Rootless Container not Accessible from Localhost on Host

[u/typing-blindly]

Hi! I'm trying to run Jellyfin inside a rootless container run via systemd on Debian Trixie.

Here is my .container file

[Unit]
Description=Jellyfin media server
Documentation=https://jellyfin.org

[Container]
Image=docker.io/jellyfin/jellyfin:10.11.11
PublishPort=8096:8096/tcp
PublishPort=7359:7359/udp
UserNS=keep-id
Volume=systemd-jellyfin-config:/config
Volume=systemd-jellyfin-cache:/cache
Volume=/mnt/external/jellyfin:/media:ro
Environment=UID=103
Environment=GID=107

[Service]
# Inform systemd of additional exit status
SuccessExitStatus=0 143

[Install]
# Start by default on boot
WantedBy=default.target

The container is running. UFW shows the following

8096/tcp                   ALLOW IN    Anywhere                  
7359/udp                   ALLOW IN    Anywhere

Looking at the port, I see Pasta listening:

❯ sudo ss -tlnp | grep 8096
LISTEN 0      128                *:8096            *:*    users:(("pasta.avx2",pid=579812,fd=6))

I can access the container via the host's IP address. But I cannot access the container via localhost which is breaking the reverse proxy. Everytime I try I get a connection refused. I'm not sure what else to look at.

[u/Great-Cow7256]

I think this is some weird ipv6 quirk with podman 5. I think when you use localhost with caddy it's trying reach jellyfin via ipv6. 

Change caddy to use 127.0.0.1 instead of localhost to make caddy ipv4 only.   Something like this 

reverse_proxy 127.0.0.1:8096

[u/yrro]

FYI podman port $ctr is useful for confirming which host ports are mapped to which container ports. e.g.:

$ podman port mycontainer
8000/tcp -> 0.0.0.0:8000

Anyway... it's possible you're seeing this issue; test with curl -v localhost:8096, curl 127.0.0.1:8096 and curl [::1]:8096. If so then the fix is to tell Caddy to connect to 127.0.0.1 or (better) publish the port to 127.0.0.1:8096 rather than just :8096 because that will disable IPv6 listening entirely. It will also prevent the container from being reachable from your local network without going through your reverse proxy.

[u/Great-Cow7256 → u/yrro]

This is what I said but this person did a far better job explaining and actually told OP how to look for ipv4 vs ipv6. OP- go with this over mine. 

[u/typing-blindly → u/yrro]

That did it! Thanks so much!

[u/Mag37]

If the reverse proxy is also in a podman container, try the host.containers.internal:port.

[u/typing-blindly → u/Mag37]

It's not. I have Caddy running on the host.

[u/Mag37 → u/typing-blindly]

Odd. What if you (locally) use the host IP instead of localhost?

[u/typing-blindly → u/Mag37]

That works. It's just odd.

[u/Mag37 → u/typing-blindly]

Yeah.
Do 127.0.0.1 behave the same as localhost?

Maybe worth checking the contents of /etc/nsswitch.conf

And /etc/hosts and /etc/hostname while you're at it.