Skip to content

🐳 Accessing Host from Podman Containers

postgresdatabasepodmandockernetwork

Accessing host resources and ports from a Docker/Podman container can be done in two ways:

  • exposing the network on a host-level (using --net host param or similar);
  • routing through gateway.

Basic Gateway Routing

While exposing host ports for the container may be an easier choice, it's better to properly isolate it and use the gateway routing instead.

However, this will not work out-of-the-box as Postgres (or some other service) by default bind to localhost addesses only (127.0.0.1, ::1).

To overcome this, you can use pgsql.remote-access Scope to enable remote access to the service.

bash
cpcmd scope:set pgsql.remote 1

Enabling remote access will also impact your firewall rules to do so, opening external access to the system.

Better Gateway Routing

In the case of containers running on localhost, allowing remote access is most likely unneccessary and will only introduce other things to worry about such as the firewall.

A better solution in this case is to use the gateway routing, properly configuring target service and keeping it local.

In this case, Podman will publish a network similar to 10.89.0.1/24 where .1 will be the host.

Enabling Postgres Access

The first thing we need to do is whitelist 10.89.0.1/24 network for users accessing Postgres, by editing our pg_hba.conf adding the following lines:

txt
# nano /var/lib/pgsql/16/data/pg_hba.conf
host    all             all             10.89.0.1/24            trust
host    replication     all             10.89.0.1/24            trust

Binding to Podman Network

We can now add 10.89.0.1 to the list of addresses Postgres will bind to.

bash
cpcmd scope:set cp.bootstrapper pgsql_bind_address '127.0.0.1, ::1, 10.89.0.1'

pgsql_bind_address requires a string, so the value passed to the scope shoul be a comma-separated list as a string.

We now need to apply the changes by invoking a Postgres reconfiguration via Ansible, to write the new bind definition on the config file and restart the process, including our pg_hba.conf changes.

bash
upcp -sb pgsql/install

You can now achieve this on edge and edge-master by using pgsql.listening-ips scope: cpcmd scope:set pgsql.listening-ips '["127.0.0.1", "::1", "10.89.0.1"]' will update the bind address definition and will trigger bootstrapper to apply pgsql/install.

After playbooks completes all actions, Podman containers will be able to access Host Postgres via:

  • host.containers.internal:5432
  • host.docker.internal:5432