Merge pull request #12534 from Luap99/network-db

network db rewrite

35 files changed, 655 insertions, 260 deletions

diff --git a/pkg/api/handlers/compat/networks.go b/pkg/api/handlers/compat/networks.go
index 8aab29658..db3af7d0b 100644
--- a/pkg/api/handlers/compat/networks.go
+++ b/pkg/api/handlers/compat/networks.go
@@ -299,20 +299,66 @@ func Connect(w http.ResponseWriter, r *http.Request) {
 	runtime := r.Context().Value(api.RuntimeKey).(*libpod.Runtime)
 
 	var (
-		aliases    []string
 		netConnect types.NetworkConnect
 	)
 	if err := json.NewDecoder(r.Body).Decode(&netConnect); err != nil {
 		utils.Error(w, "Something went wrong.", http.StatusInternalServerError, errors.Wrap(err, "Decode()"))
 		return
 	}
+
+	netOpts := nettypes.PerNetworkOptions{}
+
 	name := utils.GetName(r)
 	if netConnect.EndpointConfig != nil {
 		if netConnect.EndpointConfig.Aliases != nil {
-			aliases = netConnect.EndpointConfig.Aliases
+			netOpts.Aliases = netConnect.EndpointConfig.Aliases
+		}
+
+		// if IP address is provided
+		if len(netConnect.EndpointConfig.IPAddress) > 0 {
+			staticIP := net.ParseIP(netConnect.EndpointConfig.IPAddress)
+			if staticIP == nil {
+				utils.Error(w, "failed to parse the ip address", http.StatusInternalServerError,
+					errors.Errorf("failed to parse the ip address %q", netConnect.EndpointConfig.IPAddress))
+				return
+			}
+			netOpts.StaticIPs = append(netOpts.StaticIPs, staticIP)
+		}
+
+		if netConnect.EndpointConfig.IPAMConfig != nil {
+			// if IPAMConfig.IPv4Address is provided
+			if len(netConnect.EndpointConfig.IPAMConfig.IPv4Address) > 0 {
+				staticIP := net.ParseIP(netConnect.EndpointConfig.IPAMConfig.IPv4Address)
+				if staticIP == nil {
+					utils.Error(w, "failed to parse the ipv4 address", http.StatusInternalServerError,
+						errors.Errorf("failed to parse the ipv4 address %q", netConnect.EndpointConfig.IPAMConfig.IPv4Address))
+					return
+				}
+				netOpts.StaticIPs = append(netOpts.StaticIPs, staticIP)
+			}
+			// if IPAMConfig.IPv6Address is provided
+			if len(netConnect.EndpointConfig.IPAMConfig.IPv6Address) > 0 {
+				staticIP := net.ParseIP(netConnect.EndpointConfig.IPAMConfig.IPv6Address)
+				if staticIP == nil {
+					utils.Error(w, "failed to parse the ipv6 address", http.StatusInternalServerError,
+						errors.Errorf("failed to parse the ipv6 address %q", netConnect.EndpointConfig.IPAMConfig.IPv6Address))
+					return
+				}
+				netOpts.StaticIPs = append(netOpts.StaticIPs, staticIP)
+			}
+		}
+		// If MAC address is provided
+		if len(netConnect.EndpointConfig.MacAddress) > 0 {
+			staticMac, err := net.ParseMAC(netConnect.EndpointConfig.MacAddress)
+			if err != nil {
+				utils.Error(w, "failed to parse the mac address", http.StatusInternalServerError,
+					errors.Errorf("failed to parse the mac address %q", netConnect.EndpointConfig.IPAMConfig.IPv6Address))
+				return
+			}
+			netOpts.StaticMAC = nettypes.HardwareAddr(staticMac)
 		}
 	}
-	err := runtime.ConnectContainerToNetwork(netConnect.Container, name, aliases)
+	err := runtime.ConnectContainerToNetwork(netConnect.Container, name, netOpts)
 	if err != nil {
 		if errors.Cause(err) == define.ErrNoSuchCtr {
 			utils.ContainerNotFound(w, netConnect.Container, err)
diff --git a/pkg/api/handlers/compat/swagger.go b/pkg/api/handlers/compat/swagger.go
index cfbdd1154..32167d6b5 100644
--- a/pkg/api/handlers/compat/swagger.go
+++ b/pkg/api/handlers/compat/swagger.go
@@ -55,15 +55,13 @@ type swagCompatNetworkCreateResponse struct {
 }
 
