How to create a container without default route?

[vukitoso]

Hello.
There is a rootless podman container.
The task is to make sure that there is no default route inside the container, but there is a network and access to the Internet.
Internet access means access to the router subnet: 192.168.1.0/24.
The following options do not help:

--network pasta:--no-map-gw
--network pasta:-a,10.0.2.0,-n,24,--no-map-gw,--no-dhcp

the network is created and the default route is copied from the host.

It turns out to be done like this:

podman exec --privileged -u 0 -ti firefox bash
ip route del default
ip r add 192.168.1.0/24 dev enp0s7

But this must be done every time, which is not a convenient or smart solution.

Please tell me, is there any solution so that there is no default route?
Thank you.

[Luap99]

you can use custom networks

podman network create --subnet 10.10.10.0/24  --opt no_default_route=true --route 192.168.188.0/24,10.10.10.1 testnet

podman run --network testnet quay.io/libpod/testimage:20241011 ip route
10.10.10.0/24 dev eth0 proto kernel scope link src 10.10.10.2 
192.168.188.0/24 via 10.10.10.1 dev eth0 proto static metric 100

the subnet for container is whatever you want and then you just need to set a custom route to your local subnet using the container subnet gateway

keep in mind routes are set in the container namespace, any container that you give CAP_NET_ADMIN could add a default route themselves (i.e. only safe when not using --privileged or --cap-add CAP_NET_ADMIN)

[vukitoso]

thx, work!