Custom network does not use pasta?

[loeffelpan]

I'm running podman 5.1.0 on Fedora CoreOS in rootless mode.
My compose project as below with several containers for a mailserver and a selfhosted simplelogin instance, which communicate with each other in a custom network.
I used the default bridge driver for that network.
Unfortunately the source IP (incoming mails) is not preserved. I need that e. g. for Fail2Ban and SPF validation.

services:
  mailserver:
    image: docker.io/mailserver/docker-mailserver:latest
    container_name: mailserver
    # Provide the FQDN of your mail server here (Your DNS MX record should point to this value)
    hostname: mail.kbw3.de
    env_file: mailserver.env
    # More information about the mail-server ports:
    # https://docker-mailserver.github.io/docker-mailserver/latest/config/security/understanding-the-ports/
    ports:
      - "25:25"    # SMTP  (explicit TLS => STARTTLS, Authentication is DISABLED => use port 465/587 instead)
      - "143:143"  # IMAP4 (explicit TLS => STARTTLS)
      - "465:465"  # ESMTP (implicit TLS)
      - "587:587"  # ESMTP (explicit TLS => STARTTLS)
      - "993:993"  # IMAP4 (implicit TLS)
    volumes:
      - ./dms/mail-data:/var/mail:Z
      - ./dms/mail-state:/var/mail-state:Z
      - ./dms/mail-logs:/var/log/mail:Z
      - ./dms/config:/tmp/docker-mailserver:z
      - ./dms/certs:/etc/certs:Z
    restart: always
    stop_grace_period: 1m
    cap_add:
      - NET_ADMIN
    healthcheck:
      test: "ss --listening --tcp | grep -P 'LISTEN.+:smtp' || exit 1"
      timeout: 3s
      retries: 0
      
include:
  - simplelogin-compose.yaml

networks:
  default:
    name: mailserver-simplelogin

I tried to run the mailserver containers from the project in the default bridge network. This way it preserves the source IP from incoming emails. I also noticed that there is a pasta process when container starts.

core 1235838 0.0 0.4 70480 17688 ? Ss 15:54 0:04 /usr/bin/pasta --config-net -t 25-25:25-25 -t 143-143:143-143 -t 465-465:465-465 -t 587-587:587-587 -t 993-993:993-993 --dns-forward 169.254.0.1 -u none -T none -U none --no-map-gw --quiet --netns /run/user/1000/netns/netns-c856b34a-4aa3-ff9a-2e6b-159f7f2251d3

When using the custom network there is no pasta process.
Do custom networks use another network driver? How to use pasta in this case or preserve the source IP otherwise?

Any help would be appreciated.

[Luap99]

Custom networks do use pasta but they only use one instance for the rootless-netns which makes it incompatible with port forwarding, see #22943 (comment) for how this looks.

Keeping the source ip with custom networks is already tracked in #8193

[loeffelpan]

Thanks. Exactly what I wanted to know.
So for now it's not solvable. Hopefully it will be implemented soon.

[Luap99]

If the application support socket activation (likely not the case for your mailserver example) then it can done by binding the socket on the host and leaking it into the container via socket activation: https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md
Also see this example for nginx https://github.com/eriksjolund/podman-nginx-socket-activation

[loeffelpan]

Any way to workaround?
Would using rootful containers help?

[Luap99]

If you run rootful port forwarding is done via firewall rules and the container gets the correct source ip with that.

[loeffelpan]

Thanks.
Maybe I will do that in between.

[loeffelpan]

Tried to run useful.
Mailserver is running fine but other conainers in the same custom network cannot communicate with each other by container name? Does name resolution with rootful custom networks work different?

[Luap99]

No it should work the same