Pass a network interface from the host to a container with network=none

[Exagone313]

• This is tested using podman version 5.0.3 and jq, as root
• Create a container image with the ip command installed

   mkdir -m 700 /tmp/fedora-iproute
   echo -e "FROM docker.io/library/fedora:40\nRUN dnf -y install iproute && dnf clean all" > /tmp/fedora-iproute/Dockerfile
   podman build -t localhost/fedora-iproute /tmp/fedora-iproute

• Create an interface you will want to pass to your container, here it's a dummy interface, but it could be a WireGuard interface 😉

   ip link add dummy-foobar type dummy

• Create a container using the image created above and with --network=none

   podman run -it --rm --network=none --name=foobar localhost/fedora-iproute

• Check that only the loopback interface is available

   ip a

   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
   	link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
   	inet 127.0.0.1/8 scope host lo
   	   valid_lft forever preferred_lft forever
   	inet6 ::1/128 scope host proto kernel_lo 
   	   valid_lft forever preferred_lft forever
  

• On another terminal, run this to add a symbolic link to the network namespace (required for ip), as it's not made for containers created with --network=none

   ln -sfT "$(podman inspect foobar | jq -r '.[0].NetworkSettings.SandboxKey')" /run/netns/podman-foobar

• Move the dummy-foobar interface to the network namespace of your container:

   ip link set dummy-foobar netns podman-foobar

• In your container, check that the interface is now available

   ip a

   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
   	link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
   	inet 127.0.0.1/8 scope host lo
   	   valid_lft forever preferred_lft forever
   	inet6 ::1/128 scope host proto kernel_lo 
   	   valid_lft forever preferred_lft forever
   4: dummy-foobar: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000
   	link/ether 3a:66:12:d7:43:fb brd ff:ff:ff:ff:ff:ff
  

• You can now easily create a second container having access to these interfaces

   podman run -it --rm --network=ns:/run/netns/podman-foobar --name=foobar-test localhost/fedora-iproute

   ip a

   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
   	link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
   	inet 127.0.0.1/8 scope host lo
   	   valid_lft forever preferred_lft forever
   	inet6 ::1/128 scope host proto kernel_lo 
   	   valid_lft forever preferred_lft forever
   4: dummy-foobar: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000
   	link/ether 3a:66:12:d7:43:fb brd ff:ff:ff:ff:ff:ff
  

Notes

• the interface seems to disappear when the main container dies, hence the idea to create a second container that you can recreate at will
• for a WireGuard interface, you will need to authenticate and add routes inside the container, so it probably requires a privileged container
  • or you could try to use ip commands on the host using the network namespace
• future work should do the same with a Podman network that can easily be added to multiple containers