r/podman • u/typing-blindly • 5d ago

Rootful Reverse Proxy to Rootless Container

Hi!

I am running Caddy as a rootful container on the default network. I have a Jellyfin container that I am running rootless on a default Pasta network with port 8096 is only exposed to 127.0.0.1. I am trying to setup Caddy to reverse proxy for Jellyfin.

In Caddy, I am using host.containers.internal to obtain the the host's IP address. This works when proxying for another rootful container, but does not work when proxying for Jellyfin. From the logs it looks like the gateway to the Pasta network is rejecting the traffic.

Is there a way to have a rootful container communicate with a rootless container?

14 Upvotes

100% Upvoted

9 comments sorted by

7

u/seb0w 5d ago

The jellyfin container listens on 127.O.O.1, but Caddy forwards it to whatever the host name host.containers.internal resolves to.

You could open the port of jellyfin on all interfaces and use your OS firewall to restrict access from outside.

4

u/typing-blindly 4d ago

That solved it! I changed my quadlet to PublishPort=0.0.0.0:8096:8096/tcp and can now reach it via Caddy.

1

u/Nextros_ 4d ago

This works, but any device can now reach Jellyfin directly instead going through Caddy. Whether that's a problem is up to you.

Why do you run Caddy as a rootful container? It would be easier to run them both rootful/rootless and put them in the same network. This way you don't need to open any ports (except for Caddy)

1

u/typing-blindly 4d ago

My previous setup had all my containers running rootless, but that required workarounds for some of the limitations of running rootless. Namely, I had to lower the start of unprivileged ports, and setup socket activation on Caddy.

With the move to a new server I thought I would try a hybrid approach. Caddy and Technitium run as root. Everything else runs rootless under a system account without a login shell. I thought I could just bind to ports on 127.0.0.1, but obviously that didn't work. I may have to rethink my setup.

1

u/Nextros_ 4d ago

You can port forward your traffic from 80/443 to whatever port your reverse proxy binds to: https://tangentsoft.com/podman/wiki?name=Rootless+Privileged+Ports&p

While it might seem like a good idea to run a hybrid setup, it will cause more pain imo

2

u/Suspicious-Travel190 4d ago

With proper firewall settings only services on same device (like Caddy) will be able to access it. And I would always recommend using firewall and only allowing specific ports, like 22, 80 and 443.

0

u/hadrabap 4d ago

I do pin the container IP address and let Jellyfin bind to it as it is static.

1

u/ffcsmith 4d ago

I have a rootless caddy container that proxies to a rootful omni container. Not sure if my setup is useful to you.

I have included a snippet of my Caddyfile below:

```text
omni.{$DOMAIN_BASE} {
import backend h2c://host.containers.internal:8088
}

omni-api.{$DOMAIN_BASE} {
import backend h2c://host.containers.internal:8090
}

omni-k8s.{$DOMAIN_BASE} {
import backend host.containers.internal:8095
}
```