 // Network disconnect
-// swagger:model NetworkConnectRequest
+// swagger:model NetworkCompatConnectRequest
 type swagCompatNetworkConnectRequest struct {
-	// in:body
-	Body struct{ types.NetworkConnect }
+	types.NetworkConnect
 }
 
 // Network disconnect
-// swagger:model NetworkDisconnectRequest
+// swagger:model NetworkCompatDisconnectRequest
 type swagCompatNetworkDisconnectRequest struct {
-	// in:body
-	Body struct{ types.NetworkDisconnect }
+	types.NetworkDisconnect
 }
diff --git a/pkg/api/handlers/libpod/networks.go b/pkg/api/handlers/libpod/networks.go
index 1f7f2e26c..a28c3c57c 100644
--- a/pkg/api/handlers/libpod/networks.go
+++ b/pkg/api/handlers/libpod/networks.go
@@ -125,7 +125,7 @@ func Connect(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	name := utils.GetName(r)
-	err := runtime.ConnectContainerToNetwork(netConnect.Container, name, netConnect.Aliases)
+	err := runtime.ConnectContainerToNetwork(netConnect.Container, name, netConnect.PerNetworkOptions)
 	if err != nil {
 		if errors.Cause(err) == define.ErrNoSuchCtr {
 			utils.ContainerNotFound(w, netConnect.Container, err)
diff --git a/pkg/api/handlers/libpod/play.go b/pkg/api/handlers/libpod/play.go
index f943fc240..312aa32de 100644
--- a/pkg/api/handlers/libpod/play.go
+++ b/pkg/api/handlers/libpod/play.go
@@ -23,7 +23,7 @@ func PlayKube(w http.ResponseWriter, r *http.Request) {
 	runtime := r.Context().Value(api.RuntimeKey).(*libpod.Runtime)
 	decoder := r.Context().Value(api.DecoderKey).(*schema.Decoder)
 	query := struct {
-		Network    string   `schema:"network"`
+		Network    []string `schema:"network"`
 		TLSVerify  bool     `schema:"tlsVerify"`
 		LogDriver  string   `schema:"logDriver"`
 		LogOptions []string `schema:"logOptions"`
@@ -103,7 +103,7 @@ func PlayKube(w http.ResponseWriter, r *http.Request) {
 		Authfile:   authfile,
 		Username:   username,
 		Password:   password,
-		Network:    query.Network,
+		Networks:   query.Network,
 		NoHosts:    query.NoHosts,
 		Quiet:      true,
 		LogDriver:  query.LogDriver,
diff --git a/pkg/api/handlers/libpod/swagger.go b/pkg/api/handlers/libpod/swagger.go
index 7ccfdd0f3..8d7058b1e 100644
--- a/pkg/api/handlers/libpod/swagger.go
+++ b/pkg/api/handlers/libpod/swagger.go
@@ -133,6 +133,12 @@ type swagNetworkPruneResponse struct {
 	Body []entities.NetworkPruneReport
 }
 
