VPN a container in a podman pod

[mrepetto94]

Sorry for posting it here, but no one had an answer to this problem, apparently
I'm crushing my head over the way Podman does networking.

I have the following minimal Ansible playbook:

- name: Setup Media Server Pod
  hosts: localhost
  tasks:

    - name: Run Gluetun container for AirVPN
      containers.podman.podman_container:
        name: gluetun-airvpn
        image: docker.io/qmcgaw/gluetun:latest
        state: quadlet
        quadlet_dir: ~/.config/containers/systemd/
        env:
          TZ: Europe/Rome
          VPN_SERVICE_PROVIDER: airvpn
          VPN_TYPE: wireguard
          WIREGUARD_PRIVATE_KEY: xxx
          WIREGUARD_PRESHARED_KEY: xxx
          WIREGUARD_ADDRESSES: xxx
          SERVER_COUNTRIES: Switzerland
          FIREWALL_VPN_INPUT_PORTS: 13445
        cap_add:
          - NET_ADMIN
        privileged: true
        device:
          - /dev/net/tun:/dev/net/tun
        quadlet_options:
          - "AutoUpdate=registry"
          - |
            [Service]
            Restart=always
            RestartSec=5
          - |
            [Install]
            WantedBy=default.target


    - name: Create media pod
      containers.podman.podman_pod:
        name: media_server
        state: quadlet
        quadlet_dir: ~/.config/containers/systemd/
        quadlet_options:
          - |
            [Install]
            WantedBy=default.target
        ports:
          - 8096:8096 # jellyfin
          - 8080:8080 # qbittorrent

    - name: Run Jellyfin container
      containers.podman.podman_container:
        name: jellyfin
        image: docker.io/jellyfin/jellyfin:latest
        state: quadlet
        quadlet_dir: ~/.config/containers/systemd/
        pod: media_server.pod
        cap_add:
          - SYS_ADMIN
          - MKNOD
        device:
          - /dev/dri:/dev/dri:rwm
        quadlet_options:
          - "AutoUpdate=registry"
          - |
            [Service]
            Restart=always
            RestartSec=5
          - |
            [Install]
            WantedBy=default.target

    - name: Run qBittorrent container
      containers.podman.podman_container:
        name: qbittorrent
        image: ghcr.io/linuxserver/qbittorrent:latest
        state: quadlet
        quadlet_dir: ~/.config/containers/systemd/
        pod: media_server.pod
        network_mode:
          - container:gluetun-airvpn
        env:
          WEBUI_PORT: 8080
          TORRENTING_PORT: 13445
          PUID: 1000
          PGID: 1000
          TZ: Europe/Rome
        quadlet_options:
          - "AutoUpdate=registry"
          - |
            [Service]
            Restart=always
            RestartSec=5
          - |
            [Install]
            WantedBy=default.target


    - name: Reload systemd
      ansible.builtin.systemd_service:
        daemon_reload: true
        scope: user

    - name: Start Media Server Pod
      ansible.builtin.systemd_service:
        name: media_server-pod
        state: started
        scope: user
        enabled: true

    - name: Start Gluetun AirVPN
      ansible.builtin.systemd_service:
        name: gluetun-airvpn
        state: started
        scope: user
        enabled: true

    - name: Start Jellyfin
      ansible.builtin.systemd_service:
        name: jellyfin
        state: started
        scope: user
        enabled: true

    - name: Start qBittorrent
      ansible.builtin.systemd_service:
        name: qbittorrent
        state: started
        scope: user
        enabled: true

I can't make the qbitorrent container using the VPN inside the container. But If I build the container outside the pod I can. The problem is that I would like to use this container inside the pod. Has anyone figured out a solution?

[november781]

podman really does not like containers in a pod managing their own network settings. If I'm reading the documentation right, containers in a pod are supposed to route all network traffic through a dedicated infra container that spawns as part of the pod. You might have better luck running the entire media pod over the VPN and then allowing whatever subnet you use to access jellyfin to connect around the VPN with Gluetun's settings.

