#networking
2 entries
writing · July 2026
Service-to-Service Routing in Rootless Podman
Part one isolated the network planes. The sequel: if every service is in its own plane, how do they talk? The answer is FQDN-everywhere through one always-available local router. Getting there meant a hunt through link-local host access, an SSRF guard that rejected it, pasta's --map-guest-addr, and a careful reading of what podman upstream has actually decided. Plus an epilogue: what happened when the pattern met the whole fleet, and the upstream patch that lets the workaround retire.
writing · June 2026
Network Plane Isolation in Rootless Podman
Two podman networks alone don't segment traffic in rootless mode, and isolate=true silently fails when netavark uses its iptables backend (the default on Fedora 43 and earlier) thanks to an iptables-nft bug. The root cause, the fix, and how Fedora 44 made it disappear.