+// Network connect
+// swagger:model NetworkConnectRequest
+type swagNetworkConnectRequest struct {
+	entities.NetworkConnectOptions
+}
+
 func ServeSwagger(w http.ResponseWriter, r *http.Request) {
 	path := DefaultPodmanSwaggerSpec
 	if p, found := os.LookupEnv("PODMAN_SWAGGER_SPEC"); found {
diff --git a/pkg/api/server/register_networks.go b/pkg/api/server/register_networks.go
index 641bce333..344486299 100644
--- a/pkg/api/server/register_networks.go
+++ b/pkg/api/server/register_networks.go
@@ -131,7 +131,7 @@ func (s *APIServer) registerNetworkHandlers(r *mux.Router) error {
 	//    name: create
 	//    description: attributes for connecting a container to a network
 	//    schema:
-	//      $ref: "#/definitions/NetworkConnectRequest"
+	//      $ref: "#/definitions/NetworkCompatConnectRequest"
 	// responses:
 	//   200:
 	//     description: OK
@@ -159,7 +159,7 @@ func (s *APIServer) registerNetworkHandlers(r *mux.Router) error {
 	//    name: create
 	//    description: attributes for disconnecting a container from a network
 	//    schema:
-	//      $ref: "#/definitions/NetworkDisconnectRequest"
+	//      $ref: "#/definitions/NetworkCompatDisconnectRequest"
 	// responses:
 	//   200:
 	//     description: OK
@@ -368,7 +368,7 @@ func (s *APIServer) registerNetworkHandlers(r *mux.Router) error {
 	//    name: create
 	//    description: attributes for disconnecting a container from a network
 	//    schema:
-	//      $ref: "#/definitions/NetworkDisconnectRequest"
+	//      $ref: "#/definitions/NetworkCompatDisconnectRequest"
 	// responses:
 	//   200:
 	//     description: OK
diff --git a/pkg/api/server/register_play.go b/pkg/api/server/register_play.go
index 915d0d02e..5ace01929 100644
--- a/pkg/api/server/register_play.go
+++ b/pkg/api/server/register_play.go
@@ -18,8 +18,10 @@ func (s *APIServer) registerPlayHandlers(r *mux.Router) error {
 	// parameters:
 	//  - in: query
 	//    name: network
-	//    type: string
-	//    description: Connect the pod to this network.
+	//    type: array
+	//    description: USe the network mode or specify an array of networks.
+	//    items:
+	//      type: string
 	//  - in: query
 	//    name: tlsVerify
 	//    type: boolean
diff --git a/pkg/bindings/network/network.go b/pkg/bindings/network/network.go
index 172598be1..66e01a016 100644
--- a/pkg/bindings/network/network.go
+++ b/pkg/bindings/network/network.go
@@ -3,7 +3,6 @@ package network
 import (
 	"context"
 	"net/http"
-	"net/url"
 	"strings"
 
 	"github.com/containers/podman/v3/libpod/network/types"
@@ -110,8 +109,6 @@ func Disconnect(ctx context.Context, networkName string, ContainerNameOrID strin
 	if err != nil {
 		return err
 	}
-	// No params are used for disconnect
-	params := url.Values{}
 	// Disconnect sends everything in body
 	disconnect := struct {
 		Container string
@@ -128,7 +125,7 @@ func Disconnect(ctx context.Context, networkName string, ContainerNameOrID strin
 		return err
 	}
 	stringReader := strings.NewReader(body)
-	response, err := conn.DoRequest(ctx, stringReader, http.MethodPost, "/networks/%s/disconnect", params, nil, networkName)
+	response, err := conn.DoRequest(ctx, stringReader, http.MethodPost, "/networks/%s/disconnect", nil, nil, networkName)
 	if err != nil {
 		return err
 	}
@@ -138,32 +135,26 @@ func Disconnect(ctx context.Context, networkName string, ContainerNameOrID strin
 }
 
 // Connect adds a container to a network
-func Connect(ctx context.Context, networkName string, ContainerNameOrID string, options *ConnectOptions) error {
+func Connect(ctx context.Context, networkName string, containerNameOrID string, options *types.PerNetworkOptions) error {
 	if options == nil {
-		options = new(ConnectOptions)
+		options = new(types.PerNetworkOptions)
 	}
 	conn, err := bindings.GetClient(ctx)
 	if err != nil {
 		return err
 	}
-	// No params are used in connect
-	params := url.Values{}
 	// Connect sends everything in body
-	connect := struct {
-		Container string
-		Aliases   []string
-	}{
-		Container: ContainerNameOrID,
-	}
-	if aliases := options.GetAliases(); options.Changed("Aliases") {
-		connect.Aliases = aliases
+	connect := entities.NetworkConnectOptions{
+		Container:         containerNameOrID,
+		PerNetworkOptions: *options,
 	}
+
 	body, err := jsoniter.MarshalToString(connect)
 	if err != nil {
 		return err
 	}
 	stringReader := strings.NewReader(body)
-	response, err := conn.DoRequest(ctx, stringReader, http.MethodPost, "/networks/%s/connect", params, nil, networkName)
+	response, err := conn.DoRequest(ctx, stringReader, http.MethodPost, "/networks/%s/connect", nil, nil, networkName)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/bindings/network/types.go b/pkg/bindings/network/types.go
index 8088de061..b82c0e438 100644
--- a/pkg/bindings/network/types.go
+++ b/pkg/bindings/network/types.go
@@ -1,6 +1,8 @@
 package network
 
-import "net"
+import (
+	"net"
+)
 
