Rootless Podman Port Publishing Defaults and Interface Binding Behavior

Rootless Port Binding Behavior

When using -p 8080:80 in rootless Podman, the effective listening address is 0.0.0.0. This means the service is bound to all available network interfaces on the host, making it accessible to any device that can reach the host's IP address, provided no external firewall blocks the traffic.

Restricting Access to Loopback

Binding explicitly to 127.0.0.1:8080:80 fully prevents slirp4netns (the default rootless network stack) from creating listeners on external-facing interfaces. In rootless mode, Podman manages the port mapping via a user-mode network stack rather than kernel-level iptables rules. By specifying the loopback IP, you instruct the stack to only accept connections originating from the host itself.

Implementation Pattern

To guarantee a service remains internal without relying on host-level firewall management, use the following explicit binding pattern:

podman run -d -p 127.0.0.1:8080:80 --name internal-service nginx

Runtime Verification

To verify that no unintended interfaces are bound, execute the following command on the host machine:

ss -tulpn | grep :8080

Expected Result: The output should show 127.0.0.1:8080. If you see 0.0.0.0:8080 or *:8080, the service is exposed to the network.

Technical Assumptions and Constraints

• Privileged Ports: This configuration assumes the use of ports above 1024. If you require ports below 1024, you must first adjust the host sysctl: sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80.
• Network Stack: This behavior is based on the standard slirp4netns implementation used in most rootless Podman installations.
• Firewall Layering: While binding to 127.0.0.1 prevents the application from listening on external interfaces, host-level firewalls (nftables/iptables) act as a secondary, independent layer of security.

Diagnostic Note: To provide a more tailored recommendation, please specify if you are using a custom network backend (such as pasta) instead of slirp4netns, as interface handling may vary.