All requests coming from gateway IP of podman network with v4.9.4, correct IP in 4.1.1

[hllizi]

This is a question about an older podman version. We could not reproduce the problem with versions above 4... But the systems in question cannot be updated ATM, so this is still interesting to us and maybe someone can help.

It was discovered yesterday that any request to an nginx running in a rootful container using podman v4.9.4 on one of our servers is shown in the access log as originating from 10.88.0.1, the gateway address of the default podman network, like the gateway is using NAT. This problem does not occur with an nginx container that is run using v4.1.1 when started using the same command. In the case of 4.1.1, the correct IP addresses of the clients are shown. It used to be like this on the system with v4.9.4, too, and thus in all likelihood changed due to an upgrade.

The command the container is started with is innocuous: podman run -p 443:8443 -p 80:8080 -v /opt/log/nginx:/var/log/nginx:Z,U --tz=Europe/Berlin --name nginx-proxy_container nginx (image built from redhat nginx container; some --secret options have been removed).

/etc/cni/net.d/87-podman-bridge.conflist, which I assume is pertinet, is the same on both systems:

{
  "cniVersion": "0.4.0",
  "name": "podman",
  "plugins": [
    {
      "type": "bridge",
      "bridge": "cni-podman0",
      "isGateway": true,
      "ipMasq": true,
      "hairpinMode": true,
      "ipam": {
        "type": "host-local",
        "routes": [{ "dst": "0.0.0.0/0" }],
        "ranges": [
          [
            {
              "subnet": "10.88.0.0/16",
              "gateway": "10.88.0.1"
            }
          ]
        ]
      }
    },
    {
      "type": "portmap",
      "capabilities": {
        "portMappings": true
      }
    },
    {
      "type": "firewall"
    },
    {
      "type": "tuning"
    }
  ]
}

So the only pertinent difference I am aware of is the podman version.

So far I couldn't find anything on that problem. It seems like a bug to me, but maybe it's expected behaviour now? Any help is appreciated.

[Luap99]

We only support the latest version upstream and with podman 5.0 we removed CNI support so I would suggest you try netavark.