How are Pasta and Netavark working together?

[Max-F-Helm]

I'm trying to understand the deeper working of rootless Podmans networking. Current Podman versions use pasta to manage network-traffic, but the documentation (and also podman info) says netavark is the network-backend.

Can somebody give me insight how netavark and pasta work in context of rootless networking?
So what each component is responsible for, how they interact with each other and Podman, how each of these are launched and configured, ...?

I appreciate every piece of information :)

[sbrivio-rh]

This is a great overview, I think: #22943 (comment)

Taken from slides at: https://pretalx.com/media/devconf-cz-2024/submissions/BVM77L/resources/Devconf.cz_podman_networking_rQ3aMf1.pdf

See https://github.com/eriksjolund/podman-networking-docs?tab=readme-ov-file#pasta-documentation-links for a collection of relevant links (most relevant is the one above).

[Max-F-Helm]

This is a great overview, I think

This one I also found, but it focuses on the architecture of the fully set up network, not how (and with which tools) these elements are created.

Taken from slides at

Slide 14 answers most of my questions. Thank you!

See ... for a collection of relevant links

Repo looks like a rich source of information. I will look into it.

[Luap99]

The flow is:

• podman creates rootless-netns
• podman start pasta with rootless-netns as target netns
• pasta creates the tap interface with the external route in there (like it would for a normal container)
• podman calls netavark from inside the rootless-netns
• netavark configures the bridge + veth pairs exactly the same as it would for rootlful containers

The "great" part here for me at least that we managed to use netavark (used to be CNI) without any extra changes top them which makes maintenance so much easier for me.

code wise https://github.com/containers/common/blob/main/libnetwork/netavark/run.go and https://github.com/containers/common/blob/main/libnetwork/internal/rootlessnetns/netns_linux.go contain the core logic from podman's side.
Now the rootless netns setup is fair bit more complicated as we have to also use a mount namespace to do some trickery for /run and /etc/resolv.conf to make dns work.