pasta: set --host-lo-to-ns-lo; CI: update pasta

[AkihiroSuda]

No description provided.

[AkihiroSuda]

Regression in AkihiroSuda/passt-mirror@2024_09_06.6b38f07...2024_10_30.ee7d0b6

https://github.com/rootless-containers/rootlesskit/actions/runs/12783037201/job/35633471012

Docker integration test: net=pasta, port-driver=implicit

+ docker run -d --name=nginx -p 127.0.0.1:8080:80 nginx:alpine
c97d3321bb3e442209855c85ad2f348b6e9bc98dfda4a1d633c4f70896312abf
+ sleep 2
+ curl -fsSL http://127.0.0.1:8080/
curl: (56) Recv failure: Connection reset by peer

[AkihiroSuda]

Regression in https://passt.top/passt/commit/?id=b4dace8f462b346ae2135af1f8d681a99a849a5f

"fwd: Direct inbound spliced forwards to the guest's external address"

A minimal reproducer w/o Docker: rootlesskit --net=pasta --port-driver=implicit nc -l 127.0.0.1 12345 no longer forwards the port 12345

[AkihiroSuda]

Seems relevant:

• rootless+pasta can not use localhost IP address in published ports moby/moby#48838

[AkihiroSuda]

Updated PR to exec pasta with --host-lo-to-ns-lo, so as to keep docker run -p 127.0.0.1:8080:80 functional with passt >= 2024_10_30.ee7d0b6

This flag seems already deprecated, but any chance to undeprecate it?
cc @sbrivio-rh 🙏

[sbrivio-rh]

A minimal reproducer w/o Docker: rootlesskit --net=pasta --port-driver=implicit nc -l 127.0.0.1 12345 no longer forwards the port 12345

Oops. I would argue that it's a regression for this specific test, but not for the functionality. That is, nc -l 12345 would still work: it's just binding specifically to loopback inside the container that doesn't expose that port. If you bind to "any" address, it works.

But anyway:

This flag seems already deprecated, but any chance to undeprecate it?

...that's something that you and probably some users expected to work, so we definitely have to keep it working.

From the related discussion I would say that the only reason why it was introduced directly as deprecated is that, eventually, we would like to replace it with a more generic configuration interface (the runtime port forwarding interface I mentioned a couple of times), where one can say "map x to y" in a generic way.

But I would suggest that, until then, you can use it, and I'll make a note to find a working alternative for rootlesskit if we ever drop that option (it won't happen any time soon, anyway).

[sbrivio-rh]

@dgibson