"502 Bad Gateway" if I switch to the krun runtime

[user451421541757324]

I'm going crazy trying to get this simple setup to work with krun. It works fine with crun, but as soon as I switch runtime (setting /etc/containers/containers.conf), I get a 502 Bad Gateway error.

podman pull docker.io/nginxinc/nginx-unprivileged:mainline-alpine-slim
podman pull ghcr.io/silvenga/redlib:0
systemctl --user daemon-reload
systemctl --user start redlib
systemctl --user start nginx

The containers start up correctly but are effectively unusable. I've tried this on two different operating systems (Manjaro and Arch Linux).

demo.nework:

[Network]
Driver=bridge

redlib.container:

[Unit]
After=network-online.target demo.network
Wants=network-online.target

[Container]
ContainerName=redlib
Image=ghcr.io/silvenga/redlib:0
Network=demo.network

[Install]
WantedBy=default.target

nginx.container:

[Unit]
After=network-online.target redlib.service demo.network
Wants=network-online.target

[Container]
ContainerName=nginx
Image=docker.io/nginxinc/nginx-unprivileged:mainline-alpine-slim
Network=demo.network
PublishPort=8081:8081

Volume=%h/Contenitori/Nginx/proxy.conf:/etc/nginx/nginx.conf:ro,Z

[Install]
WantedBy=default.target

nginx.conf:

pid /tmp/nginx.pid;

events {
    worker_connections 2048;
    use epoll;
    multi_accept on;
}

http {
    proxy_temp_path /tmp/proxy_temp;
    client_body_temp_path /tmp/client_temp;
    fastcgi_temp_path /tmp/fastcgi_temp;
    uwsgi_temp_path /tmp/uwsgi_temp;
    scgi_temp_path /tmp/scgi_temp;

    server {
        listen 8081;
        server_name _;

        client_body_timeout 8s;
        client_header_timeout 8s;
        send_timeout 8s;

        location / {
            proxy_pass http://redlib:8080;
        }
    }
}

As I said, it must be krun's fault, because everything works fine without it.

(obviously, I don't want to use crun)

[Luap99]

@jakecorrenti @slp Does krun not accept incoming connecting to the container ip? I am not sure how the networking via krun in general works because it does not seem to have any (non localhost) interface or any routes in the container so I am a bit confused.

and pings all fail with ping: sendto: Network unreachable

[user451421541757324]

Hello again, it's been a few days and I still haven't received a reply.

I tried a few other things, like switching between pasta and slirp4netns, but it still didn't work.

Can anyone help me? Should I open an issue?

[Luap99]

This is a FOSS project with no guarantees about any form of user support, getting any reply at all is no given. We try to answer as much as we can but you cannot expect us to do so.

If you want actual proper support you need to find a vendor which does provide such support.

As for an issue, in general, if it works with crun it is not a podman bug so you would need to ask the krun maintainers that which I already pinged above, they are likely just busy with other things.

[eriksjolund]

Last week a PR related to krun and pasta got merged:

• krun: implement support for passt networking containers/crun#1913

I don't know if this changes anything. Just mentioning it.

[user451421541757324]

Last week a PR related to krun and pasta got merged:

Thanks for the suggestion.

I'm running Arch Linux and already have the latest version (which includes the PR you mentioned). I tried enabling the PR flag with annotations = ["krun.use_passt=1"] (in /etc/containers/containers.conf), but nothing changed: still doesn't work.

[eriksjolund]

There is a new PR related to krun and dhcp:

• krun: request enabling DHCP client crun#2093

I don't know if this changes anything. Just mentioning it.

[user451421541757324]

Thanks again, I'll wait for the merge and then test it.

[slp]

Hi! libkrun maintainer here. Thanks for the detailed report. I've tested this on my machine, and found ngnix failing with this error:

2026/05/15 14:54:31 [alert] 493#493: *1 ioctl(FIONREAD) failed (95: Not supported) while reading response header from upstream, client: 10.89.2.25, server: _, request: "GET / HTTP/1.1", upstream: "http://10.89.2.17:8080/", host: "192.168.0.18:8081"

This happens because TSI doesn't support FIONREAD/SIOCINQ yet. But, luckily, can be easily supported. I'm preparing a PR for libkrunfw, will link it here once it's ready.

[user451421541757324]

Glad it's an easy fix. I'll wait, thanks a lot.

I also opened an issue, if you want to move the discussion there.