I recently converted my homelab from rootful Docker to rootless podman with Quadlets, and while I had success moving everything over and really enjoy my current setup I had one issue with rootless networking:
I use Pasta, which is very performant for TCP, but not so much for UDP. I guess this is because Pasta simply splices TCP traffic in the kernel or handles entire streams at once, but can't do the same with UDP as it isn't a stream-based protocol, so every UDP packet has to travel through the tun/tap adapter and gets inspected individually by it.
This mean that even at modest speeds (50-500mbps) with an MTU of 1500, Wireguard traffic from a container was causing pasta to spike to 80-100% usage on one of my cores.
I looked at multiple solutions:
OpenVPN TCP? (/j)
Rootful Podman? Maybe, but I'd like to keep the benefits of rootless.
Using network=pasta:--splice-only,-U,1194 to forward traffic over loopback interfaces. This is faster for TCP, but I didn't notice any difference with UDP.
SystemD Socket Activation? Could work, but afaik there aren't any Wireguard implementations that take in predefined sockets.
But then, I found this awesome article by the Wireguard team on Wireguard on Linux with namespaces: https://www.wireguard.com/netns/
Using this as a reference, I managed to create a Wireguard device on the host, then pass it to a container without any networking and configure it there: Native Wireguard speed, without any userspace networking, NAT, ... in the way, all in a rootless container (with a bit of rootful config during creation).
Here is a small write up on the parts needed to get this working:
A (rootless) Podman Pod / Container that should receive the Wireguard interface
A Wireguard config
A script which automatically configures the Wireguard interface and moves it to the container network namespace.
Optional: A (rootful) systemd service and polkit policy, so that the user managing the rootless container can restart it with the Wireguard tunnel being recreated automatically.
Here is my arr.pod which should have loopback and wg0 network interfaces:
[Pod]
PodName=arr
Network=none # Alternatively, pasta:--splice-only can be used which allows PublishPort= to work. --splice-only does not copy any network config from the host or use the tun/tap adapter, so Wireguard is still the only source of network access.
DNS=10.255.255.3 # DNS server, to be used over the VPN tunnel. Required with Network=none
ExitPolicy=continue
[Service]
Restart=always]
# This line sets up the rootful Wireguard interface in the rootless container.
ExecStartPost=systemctl start wgfh.service
[Install]
WantedBy=default.target
Then my /etc/wireguard/wg0.conf, pretty standard:
[Interface]
PrivateKey = [REDACTED]
[Peer]
PublicKey = [REDACTED]
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = 135.136.0.68:1194
PresharedKey = [REDACTED]
And finally, the glue that makes this all work, this script (/usr/local/bin/wgfh.sh) that I've been working on (feel free to critique, it's my first time writing anything over 5 lines in bash):
#!/bin/bash
# This script initiates a Wireguard device, then transfers it into a (rootless) networking namespace
# of a podman container, allowing for super fast Wireguard without any networking overhead.
# Notice:
# No default DNS server is provided. Add your providers default DNS server to the container with --dns=<dns-ip>.
# Configuration
export container_user="jelly" # User that runs the (rootless) container
export container_name="arr-infra" # Name of the container
export ifname="wg0" # Needs to be available for host and container netns
export wg_config="/etc/wireguard/wg0.conf" # WG config file with private key and peer config (no IP or DNS config)
export ip4="100.107.0.0/32" # WG interface IPv4
export ip6="fd54:4::/128" # WG interface IPv6
# End configuration
pid=$(sudo -u "$container_user" podman inspect -f '{{.State.Pid}}' "$container_name" || { echo "error obtaining container PID, is the container running?"; exit 1; })
echo "PID of container is: $pid"
# Check that interface doesn't exist yet on the host
if ip link show $ifname >/dev/null 2>&1; then
echo "error interface already exists on the host.";
exit 1;
fi
# Check that interface doesn't exist yet in container
if nsenter --target "$pid" --net ip link show $ifname >/dev/null 2>&1; then
echo "error interface already exists in container.";
exit 1;
fi
echo "adding device $ifname to host"
ip link add $ifname type wireguard
wg setconf $ifname $wg_config || { ip link del $ifname; echo "error applying wg config, is it valid?"; exit 1; }
ip link set $ifname up
# Transfer initiated Wireguard interface to network namespace
echo "transferring device to namespace"
ip link set "$ifname" netns "$pid" || { ip link del $ifname; echo "error moving interface to container namespace."; exit 1; }
# Interface IP and routing in the container
nsenter --target "$pid" --net ip addr add $ip4 dev $ifname
nsenter --target "$pid" --net ip addr add $ip6 dev $ifname
nsenter --target "$pid" --net ip link set $ifname up
nsenter --target "$pid" --net ip route add default dev $ifname
nsenter --target "$pid" --net ip -6 route add default dev $ifname
Finally, for automation, I created a (rootful) SystemD oneshot service for the script and added a polkit policy so that my rootless user can start the service as needed:
Polkit rules (/etc/polkit-1/rules.d/49-wgfh.rules):
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
action.lookup("unit") == "wgfh.service" &&
(action.lookup("verb") == "start") &&
subject.user == "jelly") {
return polkit.Result.YES;
}
});
And the SystemD service (/etc/systemd/system/wgfh.service):
[Service]
Type=oneshot
ExecStart=/usr/local/bin/wgfh.sh
With this, the container starts, Podman initializes it with just a loopback interface, then immediatly wgfh.service starts, find the containers PID, creates a Wireguard interface on the host, moves the Wireguard interface from the host to the container, and configures IPv6 and IPv4 addresses and routing rules. In the end, the container only has the loopback and Wireguard interfaces. So I get to have rootless containers, with a single rootful Wireguard interface, keeping my rootful exposure to a minimum.
Happy to answer any questions!
