Ports are not forwarded using podman 6

[windsource]

Windows Version

Microsoft Windows [Version 10.0.26200.8875]

WSL Version

2.7.11.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

6.18.33.2-microsoft-standard-WSL2

Distro Version

Manjaro

Other Software

podman version 6.0.1

Repro Steps

Run in WSL2:

sudo podman run -it --rm -p 8081:80 docker.io/nginx
curl http://localhost:8081

Expected Behavior

The curl command (in WSL2) succeeds and in the browser on windows you can open http://localhost:8081.

Actual Behavior

The curl commands (in WSL2) succeeds but in the browser you cannot open http://localhost:8081 but get ERR_CONNECTION_REFUSED.

The problem occurs only with podman 6. Podman 4.x and 5.x work fine. I have installed podman in Manjaro with sudo pacman -S podman.

Diagnostic Logs

No response

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use .\collect-wsl-logs.ps1 -LogProfile networking instead, following the instructions in Collect WSL logs for networking issues

Once completed please upload the output files to this GitHub issue.

See Collect WSL logs (recommended method).

If you choose to email these logs instead of attaching them to the bug, please send them to wsl-gh-logs@microsoft.com with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.

[windsource]

Unfortunately I cannot collect those logs as on my machine I am not allowed to run scripts in powershell prompt due to execution policy.

[shuaiyuanxx]

@windsource Thanks for the report. To help us further investigate the issue, could you please provide the output of the following commands?

wsl -d <Distro> -- wslinfo --networking-mode

podman info --debug
curl -v http://127.0.0.1:8081
sudo ss -ltnp '( sport = :8081 )'
sudo nft list ruleset | grep -n 8081
ps -ef | grep -E 'conmon|netavark|pasta|rootlessport'

Please also confirm whether Podman is rootful or rootless. This will show whether the failure is in NAT listener discovery, mirrored networking, or Podman's port-publishing path.

[windsource]

@shuaiyuanxx here is the required report. I use rootful podman.

> wsl -d Manjaro -- wslinfo --networking-mode
nat

❯ podman info --debug
WARN[0000] "/" is not a shared mount, this could cause issues or missing mounts with rootless containers
host:
  arch: amd64
  buildahVersion: 1.44.0
  cdiSpecDirs:
  - /etc/cdi
  - /var/run/cdi
  cgroupControllers:
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-1:2.2.1-1
    path: /usr/bin/conmon
    version: 'conmon version 2.2.1, commit: c8cc2c4db27531bd4e084ce7857f73cd21ee639d'
  cpuUtilization:
    idlePercent: 99.48
    systemPercent: 0.36
    userPercent: 0.16
  cpus: 16
  databaseBackend: sqlite
  discoveredDevices:
  - id: nvidia.com/gpu=all
    source: cdi
  distribution:
    distribution: manjaro
    version: unknown
  emulatedArchitectures:
  - linux/arm
  - linux/arm64
  - linux/arm64be
  - linux/loong64
  - linux/mips
  - linux/mips64
  - linux/ppc
  - linux/ppc64
  - linux/ppc64le
  - linux/riscv32
  - linux/riscv64
  - linux/s390x
  eventLogger: journald
  freeLocks: 2040
  hostname: <REDACTED>
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 985
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 6.18.33.2-microsoft-standard-WSL2
  linkmode: dynamic
  logDriver: journald
  memFree: 19239444480
  memTotal: 20971147264
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    defaultNetwork: podman
    dns:
      package: aardvark-dns-2.0.0-1
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 2.0.0
    package: netavark-2.0.0-1
    path: /usr/lib/podman/netavark
    version: netavark 2.0.0
  ociRuntime:
    name: runc
    package: runc-1.5.1-1
    path: /usr/bin/runc
    version: |-
      runc version 1.5.1
      spec: 1.3.0
      go: go1.26.5-X:nodwarf5
      libseccomp: 2.6.0
      libpathrs: 0.2.5
  os: linux
  pasta:
    executable: /usr/sbin/pasta
    package: passt-2026_07_16.090d739-1
    version: |
      pasta 2026_07_16.090d739
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  rootlessPortForwarder: rootlessport
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  swapFree: 5368709120
  swapTotal: 5368709120
  uptime: 0h 1m 54.00s
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries: {}
store:
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev
  graphRoot: /home/holger/.local/share/containers/storage
  graphRootAllocated: 1081101176832
  graphRootUsed: 364379635712
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 3
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/holger/.local/share/containers/storage/volumes
version:
  APIVersion: 6.0.1
  Built: 1783707691
  BuiltTime: Fri Jul 10 20:21:31 2026
  GitCommit: 4cabbe61fa3a27fafc4a3ee1226e38ae1664ae57
  GoVersion: go1.26.5-X:nodwarf5
  Os: linux
  OsArch: linux/amd64
  Version: 6.0.1

