rootless_port_forwarder=pasta: pesto rule not deleted on container restart, causing conflict

[firu11]

Issue Description

When using the new rootless_port_forwarder="pasta" with a rootless Podman container that publishes a port, restarting the container fails because the previous pesto forwarding rule is never deleted.

The new start tries to add the same forwarding rule again, causing a conflict with itself.

It seems like this issue is only with custom user-defined networks.

I'm not sure if it's related to #23737.

Steps to reproduce the issue

Easiest example I could think of:

Make sure you have .config/containers/containers.conf like:

[network]
rootless_port_forwarder = "pasta"

Then run:

podman network create pesto-repro

podman run -d \
  --name pesto-repro \
  --network pesto-repro \
  -p 18080:80 \
  docker.io/library/nginx:alpine

podman restart pesto-repro

Or with Quadlets:

pesto-repro.container:

[Container]
Image=docker.io/library/nginx:alpine
ContainerName=pesto-repro
Network=pesto-repro
PublishPort=18080:80

pesto-repro.network:

[Network]
NetworkName=pesto-repro
Driver=bridge
IPv6=true

Then:

systemctl --user daemon-reload
systemctl --user start pesto-repro-network.service
systemctl --user start pesto-repro.service
systemctl --user restart pesto-repro.service

Cleanup

You can delete the pesto forwarding rule by hand:

pesto -D -t 0.0.0.0/18080 -t '[::]/18080' /run/user/1000/containers/networks/rootless-netns/pasta.sock

Describe the results you received

The first start works and the port is bound by pasta:

ss -tulpn | grep :18080
tcp   LISTEN 0      128          0.0.0.0:18080      0.0.0.0:*    users:(("pasta",pid=4163,fd=234))
tcp   LISTEN 0      128             [::]:18080         [::]:*    users:(("pasta",pid=4163,fd=245))

But after restart:

Error: unable to start container "1151cba502fc6e0297c8ff242dcab23a433e524cd2dd8a8361631ad816fad4a1": pesto failed: exit status 1
output: Forwarding configuration conflict: TCP [0.0.0.0]:18080  =>  18080  versus TCP [0.0.0.0]:18080  =>  18080
Unable to add rule TCP [0.0.0.0]:18080  =>  18080

Describe the results you expected

Restarting the container should remove the old pesto forwarding rule and re-add it cleanly, or otherwise reuse/update the existing rule without failing.

podman info output

host:
  arch: arm64
  buildahVersion: 1.44.0
  cdiSpecDirs:
  - /etc/cdi
  - /var/run/cdi
  cgroupControllers:
  - cpu
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.2.1-2.fc42.aarch64
    path: /usr/bin/conmon
    version: 'conmon version 2.2.1, commit: '
  cpuUtilization:
    idlePercent: 96.67
    systemPercent: 1.39
    userPercent: 1.95
  cpus: 2
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    version: "42"
  emulatedArchitectures:
  - linux/386
  - linux/amd64
  - linux/arm64be
  - linux/loong64
  - linux/mips
  - linux/mips64
  - linux/ppc
  - linux/ppc64
  - linux/ppc64le
  - linux/riscv32
  - linux/riscv64
  - linux/s390x
  eventLogger: journald
  freeLocks: 2035
  hostname: firudev
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
  kernel: 6.19.14-102.fc42.aarch64
  linkmode: dynamic
  logDriver: journald
  memFree: 259678208
  memTotal: 3975254016
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    defaultNetwork: podman
    dns:
      package: aardvark-dns-2.0.0-1.20260622092550897134.main.5.gda6856f.fc42.aarch64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 2.0.0
    package: netavark-2.0.0-1.20260619111836814958.main.5.g8a649cd1.fc42.aarch64
    path: /usr/libexec/podman/netavark
    version: netavark 2.0.0
  ociRuntime:
    name: crun
    package: crun-1.27.1-1.fc42.aarch64
    path: /usr/bin/crun
    version: |-
      crun version 1.27.1
      commit: 3ec076b3b6714ec2f1a10533cf18d5605a6de637
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20260526.g038c51e-1.fc42.aarch64
    version: |
      pasta 0^20260526.g038c51e-1.fc42.aarch64-pasta
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  rootlessPortForwarder: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  swapFree: 0
  swapTotal: 0
  uptime: 1h 1m 48.00s (Approximately 0.04 days)
  variant: v8
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
store:
  containerStore:
    number: 9
    paused: 0
    running: 9
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /home/firu/.local/share/containers/storage
  graphRootAllocated: 40165670912
  graphRootUsed: 26299531264
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 10
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/firu/.local/share/containers/storage/volumes
version:
  APIVersion: 6.1.0-dev
  BuildOrigin: 'Copr: rhcontainerbot/podman-next'
  Built: 1782172800
  BuiltTime: Tue Jun 23 00:00:00 2026
  GitCommit: 38cf0ea41d6b22a358f3f8bba1ddc02fc9651400
  GoVersion: go1.25.10 X:nodwarf5
  Os: linux
  OsArch: linux/arm64
  Version: 6.1.0-dev

pasta 0^20260526.g038c51e-1.fc42.aarch64-pasta
pesto 0^20260526.g038c51e-1.fc42.aarch64-pasta
network mode: bridge

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Additional environment details

VPS on Hetzner.net running Fedora 42

[firu11]

cc @Honny1 - I hope it’s okay to tag you. Since you worked on the recent pesto / rootless_port_forwarder=pasta changes, I thought you might have the most context on this.

[urbenlegend]

I am seeing this as well when I podman-compose down only some of my containers in the network. If I shut all of my containers down, then restarting them works fine.

This is with:

aardvark-dns (2.0.0-1)
netavark (2.0.0-1)
containers-common (1:0.68.0-1)
podman (6.0.0-1)