1

As per man podman-run container's network can be configured in the host mode:

--network=mode, --net
...
host: Do not create a network namespace, the container will use the host’s network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.

What could be the use case when we don't want container to have its own network namespace, and instead share the host one?

Mark
  • 249
  • 1
  • 5
  • 13

1 Answers1

1

Consider an containerized, administrative application that you the system administrator wants to run from a management host. Say, an ansible-runner based environment, that is already a container to get the proper versions of python and various libraries. It needs to ssh out to various hosts.

You don't care that much about security, in that you personally are running this app and the host. Simpler that it goes through the host's network stack directly.

And that's not even very clever. There always are interesting use cases that I have not thought of, especially in an area as broad as IP networking.

If a compute stack can support simple variants like "don't bother with a network namespace for this container" that is a good option. Hopefully covered by the test suite. My main concern with lots of options is that they remain functional when things change.

John Mahowald
  • 32,050
  • 2
  • 19
  • 34