@mrmarkuz thanks — that lines up with what I see. Three points:
1. ldapproxy (services bound to 127.0.0.1) — same mechanism: --map-gw redirects the gateway address to the host loopback. Your -a 10.0.2.0 -g 10.0.2.2 on top keeps the well-known 10.0.2.2 working, so modules that hardcode it don’t need to change. I’d put exactly your line into the docs:
--network pasta:--map-gw,-a,10.0.2.0,-g,10.0.2.2
2. Another app via Traefik by FQDN (Collabora ↔ Nextcloud) — works with pasta too; the trick is to point the name at the host instead of the node IP, which pasta mirrors into the container:
--add-host nextcloud.example.org:host-gateway
Podman resolves host-gateway to 169.254.1.2 (its default --map-guest-addr) and Traefik on the node answers there — HTTP 200 both with the default pasta network and inside a custom bridge network; TLS/SNI is fine because the request still carries the FQDN. With your 10.0.2.x mapping --add-host <fqdn>:10.0.2.2 works the same way. --add-host <fqdn>:<node IP> does not — that’s the mirrored address, connection refused.
3. Loki / Webserver with slirp4netns:port_handler=… — that’s about the client source IP behind published ports. Tested with the node itself as client: port_handler=rootlesskit shows 10.0.2.100 (source lost), port_handler=slirp4netns shows the real address, plain pasta shows 169.254.1.2 for a connection from the host. For remote clients pasta preserves the original source IP according to the Podman docs, so those modules should not need a special option any more — I couldn’t verify the remote case myself (single test machine), so someone with two boxes should confirm before we write it down.
Everything verified on Rocky 9.7 / Podman 5.6 / passt 2025_05 on my dev system:
| Container network | --add-host webui2.test:… |
https://webui2.test/ |
|---|---|---|
| pasta (default) | host-gateway (→ 169.254.1.2) |
HTTP 200 |
custom bridge (podman network create) |
host-gateway |
HTTP 200 |
pasta:--map-gw,-a,10.0.2.0,-g,10.0.2.2 |
10.0.2.2 |
HTTP 200 |
| pasta (default) | node LAN IP (172.17.0.22) |
refused — mirrored address |