Skip to content

Commit

Permalink
add supported version hints
Browse files Browse the repository at this point in the history
The attribute `none` has been introduced as value for `PERMIT_DOCKER` in #2393.
The current release v10.4.0 does not support this option yet. To prevent podman
users from misconfiguring their server, supported version hints have been added
to the corresponding documentation.
  • Loading branch information
p-fruck committed Feb 21, 2022
1 parent c01f8a9 commit b87bc5c
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 3 deletions.
8 changes: 6 additions & 2 deletions docs/content/config/advanced/podman.md
Original file line number Diff line number Diff line change
Expand Up @@ -102,11 +102,15 @@ In rootless mode, podman resolves all incoming IPs as localhost, which results i

#### Enforce authentication from localhost

!!! warning

This method is not compatible with `docker-mailserver` v10.4.0 and below.

The `PERMIT_DOCKER` variable in the `mailserver.env` file allows to specify trusted networks that do not need to authenticate. If the variable is left empty, only requests from localhost and the container IP are allowed, but in the case of rootless podman any IP will be resolved as localhost. Setting `PERMIT_DOCKER=none` enforces authentication also from localhost, which prevents sending unauthenticated emails.

#### Use the slip4netns network driver

The second workaround is slightly more complicated because the `docker-compose.yml` has to be modified.
The second workaround is slightly more complicated because the `docker-compose.yml` has to be modified. However this method is compatible with all versions of `docker-mailserver`.
As shown in the [fail2ban section](https://docker-mailserver.github.io/docker-mailserver/edge/config/security/fail2ban/#podman-with-slirp4netns-port-driver) the `slirp4netns` network driver has to be enabled.
This network driver enables podman to correctly resolve IP addresses but it is not compatible with
user defined networks which might be a problem depending on your setup.
Expand All @@ -128,7 +132,7 @@ You must also add the ENV `NETWORK_INTERFACE=tap0`, because Podman uses a [hard-

!!! note

`podman-compose` is not compatible with configuration.
`podman-compose` is not compatible with this configuration.

### Self-start in Rootless Mode

Expand Down
2 changes: 1 addition & 1 deletion mailserver.env
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ UPDATE_CHECK_INTERVAL=1d
# The same can happen for rootless podman. To prevent this, set the value to "none" or configure slirp4netns
# https://github.com/docker-mailserver/docker-mailserver/issues/2377
# <empty> => container ip only
# none => Explicitly force authentication
# none => Explicitly force authentication (not supported in v10.4.0 and below!)
# host => Add docker container network (ipv4 only)
# network => Add all docker container networks (ipv4 only)
# connected-networks => Add all connected docker networks (ipv4 only)
Expand Down

0 comments on commit b87bc5c

Please sign in to comment.