Port forwarding broken with rootless_port_forwarder = "pasta"
Author: 0xCACreated Sep 17, 2026Updated Sep 17, 2026
Labelskind/bug
Issue Description
I set
[network]
rootless_port_forwarder = "pasta"and started containers with compose. podman ps shows correct port forwards ss -tulpn shows port bind curl -v shows either connection refused or connected, Request completely sent off, but nothing else. Commenting out rootless_port_forwarder with podman compose down and podman system migrate fixes it.
Steps to reproduce the issue
Example compose services:
socket-proxy:
image: tecnativa/docker-socket-proxy
container_name: socket-proxy
restart: always
volumes:
- ${XDG_RUNTIME_DIR}/podman/podman.sock:/var/run/docker.sock:ro
environment:
POST: 0 # CRITICAL
CONTAINERS: 1
ports:
- 127.0.4.1:2375:2375I saw connection refused with this ^
# Fixes ownership of the data dir so surrealdb can run as uid/gid 1000.
surrealdb_bootstrap:
image: busybox
container_name: surrealdb_bootstrap
command: chown 1000:1000 /data
volumes:
- "${ACT_DATA}/surrealdb:/data"
surrealdb:
image: surrealdb/surrealdb:latest
container_name: surrealdb
hostname: surrealdb
restart: always
user: "1000:1000"
depends_on:
surrealdb_bootstrap:
condition: service_completed_successfully
command:
- start
- rocksdb://data
ports:
- "${SURREALDB_BIND:-10.29.0.1:18000}:8000"
volumes:
- "${ACT_DATA}/surrealdb:/data"
networks:
- surrealdb
healthcheck:
# test: /surreal isready
test: ["CMD", "/surreal", "isready"]
start_period: 10s
retries: 5
timeout: 10s
networks:
surrealdb:
name: surrealdb-network
internal: trueI saw connect with no response with this one ^
Also a flaky fix: Specifying networks on the service sometimes did fix the port forward, without networks it's guaranteed to be dead. But in the compose above networks are specified and it didn't help. Hm, maybe it's because it's internal?
Describe the results you received
Port forward is broken
Describe the results you expected
Port forward works just like without rootless_port_forwarder = "pasta"
podman info output
Client: Podman Engine
Version: 6.1.2
API Version: 6.1.2
Go Version: go1.27.0
Built: Thu Jan 1 00:00:00 1970
OS/Arch: linux/amd64
host:
arch: amd64
buildahVersion: 1.45.1
cdiSpecDirs:
- /etc/cdi
- /var/run/cdi
cgroupControllers:
- cpu
- memory
- pids
cgroupManager: systemd
cgroupVersion: v2
conmon:
package: conmon_100:2.2.1-1_amd64
path: /usr/bin/conmon
version: 'conmon version 2.2.1, commit: c8cc2c4db27531bd4e084ce7857f73cd21ee639d'
cpuUtilization:
idlePercent: 99.37
systemPercent: 0.43
userPercent: 0.2
cpus: 96
databaseBackend: sqlite
distribution:
codename: trixie
distribution: debian
version: "13"
emulatedArchitectures:
- linux/arm
- linux/arm64
- linux/arm64be
- linux/loong64
- linux/mips
- linux/mips64
- linux/ppc
- linux/ppc64
- linux/ppc64le
- linux/riscv32
- linux/riscv64
- linux/s390x
eventLogger: journald
freeLocks: 1990
hostname: ns3012418
idMappings:
gidmap:
- container_id: 0
host_id: 1001
size: 1
- container_id: 1
host_id: 165536
size: 65536
uidmap:
- container_id: 0
host_id: 1001
size: 1
- container_id: 1
host_id: 165536
size: 65536
kernel: 7.1.8+deb13-amd64
linkmode: dynamic
logDriver: journald
memAvailable: 121488769024
memFree: 43144609792
memTotal: 134705393664
networkBackend: netavark
networkBackendInfo:
backend: netavark
defaultNetwork: podman
dns:
package: podman-aardvark-dns_100:2.1.0-1_amd64
path: /usr/libexec/podman/aardvark-dns
version: aardvark-dns 2.1.0
package: podman-netavark_100:2.1.0-1_amd64
path: /usr/libexec/podman/netavark
version: netavark 2.1.0
ociRuntime:
name: runc
package: cri-o-runc_100:1.5.0-1_amd64
path: /usr/lib/cri-o-runc/sbin/runc
version: |-
runc version 1.5.0
spec: 1.3.0
go: go1.27.0
libseccomp: 2.6.0
os: linux
pasta:
executable: /usr/bin/pasta
package: passt_100:0.0+20260728.f8df3f1b-1_amd64
version: |
pasta 0.0+20260728.f8df3f1b
Copyright Red Hat
GNU General Public License, version 2 or later
<https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
remoteSocket:
exists: true
path: /run/user/1001/podman/podman.sock
rootlessNetworkCmd: pasta
rootlessPortForwarder: rootlessport
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: true
seccompEnabled: true
seccompProfilePath: /usr/share/containers/seccomp.json
selinuxEnabled: false
serviceIsRemote: false
swapFree: 0
swapTotal: 0
uptime: 315h 56m 56.00s (Approximately 13.12 days)
variant: ""
plugins:
authorization: null
log:
- k8s-file
- none
- passthrough
- journald
network:
- bridge
- macvlan
- ipvlan
volume:
- local
registries:
search:
- docker.io
store:
containerStore:
number: 17
paused: 0
running: 13
stopped: 4
graphDriverName: overlay
graphOptions:
overlay.mountopt: nodev
graphRoot: /home/containers/.local/share/containers/storage
graphRootAllocated: 1917145055232
graphRootUsed: 106717872128
graphStatus:
Backing Filesystem: btrfs
Native Overlay Diff: "true"
Supports d_type: "true"
Supports shifting: "false"
Supports volatile: "true"
Using metacopy: "false"
imageCopyTmpDir: /var/tmp
imageStore:
number: 26
runRoot: /run/user/1001/containers
transientStore: false
volumePath: /home/containers/.local/share/containers/storage/volumes
version:
APIVersion: 6.1.2
Built: 0
BuiltTime: Thu Jan 1 00:00:00 1970
GitCommit: ""
GoVersion: go1.27.0
Os: linux
OsArch: linux/amd64
Version: 6.1.2Podman in a container
No
Privileged Or Rootless
Rootless
Upstream Latest Release
Yes
Additional environment details
Debian 13, podman installed from https://build.opensuse.org/project/show/home:alvistack docker's docker-compose
Additional information
No response
Source: podman-container-tools/podman