How can I setup rootless podman with different IPs?

[msrd0]

I want to run some (potentially untrustworthy) software using rootless podman. I do not want it to share any ip address with my host, and especially don't want any traffic from the container appear to be coming from the ip address of my host.

I have an entire IPv6 /64 subnet available from which I am currently using just one ip, and I don't care about IPv4, so if possible I'd like to just not have it enabled for my container.

Now I can enable ipv6 forwarding on the host, create a bridge network on the host for the correct subnet, etc ... but I am lost how do I configure the network for podman? I tried using podman network create but it won't even let me create a network where the subnet is a subnet of the subnet of my eth0 ...

Bonus points for this setup working out of the box when the container is created using the rootless podman docker socket, and ignoring whatever wrong opinion docker has on networking.

[sbrivio-rh]

Some hints here:

#24823 (reply in thread)

and https://bugs.passt.top/show_bug.cgi?id=48, which is not fully supported, but most things should work (except that if your prefix changes, pasta doesn't change it).

That is, long story short: use --freebind and --outbound with pasta (--net=pasta:--freebind,--outbound,2001:db8:b1bb:1d1::b00 where 2001:db8:b1bb:1d1::b00 is the "non-local" address you want to use), use a "AnyIP" route such as:

# ip route add local 2001:db8:b1bb:1d1::/64 dev lo

And you should be done. No bonus points though.