 //go:generate go run ../generator/generator.go CreateOptions
 // CreateOptions are optional options for creating networks
@@ -61,15 +63,6 @@ type DisconnectOptions struct {
 	Force *bool
 }
 
-//go:generate go run ../generator/generator.go ConnectOptions
-// ConnectOptions are optional options for connecting
-// containers from a network
-type ConnectOptions struct {
-	// Aliases are names the container will be known as
-	// when using the dns plugin
-	Aliases *[]string
-}
-
 //go:generate go run ../generator/generator.go ExistsOptions
 // ExistsOptions are optional options for checking
 // if a network exists
diff --git a/pkg/bindings/network/types_connect_options.go b/pkg/bindings/network/types_connect_options.go
deleted file mode 100644
index b7a465999..000000000
--- a/pkg/bindings/network/types_connect_options.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Code generated by go generate; DO NOT EDIT.
-package network
-
-import (
-	"net/url"
-
-	"github.com/containers/podman/v3/pkg/bindings/internal/util"
-)
-
-// Changed returns true if named field has been set
-func (o *ConnectOptions) Changed(fieldName string) bool {
-	return util.Changed(o, fieldName)
-}
-
-// ToParams formats struct fields to be passed to API service
-func (o *ConnectOptions) ToParams() (url.Values, error) {
-	return util.ToParams(o)
-}
-
-// WithAliases set field Aliases to given value
-func (o *ConnectOptions) WithAliases(value []string) *ConnectOptions {
-	o.Aliases = &value
-	return o
-}
-
-// GetAliases returns value of field Aliases
-func (o *ConnectOptions) GetAliases() []string {
-	if o.Aliases == nil {
-		var z []string
-		return z
-	}
-	return *o.Aliases
-}
diff --git a/pkg/bindings/play/types.go b/pkg/bindings/play/types.go
index 011f7f9ca..ca639e46b 100644
--- a/pkg/bindings/play/types.go
+++ b/pkg/bindings/play/types.go
@@ -15,8 +15,8 @@ type KubeOptions struct {
 	Username *string
 	// Password for authenticating against the registry.
 	Password *string
-	// Network - name of the CNI network to connect to.
-	Network *string
+	// Network - name of the networks to connect to.
+	Network *[]string
 	// NoHosts - do not generate /etc/hosts file in pod's containers
 	NoHosts *bool
 	// Quiet - suppress output when pulling images.
diff --git a/pkg/bindings/play/types_kube_options.go b/pkg/bindings/play/types_kube_options.go
index 344771e0c..593f026a3 100644
--- a/pkg/bindings/play/types_kube_options.go
+++ b/pkg/bindings/play/types_kube_options.go
@@ -79,15 +79,15 @@ func (o *KubeOptions) GetPassword() string {
 }
 
 // WithNetwork set field Network to given value
-func (o *KubeOptions) WithNetwork(value string) *KubeOptions {
+func (o *KubeOptions) WithNetwork(value []string) *KubeOptions {
 	o.Network = &value
 	return o
 }
 
 // GetNetwork returns value of field Network
-func (o *KubeOptions) GetNetwork() string {
+func (o *KubeOptions) GetNetwork() []string {
 	if o.Network == nil {
-		var z string
+		var z []string
 		return z
 	}
 	return *o.Network
diff --git a/pkg/checkpoint/checkpoint_restore.go b/pkg/checkpoint/checkpoint_restore.go
index c371adf5b..34bd8a124 100644
--- a/pkg/checkpoint/checkpoint_restore.go
+++ b/pkg/checkpoint/checkpoint_restore.go
@@ -78,6 +78,18 @@ func CRImportCheckpoint(ctx context.Context, runtime *libpod.Runtime, restoreOpt
 		}
 	}
 
+	if restoreOptions.IgnoreStaticIP || restoreOptions.IgnoreStaticMAC {
+		for net, opts := range ctrConfig.Networks {
+			if restoreOptions.IgnoreStaticIP {
+				opts.StaticIPs = nil
+			}
+			if restoreOptions.IgnoreStaticMAC {
+				opts.StaticMAC = nil
+			}
+			ctrConfig.Networks[net] = opts
+		}
+	}
+
 	ctrID := ctrConfig.ID
 	newName := false
 
diff --git a/pkg/domain/entities/network.go b/pkg/domain/entities/network.go
index d7389a699..34b89ae7d 100644
--- a/pkg/domain/entities/network.go
+++ b/pkg/domain/entities/network.go
@@ -2,6 +2,8 @@ package entities
 
 import (
 	"net"
+
+	"github.com/containers/podman/v3/libpod/network/types"
 )
 
