Can I use a bridge network with a rootless container?

[josedom24]

Hello,
I know that the default network mode for rootless container is slirp4netns in Podman 4.9 versions.

However, I can create with an unprivileged user a new bridge network, and connect a rootless container to that network.
I can check the IP address taken by the container, however I do not see the Linux Bridge created on the host.

$ podman network create net1
$ podman run -it --network net1 alpine
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 5a:5c:b3:a5:5e:f2 brd ff:ff:ff:ff:ff:ff
    inet 10.89.1.2/24 brd 10.89.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::585c:b3ff:fea5:5ef2/64 scope link 
       valid_lft forever preferred_lft forever

Is this way of working correct? How does it differ from bridge networking with rootful containers?

All this has me very confused, because I thought that an unprivileged user could not create new virtual interfaces on the host.

Can someone clarify me if I am doing it correctly?

Thank you very much

[Luap99]

see Rootless CNI networking section in https://containers.github.io/podman.io_old/old/community/meeting/notes/2021-10-05/Podman-Rootless-Networking.pdf
It is quite old (we use netavark now instead of CNI to create the bridges) but the principle is still the same.