChan chan<- error, info initInfo) { "--network", info.dockerNetwork, "--network-alias", DaprZipkinContainerName) } else { + args = append(args, publishPortNetworkArgs(runtimeCmd)...) args = append( args, "-p", "9411:9411") @@ -498,6 +499,7 @@ func runRedis(wg *sync.WaitGroup, errorChan chan<- error, info initInfo) { "--network", info.dockerNetwork, "--network-alias", DaprRedisContainerName) } else { + args = append(args, publishPortNetworkArgs(runtimeCmd)...) args = append( args, "-p", "6379:6379") @@ -599,6 +601,7 @@ func runPlacementService(wg *sync.WaitGroup, errorChan chan<- error, info initIn osPort = 6050 } + args = append(args, publishPortNetworkArgs(runtimeCmd)...) args = append(args, "-p", fmt.Sprintf("%v:50005", osPort), "-p", fmt.Sprintf("%v:8080", healthPort), @@ -710,6 +713,7 @@ func runSchedulerService(wg *sync.WaitGroup, errorChan chan<- error, info initIn osPort = 6060 } + args = append(args, publishPortNetworkArgs(runtimeCmd)...) args = append(args, "-p", fmt.Sprintf("%v:50006", osPort), "-p", fmt.Sprintf("%v:2379", schedulerEtcdPort), diff --git a/pkg/standalone/standalone_test.go b/pkg/standalone/standalone_test.go index 7600547c4c..f18a0ac8bf 100644 --- a/pkg/standalone/standalone_test.go +++ b/pkg/standalone/standalone_test.go @@ -407,3 +407,8 @@ func TestIsSchedulerIncluded(t *testing.T) { }) } } + +func TestPublishPortNetworkArgs(t *testing.T) { + assert.Equal(t, []string{"--network", "private"}, publishPortNetworkArgs("podman")) + assert.Nil(t, publishPortNetworkArgs("docker")) +}