❯ curl -v http://127.0.0.1:8081
*   Trying 127.0.0.1:8081...
* Established connection to 127.0.0.1 (127.0.0.1 port 8081) from 127.0.0.1 port 34622
* using HTTP/1.x
> GET / HTTP/1.1
> Host: 127.0.0.1:8081
> User-Agent: curl/8.21.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
< Server: nginx/1.31.3
< Date: Thu, 30 Jul 2026 09:27:20 GMT
< Content-Type: text/html
< Content-Length: 896
< Last-Modified: Wed, 15 Jul 2026 16:03:14 GMT
< Connection: keep-alive
< ETag: "6a57af42-380"
< Accept-Ranges: bytes
<
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, nginx is successfully installed and working.
Further configuration is required for the web server, reverse proxy,
API gateway, load balancer, content cache, or other features.</p>

<p>For online documentation and support please refer to
<a href="https://nginx.org/">nginx.org</a>.<br/>
To engage with the community please visit
<a href="https://community.nginx.org/">community.nginx.org</a>.<br/>
For enterprise grade support, professional services, additional
security features and capabilities please refer to
<a href="https://f5.com/nginx">f5.com/nginx</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>
* Connection #0 to host 127.0.0.1:8081 left intact

❯ sudo ss -ltnp '( sport = :8081 )'
State   Recv-Q   Send-Q      Local Address:Port       Peer Address:Port   Process

❯ sudo nft list ruleset | grep -n 8081
# Warning: table ip filter is managed by iptables-nft, do not touch!
# Warning: table ip nat is managed by iptables-nft, do not touch!
# Warning: table ip mangle is managed by iptables-nft, do not touch!
# Warning: table ip6 filter is managed by iptables-nft, do not touch!
# Warning: table ip6 nat is managed by iptables-nft, do not touch!
251:		tcp dport 8081 jump nv_2f259bab_10_88_0_0_nm16_dnat
276:		ip saddr 10.88.0.0/16 tcp dport 8081 jump NETAVARK-HOSTPORT-SETMARK
277:		ip saddr 127.0.0.1 tcp dport 8081 jump NETAVARK-HOSTPORT-SETMARK
278:		tcp dport 8081 dnat ip to 10.88.0.2:80

❯ ps -ef | grep -E 'conmon|netavark|pasta|rootlessport'
root        1427     867  0 11:24 ?        00:00:00 /usr/bin/conmon --api-version 1 -c f254fcf456ab3f20c0d5db832df391ddc4d1335becbb75a88903dfec0f42e9bf -u f254fcf456ab3f20c0d5db832df391ddc4d1335becbb75a88903dfec0f42e9bf -r /usr/bin/runc -b /var/lib/containers/storage/overlay-containers/f254fcf456ab3f20c0d5db832df391ddc4d1335becbb75a88903dfec0f42e9bf/userdata -p /run/containers/storage/overlay-containers/f254fcf456ab3f20c0d5db832df391ddc4d1335becbb75a88903dfec0f42e9bf/userdata/pidfile -n dreamy_mayer --exit-dir /run/libpod/exits --persist-dir /run/libpod/persist/f254fcf456ab3f20c0d5db832df391ddc4d1335becbb75a88903dfec0f42e9bf --full-attach -s -l journald --log-level warning --syslog --runtime-arg --log-format=json --runtime-arg --log --runtime-arg=/run/containers/storage/overlay-containers/f254fcf456ab3f20c0d5db832df391ddc4d1335becbb75a88903dfec0f42e9bf/userdata/oci-log -t --conmon-pidfile /run/containers/storage/overlay-containers/f254fcf456ab3f20c0d5db832df391ddc4d1335becbb75a88903dfec0f42e9bf/userdata/conmon.pid --exit-command /usr/bin/podman --exit-command-arg --root --exit-command-arg /var/lib/containers/storage --exit-command-arg --runroot --exit-command-arg /run/containers/storage --exit-command-arg --log-level --exit-command-arg warning --exit-command-arg --cgroup-manager --exit-command-arg systemd --exit-command-arg --tmpdir --exit-command-arg /run/libpod --exit-command-arg --network-config-dir --exit-command-arg  --exit-command-arg --volumepath --exit-command-arg /var/lib/containers/storage/volumes --exit-command-arg --transient-store=false --exit-command-arg --hooks-dir --exit-command-arg /usr/share/containers/oci/hooks.d --exit-command-arg --runtime --exit-command-arg runc --exit-command-arg --storage-driver --exit-command-arg overlay --exit-command-arg --storage-opt --exit-command-arg overlay.mountopt=nodev,metacopy=on --exit-command-arg --events-backend --exit-command-arg journald --exit-command-arg container --exit-command-arg cleanup --exit-command-arg --stopped-only --exit-command-arg --rm --exit-command-arg f254fcf456ab3f20c0d5db832df391ddc4d1335becbb75a88903dfec0f42e9bf
holger      2053    1492  0 12:02 pts/4    00:00:00 grep -E conmon|netavark|pasta|rootlessport