feat: add support for changing default host IPs via containers.conf #27938

danishprakash · 2026-01-23T07:52:04Z

Add support for default_host_ips in containers.conf to set default host IP(s) if no IP is set when forwarding ports. Multiple IPs can be configured, and passing an explicit IP with -p will always override the configured defaults.

Fixes #27186

packit-as-a-service · 2026-01-23T07:55:12Z

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

jankaluza · 2026-01-23T10:41:55Z

@danishprakash , you probably noticed, but this right now does not compile. The code looks OK, I just wanted to test it locally more :-)

danishprakash · 2026-01-23T10:54:55Z

Yes, I guess I can mark it as such? This is dependent on containers/container-libs#422. A go.mod replace directive could help you test this locally, but it's best to let that get merged first imo.

mheon

One concern, but the code otherwise LGTM

mheon · 2026-01-28T21:04:06Z

pkg/checkpoint/checkpoint_restore.go

+			return nil, err
+		}
+		defaultHostIPs := cfg.Network.DefaultHostIPs.Get()
+		pubPorts, err := specgenutil.CreatePortBindings(restoreOptions.PublishPorts, defaultHostIPs)


Is this safe when importing a checkpoint, given that we may be changing details about the ports versus when the checkpoint was made?

I think that is expected here, this code path is when the user asked for new ports
podman container restore --publish so these new ports need to use the config setting.

Luap99 · 2026-01-29T13:55:23Z

@danishprakash The way we do thing normally is to add the go mod replace here to your fork/branch and then make sure CI passes here with that. Then we merge container-libs and you can rebase this br and remove the raplce and bump to the modules to @main to fetch latest changes.

Luap99 · 2026-01-29T13:58:01Z

pkg/checkpoint/checkpoint_restore.go

+			return nil, err
+		}
+		defaultHostIPs := cfg.Network.DefaultHostIPs.Get()
+		pubPorts, err := specgenutil.CreatePortBindings(restoreOptions.PublishPorts, defaultHostIPs)


I think that is expected here, this code path is when the user asked for new ports
podman container restore --publish so these new ports need to use the config setting.

Luap99 · 2026-01-29T14:00:43Z

pkg/specgenutil/util.go

 // CreatePortBindings iterates ports mappings into SpecGen format.
-func CreatePortBindings(ports []string) ([]types.PortMapping, error) {
+// defaultHostIPs is the list of default host IPs to use when no IP is specified in the port mapping.
+func CreatePortBindings(ports []string, defaultHostIPs []string) ([]types.PortMapping, error) {


I think this is the wrong place here, I know we are very inconsistent overall but config fields should be read and processed on the server side while this here is cli parsing that is called on the remote client.

I think the easiest thing is to do this inside setupContainer( in libpod where we have other netowrking checks as well

That makes sense, thanks for pointing it out! I was slightly confused earlier with the distinction.

danishprakash · 2026-02-03T09:02:12Z

libpod/runtime_ctr.go

+		if len(defaultHostIPs) > 0 {
+			expanded := make([]types.PortMapping, 0, len(ctr.config.PortMappings)*len(defaultHostIPs))
+			for _, pm := range ctr.config.PortMappings {
+				if pm.HostIP == "" {


Podman treats 0.0.0.0 differently; it leaves it unset because of netavark but seems to add it later on for inspect. But since the CLI strips this information, we can't be sure whether the user passed 0.0.0.0 or "', and prevent the server from overriding 0.0.0.0 with defaultHostIPs.

podman/pkg/specgenutil/util.go

Lines 182 to 183 in 98788a6

// If hostIP is 0.0.0.0, leave it unset - netavark treats

// 0.0.0.0 and empty differently, Docker does not.

That blame is from roughly 5 years ago so I'm not sure if it still applies to netavark (I can check) but if it still applies, then perhaps we need an indicator to distinguish between 0.0.0.0 and "" for the server.

we should get rid of that, netavark should be able to handle this just fine.

pasta on f42 seems to be not happy with the changes:

[+0539s] # [22:33:37.823800306] $ /var/tmp/go/src/github.com/containers/podman/bin/podman run -d -p 5249:80 quay.io/libpod/testimage:20241011 sleep 60 [+0539s] # [22:33:37.954873074] Error: pasta failed with exit code 1: [+0539s] # Altering mapping of already mapped port number: ::1/5249-5249:80-80 [+0539s] # Failed to bind port 5249 ((null)) for option '-t ::1/5249-5249:80-80'

f42 seems to be running a version based on a commit which was not tagged upstream (20250919.g623dbf6); but trying a released version that matches that timestamp (20250919.623dbf6), I got the tests passing locally. Furthermore, I tried latest passt release and the tests pass still.

So I'm guessing this has to do with the environment, perhaps config changes. Currently unsure but I'm trying to figure out what's different.

Add support for `default_host_ips` in containers.conf to set default host IP(s) if no IP is set when forwarding ports. Multiple IPs can be configured, and passing explicit IP with -p will always override the configured defaults. Signed-off-by: Danish Prakash <contact@danishpraka.sh>

Podman strips `0.0.0.0` to `""` because netavark handles both of them differently. With `""` netavark binds dual stack, same as docker. Signed-off-by: Danish Prakash <contact@danishpraka.sh>

test/system/500-networking.bats

danishprakash mentioned this pull request Jan 23, 2026

common: add support for default_host_ips in containers.conf containers/container-libs#422

Open

mheon reviewed Jan 28, 2026

View reviewed changes

Luap99 requested changes Jan 29, 2026

View reviewed changes

danishprakash force-pushed the default-hostip branch 2 times, most recently from 6399ecd to d8b9829 Compare February 3, 2026 08:57

danishprakash commented Feb 3, 2026

View reviewed changes

danishprakash added 2 commits February 4, 2026 09:42

specgenutil: remove special handling of 0.0.0.0 for netavark

5a5a4c2

Podman strips `0.0.0.0` to `""` because netavark handles both of them differently. With `""` netavark binds dual stack, same as docker. Signed-off-by: Danish Prakash <contact@danishpraka.sh>

danishprakash force-pushed the default-hostip branch from 3dd3594 to 5a5a4c2 Compare February 4, 2026 04:12

danishprakash commented Feb 4, 2026

View reviewed changes

test/system/500-networking.bats Show resolved Hide resolved

Honny1 mentioned this pull request Feb 9, 2026

[docs] Clarify --publishs behavior when using with podman container restore #28031

Open

	// If hostIP is 0.0.0.0, leave it unset - netavark treats
	// 0.0.0.0 and empty differently, Docker does not.

feat: add support for changing default host IPs via containers.conf #27938

Are you sure you want to change the base?

feat: add support for changing default host IPs via containers.conf #27938

Uh oh!

Conversation

danishprakash commented Jan 23, 2026

Uh oh!

packit-as-a-service bot commented Jan 23, 2026

Uh oh!

jankaluza commented Jan 23, 2026

Uh oh!

danishprakash commented Jan 23, 2026

Uh oh!

mheon left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Luap99 commented Jan 29, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants