Is incus port-forward a simpler/reduced proxy device in NAT mode?

Incus
,
1

As per the title, I’m trying to understand where the new since incus 7.3 incus port-forward fits within Incus network capabilities.

In my understanding, so far we had two main avenues to transfer connections reaching the host to instances on a managed bridge:

(I’ve found Difference between network forward and proxy device (this reply especially) and Forward and map port to container - #2 by stgraber useful to understand the differences and respective use cases.)

Both options always felt a bit heavy/cumbersome to use to me due to their syntax, and that’s why I’m delighted we now get the simpler port-forward.

Am I right in thinking it offers a simpler, TCP-only proxy device (because it is per instance), in NAT mode (because it uses nftables instead of a separate connection/virtual device) but able to listen on the wildcard address, which didn’t use to be the case (at least for VMs)?

2

Trying it just now highlighted something that had completely escaped me: incus port-forward only does temporary/transient forwarding, à la kubectl port-forward.

So it really is on a different level than the other options, and is only suitable for quick debug/check.

I feel that neither the announcement nor the docs made this clear.

Case closed!

3

No. It’s a temporary port forward done through the Incus API by the CLI tool itself.

It’s equivalent to the same feature in SSH.