podman inspect does not show EXPOSEd ports

[mcheshkov]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

For container with EXPOSE contents of docker inspect and podman inspect differ in exposed ports while container is running: docker show exposed ports without mapping, podman does not show ports at all

Steps to reproduce the issue:

1. Get image with EXPOSEd ports
2. Run container from that image, but without publishing ports
3. While container is running run podman inspect

Describe the results you received:

Empty object in field NetworkSettings -> Ports

Describe the results you expected:

Object with key for every exposed port and null value

Additional information you deem important (e.g. issue happens only occasionally):

$ cat Containerfile 
FROM alpine:3.14.0
EXPOSE 4444
ENTRYPOINT sh -c 'while true ; do sleep 1 ; done'

$ docker build -f ./Containerfile -t podman_ports_test
$ podman build -f ./Containerfile -t podman_ports_test

$ docker run --name podman_ports_test_ctr podman_ports_test
# While container is running
$ docker inspect podman_ports_test_ctr
...
        "NetworkSettings": {
...
            "Ports": {
                "4444/tcp": null
            },
...
# Hit C-c, container will stop, run inspect again
$ docker inspect podman_ports_test_ctr
...
        "NetworkSettings": {
...
            "Ports": {},
...
$ docker rm podman_ports_test_ctr

# Now same, but on podman
$ podman run --name podman_ports_test_ctr podman_ports_test
# While container is running
$ podman inspect podman_ports_test_ctr
...
        "NetworkSettings": {
...
            "Ports": {},
...
# Hit C-c, container will stop, run inspect again
$ podman inspect podman_ports_test_ctr
...
        "NetworkSettings": {
...
            "Ports": {},
...
$ podman rm podman_ports_test_ctr

# But is all exposed ports is published I can see actual mappings
$ podman run --name podman_ports_test_ctr -P podman_ports_test
# While container is running
$ podman inspect podman_ports_test_ctr
...
        "NetworkSettings": {
...
            "Ports": {
                "4444/tcp": [
                    {
                        "HostIp": "",
                        "HostPort": "40487"
                    }
                ]
            },

Output of podman version:

Version:      3.0.1
API Version:  3.0.0
Go Version:   go1.15.2
Built:        Thu Jan  1 03:00:00 1970
OS/Arch:      linux/amd64

Output of podman info --debug:

host:
  arch: amd64
  buildahVersion: 1.19.4
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: 'conmon: /usr/libexec/podman/conmon'
    path: /usr/libexec/podman/conmon
    version: 'conmon version 2.0.27, commit: '
  cpus: 12
  distribution:
    distribution: ubuntu
    version: "18.04"
  eventLogger: journald
  hostname: mcheshkov-Pro-G40-S58-ubuntu
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 5.4.0-74-generic
  linkmode: dynamic
  memFree: 1015017472
  memTotal: 33358901248
  ociRuntime:
    name: crun
    package: 'crun: /usr/bin/crun'
    path: /usr/bin/crun
    version: |-
      crun version 0.18.1-7931a-dirty
      commit: 7931a1eab0590eff4041c1f74e2844b297c31cea
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    selinuxEnabled: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: 'slirp4netns: /usr/bin/slirp4netns'
    version: |-
      slirp4netns version 1.1.8
      commit: unknown
      libslirp: 4.3.1-git
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.3.1
  swapFree: 0
  swapTotal: 0
  uptime: 44h 5m 35.81s (Approximately 1.83 days)
registries:
  search:
  - docker.io
  - quay.io
store:
  configFile: /home/mcheshkov/.config/containers/storage.conf
  containerStore:
    number: 1
    paused: 0
    running: 1
    stopped: 0
  graphDriverName: vfs
  graphOptions: {}
  graphRoot: /home/mcheshkov/.local/share/containers/storage
  graphStatus: {}
  imageStore:
    number: 4
  runRoot: /run/user/1000/containers
  volumePath: /home/mcheshkov/.local/share/containers/storage/volumes
version:
  APIVersion: 3.0.0
  Built: 0
  BuiltTime: Thu Jan  1 03:00:00 1970
  GitCommit: ""
  GoVersion: go1.15.2
  OsArch: linux/amd64
  Version: 3.0.1

Package info (e.g. output of rpm -q podman or apt list podman):

podman/unknown,now 100:3.0.1-2 amd64 [installed]

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/master/troubleshooting.md)

No, I use Ubuntu 18.04 and podman 3.0.1 is most recent one in kubic repo

Additional environment details (AWS, VirtualBox, physical, etc.):

[rhatdan]

Interested in opening a PR for this?

[mcheshkov]

Actually yes!
I'll try to implement and test this.
But I'm not sure if this feature conflicts with something, or if it is considered "bad" in some way.

[rhatdan]

No if Docker displays this content then we should also.

[cdoern]

@mcheshkov just to reiterate since its been a while, the issue here is that podman does not show the same port information as docker right? I can open up a PR soon to fix this

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@Luap99 PTAL and see if this is an issue, and fix if it is.

[Luap99]

@mcheshkov I am curious why do you need this?
I will fix this to match docker but I wonder what the use case for this is?

[mcheshkov]

Thanks for the fix! And sorry for long silence.

I don't know if this is intended usage for this feature or not, but we are running selenoid on top of podman, and selenoid uses this behavior to check if image really wants to export port, specified in selenoid config.

One have to pass image and ports config as a JSON to selenoid. Port will end up in portConfig.SeleniumPort here. If image does not want to expose that port, inspect will not show it in NetworkSettings, and selenoid will decide it's a misconfiguration. But there's no need to actually expose that port, because selenoid controls container, knows allocated IP addresses and can proxy all traffic directly to container.

[Luap99]

@mcheshkov I see, that makes sense. Thanks.