 // NetworkListOptions describes options for listing networks in cli
@@ -67,8 +69,8 @@ type NetworkDisconnectOptions struct {
 // NetworkConnectOptions describes options for connecting
 // a container to a network
 type NetworkConnectOptions struct {
-	Aliases   []string
-	Container string
+	Container string `json:"container"`
+	types.PerNetworkOptions
 }
 
 // NetworkPruneReport containers the name of network and an error
diff --git a/pkg/domain/entities/play.go b/pkg/domain/entities/play.go
index ad35dfe25..39234caf8 100644
--- a/pkg/domain/entities/play.go
+++ b/pkg/domain/entities/play.go
@@ -26,8 +26,8 @@ type PlayKubeOptions struct {
 	Username string
 	// Password for authenticating against the registry.
 	Password string
-	// Network - name of the CNI network to connect to.
-	Network string
+	// Networks - name of the network to connect to.
+	Networks []string
 	// Quiet - suppress output when pulling images.
 	Quiet bool
 	// SignaturePolicy - path to a signature-policy file.
diff --git a/pkg/domain/entities/pods.go b/pkg/domain/entities/pods.go
index b255785c2..14127e468 100644
--- a/pkg/domain/entities/pods.go
+++ b/pkg/domain/entities/pods.go
@@ -7,7 +7,6 @@ import (
 
 	commonFlag "github.com/containers/common/pkg/flag"
 	"github.com/containers/podman/v3/libpod/define"
-	"github.com/containers/podman/v3/libpod/network/types"
 	"github.com/containers/podman/v3/pkg/specgen"
 	"github.com/containers/podman/v3/pkg/util"
 	"github.com/opencontainers/runtime-spec/specs-go"
@@ -329,11 +328,8 @@ func ToPodSpecGen(s specgen.PodSpecGenerator, p *PodCreateOptions) (*specgen.Pod
 
 	if p.Net != nil {
 		s.NetNS = p.Net.Network
-		s.StaticIP = p.Net.StaticIP
-		// type cast to types.HardwareAddr
-		s.StaticMAC = (*types.HardwareAddr)(p.Net.StaticMAC)
 		s.PortMappings = p.Net.PublishPorts
-		s.CNINetworks = p.Net.CNINetworks
+		s.Networks = p.Net.Networks
 		s.NetworkOptions = p.Net.NetworkOptions
 		if p.Net.UseImageResolvConf {
 			s.NoManageResolvConf = true
diff --git a/pkg/domain/entities/types.go b/pkg/domain/entities/types.go
index e062b9442..0348c0af5 100644
--- a/pkg/domain/entities/types.go
+++ b/pkg/domain/entities/types.go
@@ -45,18 +45,16 @@ type NetFlags struct {
 // NetOptions reflect the shared network options between
 // pods and containers
 type NetOptions struct {
-	AddHosts           []string            `json:"hostadd,omitempty"`
-	Aliases            []string            `json:"network_alias,omitempty"`
-	CNINetworks        []string            `json:"cni_networks,omitempty"`
-	UseImageResolvConf bool                `json:"no_manage_resolv_conf,omitempty"`
-	DNSOptions         []string            `json:"dns_option,omitempty"`
-	DNSSearch          []string            `json:"dns_search,omitempty"`
-	DNSServers         []net.IP            `json:"dns_server,omitempty"`
-	Network            specgen.Namespace   `json:"netns,omitempty"`
-	NoHosts            bool                `json:"no_manage_hosts,omitempty"`
-	PublishPorts       []types.PortMapping `json:"portmappings,omitempty"`
-	StaticIP           *net.IP             `json:"static_ip,omitempty"`
-	StaticMAC          *net.HardwareAddr   `json:"static_mac,omitempty"`
+	AddHosts           []string                           `json:"hostadd,omitempty"`
+	Aliases            []string                           `json:"network_alias,omitempty"`
+	Networks           map[string]types.PerNetworkOptions `json:"networks,omitempty"`
+	UseImageResolvConf bool                               `json:"no_manage_resolv_conf,omitempty"`
+	DNSOptions         []string                           `json:"dns_option,omitempty"`
+	DNSSearch          []string                           `json:"dns_search,omitempty"`
+	DNSServers         []net.IP                           `json:"dns_server,omitempty"`
+	Network            specgen.Namespace                  `json:"netns,omitempty"`
+	NoHosts            bool                               `json:"no_manage_hosts,omitempty"`
+	PublishPorts       []types.PortMapping                `json:"portmappings,omitempty"`
 	// NetworkOptions are additional options for each network
 	NetworkOptions map[string][]string `json:"network_options,omitempty"`
 }
diff --git a/pkg/domain/filters/containers.go b/pkg/domain/filters/containers.go
index a28167d3e..60a1efb22 100644
--- a/pkg/domain/filters/containers.go
+++ b/pkg/domain/filters/containers.go
@@ -249,7 +249,7 @@ func GenerateContainerFilterFuncs(filter string, filterValues []string, r *libpo
 				return false
 			}
 
