Frank
c66273033b
The bridge gateway (10.89.3.1) lives in the rootless netns; llama-server runs in the host netns, so the gateway refuses. 192.168.0.143:52625 reaches it through the rootless NAT (verified from the container). Same LAN-IP pattern the doc already prescribes for the Dankserver backend.
31 lines
1.3 KiB
SYSTEMD
31 lines
1.3 KiB
SYSTEMD
# Quadlet network: private bridge for open-webui (rootless).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/open-webui.network
|
|
# Unit name: open-webui-network.service (podman network name: systemd-open-webui)
|
|
#
|
|
# Why a bridge instead of slirp4netns (2026-08-22 incident):
|
|
# slirp4netns runs a user-space helper process per container. When that
|
|
# helper died, the container kept running but lost its tap interface,
|
|
# becoming a zombie that accepted TCP and reset every request. chat
|
|
# served empty responses for ~2 days and nothing logged an error.
|
|
# A kernel bridge has no per-container helper, so the failure mode
|
|
# cannot occur.
|
|
#
|
|
# The subnet is pinned so the container's own IP (10.89.3.2) is
|
|
# deterministic. Note the LLM backend is NOT reached via this gateway:
|
|
# the gateway lives in the rootless netns, while llama-server runs in
|
|
# the host netns. The host's LAN IP (192.168.0.143) reaches it through
|
|
# the rootless NAT. host.containers.internal is a slirp4netns-only name
|
|
# and does not resolve on a bridge.
|
|
#
|
|
# Subnet registry on dankclaw (rootless):
|
|
# 10.88.0.0/16 default "podman" bridge
|
|
# 10.89.0.0/24 gitea (systemd-gitea)
|
|
# 10.89.1.0/24 compose stack (dankclaw_default)
|
|
# 10.89.2.0/24 searxng (systemd-searxng)
|
|
# 10.89.3.0/24 open-webui (systemd-open-webui) <- this file
|
|
|
|
[Network]
|
|
Driver=bridge
|
|
Subnet=10.89.3.0/24
|
|
Gateway=10.89.3.1 |