Giving a rootful Podman container its own IP

Sat, 18 Oct 2025 00:00:00 +0000

I went on a bit of a journey this week - moving our Pi-hole from its own dedicated device¹ to a container on our home router. I still wanted it to have its own IP, and to still be able to serve DHCP and DNS. And I wanted the host machine to be able to use it. And I wanted to use Podman to host it, first because I’m using it for other things on this machine already, and second because I didn’t really want the Pi-hole machinery to have root privileges on the host (I am running Podman as root to allow it to open DNS and DHCP ports, but using UID mapping to ensure that the contents of the container are not root).

There are a lot of incantations out there on the Web (and, so, in AIs) for getting Podman containers to have their own IP. Most involve using macvlan or ipvlan. They all, though, seem to have the drawback that, while the container gets its own IP that the rest of your LAN can see, the host machine can’t see it! The canonical way to fix this seems to be to set up a ‘shim’ where your host gets a second IP, and you set up manual routing. I tried this, and it works, but, well, ick. And there are practical drawbacks to your host having two IPs - nothing that can’t be worked around² but, again, ick. Also, IPv6 autoconfiguration doesn’t work.

Turns out there is actually a much cleaner way to do this - it’s just apparently not well known, and unfortunately, that it’s a good idea was ‘hidden’ by a bug in Netavark (the network management infrastructure used by Podman), which didn’t let you set it up - and implied you were doing something bad.

IPv4 on Jamie Montgomerie’s World Wide Web Log

Giving a rootful Podman container its own IP