Comment on Podman: Issues with multiple users running containers simultaneously
rhymepurple@lemmy.ml 3 weeks agoI think this is what OP was originally trying, but this approach breaks when each service’s Podman service runs on its own localhost user.
Overspark@piefed.social 3 weeks ago
You can use the per-user reverse proxies as a bridge between the host network and the user-specific internal network. So for a user coming from outside the path looks like this:
User -> main reverse proxy on main IP and port 80/443 -> user-specific proxy listening on main IP with port 8080 and proxying to user-specific internal network -> destination container listening on user-specific internal network.
And for a container running as a different user the path will be the same, but the user-specific reverse proxy will be listening on port 8081 and higher for example.
rhymepurple@lemmy.ml 3 weeks ago
This would require the main proxy running as root or with some other sort of elevated privileges to allow cross-user network access though, right? If so, wouldn’t that essentially make the user-specific reverse proxy unnecessary in most cases?
Overspark@piefed.social 3 weeks ago
It can be run as root, but it doesn’t have to, as it is only accessing the host network, not any user-specific network. Crossing the boundaries from host network to user-specific networks is left to the reverse proxies running as those specific users.
Port 80 can normally only be bound as root, but you can work around that with either firewall rules or by using something like this in your sysctl config:
lambalicious@lemmy.sdf.org 1 week ago
Do NOT do the latter! It allows unprivileged users in the system to spawn processes to take privileged ports starting with port 80 all over to port 1024, including relevant ports like 443 (HTTPS)!