I tried to use Podman Compose with rootlessport 69 UDP for a TFTP server container as my local user with the id 1000, but it’s not working as I can’t access the port with the client tftp. When I use the user root it’s working as expected.
Thats my compose.yaml file:
---
services:
tftpd-hpa:
container_name:netboot_tftpd_hpa
image: netboot_tftpd_hpa
ports:
- 69:69/udp
volumes:
- type: bind
source: "${PWD}/files"
target: "/var/tftpboot"
read_only: false
build:
context: .
dockerfile: "${PWD}/compose/netboot-tftpd-hpa"
args:
NETBOOT_TFTP_HPA_ALPINE_VERSION: ${NETBOOT_TFTP_HPA_ALPINE_VERSION}
compose/netboot-tftpd-hpa file:
ARG NETBOOT_TFTP_HPA_ALPINE_VERSION
FROM docker.io/library/alpine:${NETBOOT_TFTP_HPA_ALPINE_VERSION}
RUN apk add --update --no-cache tftp-hpa
# Run the TFTP server
ENTRYPOINT ["in.tftpd"]
CMD ["--foreground", "--create", "--verbosity", "3", "--secure", "/var/tftpboot"]
.env file:
NETBOOT_TFTP_HPA_ALPINE_VERSION=3.21.3
I also added the following setting permanently (and rebooted):
# sysctl -p
net.ipv4.ip_unprivileged_port_start = 2
Since I added that setting I also don’t get a warning for port 69 anymore.
When I start my container with podman-compose up -d --build I can see that the port 69 UDP is listed:
# ss -tulpn | grep 69
udp UNCONN 0 0 *:69 *:* users:(("rootlessport",pid=31841,fd=10))
When I now start tftp 127.0.0.1 and try get hello.txt it’s timing out. Now podman compose down and sudo -ito be root and podman compose up -d --build again will show this port:
# ss -tulpn | grep 69
udp UNCONN 0 0 0.0.0.0:69 0.0.0.0:* users:(("conmon",pid=32547,fd=5))
Instead of * with user rootlessport it’s now 0.0.0.0 and conmon. The tftp client can now successfully get the hello.txt file.
I also tried to add the port 69/udp to the firewall:
# firewall-cmd --list-all
public (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: enp5s0
sources:
services: dhcpv6-client ssh
ports: 69/udp 80/udp 80/tcp 443/tcp 443/udp
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
…and also stopped the firewall service. But nothing works.
Do you have any idea why it’s not working under Tumbleweed as local user, but only as user root?
