title: Expose ports with rootless podman
body: <p>I am trying to expose port 8080 using rootless podman on RHEL 8.3.</p>
  <p>The podman version I am using is:</p>
  <pre class="lang-sh prettyprint-override"><code>$ podman --version
  podman version 2.2.1
  </code></pre>
  <p>I am using a simple <code>Flask</code> API to test it:</p>
  <pre class="lang-py prettyprint-override"><code>from flask import Flask
  
  app = Flask(__name__)
  
  
  @app.route(&quot;/&quot;)
  def hello():
      return &quot;Hello from the container!\n&quot;
  
  
  if __name__ == &quot;__main__&quot;:
      app.run(host=&quot;0.0.0.0&quot;)
  </code></pre>
  <p>The Containerfile looks like this:</p>
  <pre><code>FROM python:3.6-alpine
  
  RUN pip3 install flask
  
  COPY app.py app.py
  
  EXPOSE 5000
  
  ENTRYPOINT python3 app.py
  
  </code></pre>
  <p>I am building the image using:</p>
  <pre class="lang-sh prettyprint-override"><code>$ podman build -t testapi .
  </code></pre>
  <p>I am creating a pod and start a container within that pod</p>
  <pre class="lang-sh prettyprint-override"><code>$ podman pod create --name testpod -p 8080:5000
  $
  $ podman run -d --rm --name testapi --pod testpod testapi 
  </code></pre>
  <p>All containers are running as expected:</p>
  <pre class="lang-sh prettyprint-override"><code>$ podman ps
  CONTAINER ID  IMAGE                     COMMAND  CREATED             STATUS            PORTS                   NAMES
  85289290cc7a  localhost/testapi:latest           3 seconds ago       Up 2 seconds ago  0.0.0.0:8080-&gt;5000/tcp  testapi
  4b1ac2354a1a  k8s.gcr.io/pause:3.2               About a minute ago  Up 3 seconds ago  0.0.0.0:8080-&gt;5000/tcp  81aa31a38084-infra
  </code></pre>
  <p>However, I cannot connect to the port:</p>
  <pre class="lang-sh prettyprint-override"><code>$ telnet &lt;IP&gt; 8080
  Trying &lt;IP&gt;...
  telnet: Unable to connect to remote host: No route to host
  </code></pre>
  <p>When I use netstat to see which port are in use I get this:</p>
  <pre class="lang-sh prettyprint-override"><code>$ netstat -tulpn | grep LISTEN
  (Not all processes could be identified, non-owned process info
   will not be shown, you would have to be root to see it all.)
  tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
  tcp6       0      0 :::8080                 :::*                    LISTEN      638593/containers-r 
  tcp6       0      0 :::22                   :::*                    LISTEN      -                   
  </code></pre>
  <p>And using lsof I get:</p>
  <pre class="lang-sh prettyprint-override"><code>$ lsof -i -P -n | grep LISTEN
  exe     638593   ds   13u  IPv6 593362      0t0  TCP *:8080 (LISTEN)
  
  </code></pre>
  <p>When I do the same thing using rootfull podman, it works, i.e.:</p>
  <pre class="lang-sh prettyprint-override"><code>$ sudo podman pod create --name testpod -p 8080:5000 
  $ sudo podman run -d --rm --name testapi --pod testpod testapi
  </code></pre>
  <p>Now the response is:</p>
  <pre class="lang-sh prettyprint-override"><code>$ telnet 10.100.2.220 8080
  Trying 10.100.2.220...
  Connected to 10.100.2.220.
  </code></pre>
  <p>netstat returns:</p>
  <pre class="lang-sh prettyprint-override"><code>$ netstat -tulpn | grep LISTEN
  (Not all processes could be identified, non-owned process info
   will not be shown, you would have to be root to see it all.)
  tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      -                   
  tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
  tcp6       0      0 :::22                   :::*                    LISTEN      -      
  </code></pre>
  <p>and lsof:</p>
  <pre class="lang-sh prettyprint-override"><code>$ sudo lsof -i -P -n | grep LISTEN
  conmon  639312   root    5u  IPv4 590239      0t0  TCP *:8080 (LISTEN)
  </code></pre>
  <p>Is there a way to expose a port using rootless podman so I can access it away from the podman host?</p>