fix: harden node upgrades and prepare 1.9.0-alpha

core/container/src/podman_client.rs

@@ -450,6 +450,17 @@ impl PodmanClient {
                 "nsmode": net_mode
             },
         });
+        if matches!(
+            manifest.app.container.network.as_deref(),
+            Some(
+                "slirp4netns:allow_host_loopback=true"
+                    | "slirp4netns:allow_host_loopback=true,cidr=169.254.1.0/24"
+            )
+        ) {
+            body["network_options"] = serde_json::json!({
+                "slirp4netns": manifest.app.container.network.as_deref().unwrap().split_once(':').unwrap().1.split(',').collect::<Vec<_>>()
+            });
+        }
         if let Some(network) = custom_network {
             // The container always answers to its own name; manifest
             // network_aliases add extra short hostnames peers may bake in
@@ -727,7 +738,11 @@ fn podman_network_settings(
         Some("host") => ("host", None),
         Some("bridge") => ("bridge", None),
         Some("none") => ("none", None),
-        Some("slirp4netns") => ("slirp4netns", None),
+        Some(
+            "slirp4netns"
+            | "slirp4netns:allow_host_loopback=true"
+            | "slirp4netns:allow_host_loopback=true,cidr=169.254.1.0/24",
+        ) => ("slirp4netns", None),
         Some("pasta") => ("pasta", None),
         Some("private") => ("private", None),
         Some(custom) => ("bridge", Some(custom.to_string())),
@@ -1077,6 +1092,14 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn npm_rootless_options_are_not_a_named_bridge() {
+        assert_eq!(
+            podman_network_settings(Some("slirp4netns:allow_host_loopback=true"), "isolated"),
+            ("slirp4netns", None)
+        );
+    }
+
     #[test]
     fn portainer_manifest_keeps_private_network_and_loopback_api_publication() {
         let m = AppManifest::parse(include_str!("../../../apps/portainer/manifest.yml")).unwrap();