From adb2307e18689bed2e01d37ecf3f7e311c676f17 Mon Sep 17 00:00:00 2001 From: Paul Holzinger Date: Fri, 3 Jul 2026 16:07:29 +0200 Subject: [PATCH 1/2] docs: fix network create no_default_route doc With netavark v2 we require true not 1. This was correctly changed in commit bb02e49080 but then reverted in commit 7612af4c0e again as it did not properly rebase and solve the conflicts. Signed-off-by: Paul Holzinger --- docs/source/markdown/options/opt.md | 2 +- docs/source/markdown/podman-network-create.1.md.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/source/markdown/options/opt.md b/docs/source/markdown/options/opt.md index 526cafafe4..37a797ccc4 100644 --- a/docs/source/markdown/options/opt.md +++ b/docs/source/markdown/options/opt.md @@ -14,7 +14,7 @@ All drivers accept the `mtu`, `metric`, `no_default_route` and options. - `mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. - `metric` Sets the Route Metric for the default route created in every container joined to this network. Accepts a positive integer value. Can only be used with the Netavark network backend. -- `no_default_route`: If set to 1, Podman will not automatically add a default route to subnets. Routes can still be added +- `no_default_route`: If set to `true`, Podman will not automatically add a default route to subnets. Routes can still be added manually by creating a custom route using `--route`. Additionally the `bridge` driver supports the following options: diff --git a/docs/source/markdown/podman-network-create.1.md.in b/docs/source/markdown/podman-network-create.1.md.in index 5cfc24f782..3a0da30733 100644 --- a/docs/source/markdown/podman-network-create.1.md.in +++ b/docs/source/markdown/podman-network-create.1.md.in @@ -96,7 +96,7 @@ $ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33. Create a network with a static subnet and a static route without a default route. ``` -$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 --opt no_default_route=1 newnet +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 --opt no_default_route=true newnet ``` Create a Macvlan based network using the host interface eth0. Macvlan networks can only be used as root. From 4b5c1b67bfadc6578b7dc04a5ebb626b4f83cd95 Mon Sep 17 00:00:00 2001 From: Paul Holzinger Date: Fri, 3 Jul 2026 16:27:26 +0200 Subject: [PATCH 2/2] docs: update network create --route description The netavark mention is not needed as we only support it now. Then update it for the new route type syntax which was not documented in commit daaf8b62ba. Also add an example and a note that containers with CAP_NET_ADMIN can alter routes still. Signed-off-by: Paul Holzinger --- docs/source/markdown/podman-network-create.1.md.in | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/docs/source/markdown/podman-network-create.1.md.in b/docs/source/markdown/podman-network-create.1.md.in index 3a0da30733..8ccca4e26e 100644 --- a/docs/source/markdown/podman-network-create.1.md.in +++ b/docs/source/markdown/podman-network-create.1.md.in @@ -46,7 +46,13 @@ Ignore the create request if a network with the same name already exists instead #### **--route**=*route* -A static route in the format `,,`. This route will be added to every container in this network. Only available with the netavark backend. It can be specified multiple times if more than one static route is desired. +A static route in the format `,,`. +The gateway must be a valid ip address or alternatively a type can be set instead which must be either +of `blackhole`, `unreachable` or `prohibit` and means the subnet will not be routed anywhere. +This route will be added to every container in this network. It can be specified multiple times if more than one static route is desired. + +Note, routes are added into the container namespace, if a container is given the CAP_NET_ADMIN capability it is able to alter +the routes so this cannot be used for security relevant things in that case. @@option subnet @@ -99,6 +105,11 @@ route. $ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 --opt no_default_route=true newnet ``` +Create a network with a route type blackhole. This means the traffic to the destination subnet will be dropped silently. +``` +$ podman network create --route 10.1.0.0/24,blackhole --opt no_default_route=true newnet +``` + Create a Macvlan based network using the host interface eth0. Macvlan networks can only be used as root. ``` $ sudo podman network create -d macvlan -o parent=eth0 --subnet 192.5.0.0/16 newnet