f02df3e081
Document the default_host_ips option here to make it more visible. And clarify the default v4/v6 bind behavior. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2.6 KiB
####> This option file is used in: ####> podman podman-container.unit.5.md.in, create, podman-kube.unit.5.md.in, pod create, podman-pod.unit.5.md.in, run ####> If file is edited, make sure the changes ####> are applicable to all of those. << if is_quadlet >>
PublishPort=[[hostIP:][hostPort]:]containerPort[/protocol]
<< else >>
--publish, -p=[[hostIP:][hostPort]:]containerPort[/protocol]
<< endif >>
Publish a container's port, or range of ports,<<| within this pod>> to the host.
Both hostPort and containerPort can be specified as a range of ports. When specifying ranges for both, the number of container ports in the range must match the number of host ports in the range.
If hostIP is 0.0.0.0, only IPv4 addresses will be bound, if set to [::] only
IPv6 addresses are bound. In all other cases the exact IP address as given will be bound.
If hostIP is not set at all, the port is bound on all IP addresses on the host,
both v4 and v6 (if possible).
The default hostIP can be configured in containers.conf(5)
using the default_host_ips option under the [network] section.
This option accepts an array to be able to set multiple bind IP addresses.
For example setting default_host_ips = ["127.0.0.1", "::1"] will make the
port be published on the ipv4 and ipv6 localhost address respectively.
An explicit hostIP set on the command will always override the config option.
By default, Podman publishes TCP ports. To publish a UDP port instead, give
udp as protocol. To publish both TCP and UDP ports, set --publish twice,
with tcp, and udp as protocols respectively. Rootful containers can also
publish ports using the sctp protocol.
Host port does not have to be specified (e.g. podman run -p 127.0.0.1::80).
If it is not, the container port is randomly assigned a port on the host.
Use podman port to see the actual mapping: podman port $CONTAINER $CONTAINERPORT.
Port publishing is only supported for containers utilizing their own network namespace
through bridge networks, or the pasta network mode.
For rootless bridge networks, port forwarding uses rootlessport by default, which
is a userspace proxy that does not preserve client source IPs. Setting
rootless_port_forwarder="pasta" in the [network] section of
containers.conf(5)
switches to pasta's kernel-level forwarding via pesto, preserving the original
client IP address inside the container. This option is experimental and its
behavior is subject to change.