-			networks, _, err := c.Networks()
+			networks, err := c.Networks()
 			// if err or no networks, quick out
 			if err != nil || len(networks) == 0 {
 				return false
diff --git a/pkg/domain/filters/pods.go b/pkg/domain/filters/pods.go
index ed7506bf3..8231dbc79 100644
--- a/pkg/domain/filters/pods.go
+++ b/pkg/domain/filters/pods.go
@@ -142,7 +142,7 @@ func GeneratePodFilterFunc(filter string, filterValues []string, r *libpod.Runti
 			if err != nil {
 				return false
 			}
-			networks, _, err := infra.Networks()
+			networks, err := infra.Networks()
 			// if err or no networks, quick out
 			if err != nil || len(networks) == 0 {
 				return false
diff --git a/pkg/domain/infra/abi/network.go b/pkg/domain/infra/abi/network.go
index ee7403ed5..c7b12663c 100644
--- a/pkg/domain/infra/abi/network.go
+++ b/pkg/domain/infra/abi/network.go
@@ -71,7 +71,7 @@ func (ic *ContainerEngine) NetworkRm(ctx context.Context, namesOrIds []string, o
 		}
 		// We need to iterate containers looking to see if they belong to the given network
 		for _, c := range containers {
-			networks, _, err := c.Networks()
+			networks, err := c.Networks()
 			// if container vanished or network does not exist, go to next container
 			if errors.Is(err, define.ErrNoSuchNetwork) || errors.Is(err, define.ErrNoSuchCtr) {
 				continue
@@ -124,7 +124,7 @@ func (ic *ContainerEngine) NetworkDisconnect(ctx context.Context, networkname st
 }
 
 func (ic *ContainerEngine) NetworkConnect(ctx context.Context, networkname string, options entities.NetworkConnectOptions) error {
-	return ic.Libpod.ConnectContainerToNetwork(options.Container, networkname, options.Aliases)
+	return ic.Libpod.ConnectContainerToNetwork(options.Container, networkname, options.PerNetworkOptions)
 }
 
 // NetworkExists checks if the given network exists
@@ -152,7 +152,7 @@ func (ic *ContainerEngine) NetworkPrune(ctx context.Context, options entities.Ne
 	// containers want
 	networksToKeep := make(map[string]bool)
 	for _, c := range cons {
-		nets, _, err := c.Networks()
+		nets, err := c.Networks()
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/domain/infra/abi/play.go b/pkg/domain/infra/abi/play.go
index 4c024a3d8..6b3b04a0b 100644
--- a/pkg/domain/infra/abi/play.go
+++ b/pkg/domain/infra/abi/play.go
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
-	"net"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -18,6 +17,7 @@ import (
 	"github.com/containers/image/v5/types"
 	"github.com/containers/podman/v3/libpod"
 	"github.com/containers/podman/v3/libpod/define"
+	nettypes "github.com/containers/podman/v3/libpod/network/types"
 	"github.com/containers/podman/v3/pkg/autoupdate"
 	"github.com/containers/podman/v3/pkg/domain/entities"
 	"github.com/containers/podman/v3/pkg/specgen"
@@ -190,39 +190,52 @@ func (ic *ContainerEngine) playKubePod(ctx context.Context, podName string, podY
 		}
 	}
 
