0

Podman containers can be started with --network=none to deny any network access. Running containers can be denied network access by disconnecting all networks according to podman-network-disconnect(1). However, for rootless containers this fails due to slirp4netns not being supported. This article says the podman network commands are for rootful containers only. (podman-network(1) does not.)

How can a running rootless container be denied network access?

raywib
  • 1
  • 1
  • Bearing in mind that there is no root access, if slirp4netns is ptrace(2)-able, one could use gdb to make it create a new user + network namespace and switch to it: all new sockets would fail (existing ones would continue to work). Probably irreversible. This is not a really reasonable approach, but can't think of anything else without privileges. – A.B Jul 10 '23 at 11:49
  • 1
    Just killing the `slirp4netns` process seems to be sufficient. That removes the `tap0` interface from the container. Seems better to just start with `--network=None`. – larsks Jul 10 '23 at 14:45
  • While I agree that killing the process is not generally the optimal solution I'd actually accept it as a working solution. – raywib Jul 10 '23 at 15:42

0 Answers0