Podman容器可Ping通主机私有IP但无法连接其上监听服务

环境信息 #

• 主机系统：Ubuntu 22.04.4 LTS，私有IP为 172.24.52.166，防火墙已关闭
• 容器：基于ubuntu:jammy镜像，通过podman-compose部署，容器IP分别为10.89.2.2、10.89.2.3
• 工具版本：podman 5.3.1，podman-compose 1.2.0

问题现象 #

• 主机上运行的服务仅监听172.24.52.166:46541端口，同网段其他机器可正常ping通主机并通过telnet连接该端口
• 容器能够ping通主机IP 172.24.52.166，但无法通过telnet连接46541端口
• 容器可正常访问互联网，暂未在Docker环境下测试该问题

相关配置 #

Dockerfile #

ARG CONTAINER_BASE_IMAGE
FROM ${CONTAINER_BASE_IMAGE}

COPY /buildenv_vars.sh /root/buildenv_vars.sh

RUN touch /root/.profile && cat /root/buildenv_vars.sh >> /root/.profile

# 调试Ubuntu容器时，取消注释此行
RUN apt-get update && apt-get install -y bind9-host iputils-ping telnet && setcap cap_net_raw+p /usr/bin/ping

CMD [ 
    "/bin/bash", 
    "-l", "-c", 
    "echo TSH=$TSH; echo TBH=$TBH; echo PATH=$PATH; echo Waiting for signal...; trap \"echo Shutting down; exit 0\" SIGTERM SIGINT SIGKILL; /bin/sleep infinity & wait" 
]

podman-compose.yml #

services:
  container1:
    image: "${NAT_TRAV_IMG}"
    volumes:
      - "${TSH}:${TSH}"
      - "${TBH}:${TBH}"
    ports:
      - "${NAT_TRAV_EM_PORT:-44100}:${NAT_TRAV_EM_PORT:-44100}"

  container1:
    image: "${NAT_TRAV_IMG}"
    volumes:
      - "${TSH}:${TSH}"
      - "${TBH}:${TBH}"
    ports:
      - "${NAT_TRAV_SUB_PORT:-44200}:${NAT_TRAV_SUB_PORT:-44200}"

内容的提问来源于stack exchange，提问作者Nick Williams