I personally decided that pods was too much of a hassle and have all my containers running on their own and managing relationships with the requires flag in the quadlets.

[ghost]

podman really does not like containers in a pod managing their own network settings. If I'm reading the documentation right, containers in a pod are supposed to route all network traffic through a dedicated infra container that spawns as part of the pod. You might have better luck running the entire media pod over the VPN and then allowing whatever subnet you use to access jellyfin to connect around the VPN with Gluetun's settings.

I personally decided that pods was too much of a hassle and have all my containers running on their own and managing relationships with the requires flag in the quadlets.

How do you do it with flags? I want to switch to podman because security but im going insane figuring out podman lol

[november781]

The core options in the quadlet files are After, Requires, and Network.

After signals that the systemd unit that controls the container should be delayed until the listed services—or containers—are running.
Requires is a more forceful version of After that will fail if the listed service fails to start.
Network tells the container that it should use the listed container for its networking stack instead of relying on its own.

Here is an example using my caddy server that is part of my stack. It needs to network through tailscale for my remote access so it gets the Network=container:tailscale option set in the container definition—this forces all the networking operations for caddy through the tailscale sidecar, it also gets the Requires=tailscale.service option set so that it never starts up without tailscale. It also gets After=tailscale.service jellyfin.service set so that it is delayed until after my jellyfin and tailscale containers start up.

The PartOf flag defines this container as part of a target that I use to allow me to bring the entire stack up and down with a single command rather than having each unit manage its own launch.

[Unit]
Description=Caddy Cloudflare Container
# Ensure Caddy waits for Tailscale to be up before starting
Requires=tailscale.service
After=tailscale.service jellyfin.service
PartOf=finscale.target

[Container]
Image=ghcr.io/iarekylew00t/caddy-cloudflare:latest
ContainerName=caddy

# Share Tailscale's network namespace
Network=container:tailscale

# Environment variables
Environment={nope}

# Volumes
Volume=/mnt/bulk/media-server/Caddyfile:/etc/caddy/Caddyfile:Z
Volume=/mnt/bulk/media-server/state/caddy:/data:Z
Volume=/mnt/bulk/media-server/config/Caddy:/config:Z

This should also help answer your question: #3360 (comment)

[ghost]

The core options in the quadlet files are After, Requires, and Network.

After signals that the systemd unit that controls the container should be delayed until the listed services—or containers—are running. Requires is a more forceful version of After that will fail if the listed service fails to start Network tells the container that it should use the listed container for its networking stack instead of relying on its own.

Here is an example using my caddy server that is part of my stack. It needs to network through tailscale for my remote access so it gets the Network=container:tailscale option set in the container definition—this forces all the networking operations for caddy through the tailscale sidecar, it also gets the Requires=tailscale.service option set so that it never starts up without tailscale. It also gets After=tailscale.service jellyfin.service set so that it is delayed until after my jellyfin and tailscale containers start up.

The PartOf flag defines this container as part of a target that I use to allow me to bring the entire stack up and down with a single command rather than having each unit manage its own launch.

[Unit]
Description=Caddy Cloudflare Container
# Ensure Caddy waits for Tailscale to be up before starting
Requires=tailscale.service
After=tailscale.service jellyfin.service
PartOf=finscale.target

[Container]
Image=ghcr.io/iarekylew00t/caddy-cloudflare:latest
ContainerName=caddy

# Share Tailscale's network namespace
Network=container:tailscale

# Environment variables
Environment={nope}

# Volumes
Volume=/mnt/bulk/media-server/Caddyfile:/etc/caddy/Caddyfile:Z
Volume=/mnt/bulk/media-server/state/caddy:/data:Z
Volume=/mnt/bulk/media-server/config/Caddy:/config:Z

This should also help answer your question: #3360 (comment)

INCREDIBLE answer, thank you so much!!!