-	podOpt := entities.PodCreateOptions{Infra: true, Net: &entities.NetOptions{StaticIP: &net.IP{}, StaticMAC: &net.HardwareAddr{}, NoHosts: options.NoHosts}}
+	podOpt := entities.PodCreateOptions{Infra: true, Net: &entities.NetOptions{NoHosts: options.NoHosts}}
 	podOpt, err = kube.ToPodOpt(ctx, podName, podOpt, podYAML)
 	if err != nil {
 		return nil, err
 	}
 
-	if options.Network != "" {
-		ns, cniNets, netOpts, err := specgen.ParseNetworkString(options.Network)
-		if err != nil {
-			return nil, err
-		}
-
-		if (ns.IsBridge() && len(cniNets) == 0) || ns.IsHost() {
-			return nil, errors.Errorf("invalid value passed to --network: bridge or host networking must be configured in YAML")
-		}
+	ns, networks, netOpts, err := specgen.ParseNetworkFlag(options.Networks)
+	if err != nil {
+		return nil, err
+	}
 
-		podOpt.Net.Network = ns
-		if len(cniNets) > 0 {
-			podOpt.Net.CNINetworks = append(podOpt.Net.CNINetworks, cniNets...)
-		}
-		if len(netOpts) > 0 {
-			podOpt.Net.NetworkOptions = netOpts
-		}
+	if (ns.IsBridge() && len(networks) == 0) || ns.IsHost() {
+		return nil, errors.Errorf("invalid value passed to --network: bridge or host networking must be configured in YAML")
 	}
 
+	podOpt.Net.Network = ns
+	podOpt.Net.Networks = networks
+	podOpt.Net.NetworkOptions = netOpts
+
+	// FIXME This is very hard to support properly with a good ux
 	if len(options.StaticIPs) > *ipIndex {
-		podOpt.Net.StaticIP = &options.StaticIPs[*ipIndex]
+		if !podOpt.Net.Network.IsBridge() {
+			errors.Wrap(define.ErrInvalidArg, "static ip addresses can only be set when the network mode is bridge")
+		}
+		if len(podOpt.Net.Networks) != 1 {
+			return nil, errors.Wrap(define.ErrInvalidArg, "cannot set static ip addresses for more than network, use netname:ip=<ip> syntax to specify ips for more than network")
+		}
+		for name, netOpts := range podOpt.Net.Networks {
+			netOpts.StaticIPs = append(netOpts.StaticIPs, options.StaticIPs[*ipIndex])
+			podOpt.Net.Networks[name] = netOpts
+		}
 	} else if len(options.StaticIPs) > 0 {
 		// only warn if the user has set at least one ip
 		logrus.Warn("No more static ips left using a random one")
 	}
 	if len(options.StaticMACs) > *ipIndex {
-		podOpt.Net.StaticMAC = &options.StaticMACs[*ipIndex]
+		if !podOpt.Net.Network.IsBridge() {
+			errors.Wrap(define.ErrInvalidArg, "static mac address can only be set when the network mode is bridge")
+		}
+		if len(podOpt.Net.Networks) != 1 {
+			return nil, errors.Wrap(define.ErrInvalidArg, "cannot set static mac address for more than network, use netname:mac=<mac> syntax to specify mac for more than network")
+		}
+		for name, netOpts := range podOpt.Net.Networks {
+			netOpts.StaticMAC = nettypes.HardwareAddr(options.StaticMACs[*ipIndex])
+			podOpt.Net.Networks[name] = netOpts
+		}
 	} else if len(options.StaticIPs) > 0 {
 		// only warn if the user has set at least one mac
 		logrus.Warn("No more static macs left using a random one")
diff --git a/pkg/domain/infra/abi/pods.go b/pkg/domain/infra/abi/pods.go
index fc0a2337c..7bda7e994 100644
--- a/pkg/domain/infra/abi/pods.go
+++ b/pkg/domain/infra/abi/pods.go
@@ -376,7 +376,7 @@ func (ic *ContainerEngine) PodPs(ctx context.Context, options entities.PodPSOpti
 			if err != nil {
 				return nil, err
 			}
-			networks, _, err = infra.Networks()
+			networks, err = infra.Networks()
 			if err != nil {
 				return nil, err
 			}
diff --git a/pkg/domain/infra/tunnel/network.go b/pkg/domain/infra/tunnel/network.go
index 069982d30..b5050345a 100644
--- a/pkg/domain/infra/tunnel/network.go
+++ b/pkg/domain/infra/tunnel/network.go
@@ -81,8 +81,7 @@ func (ic *ContainerEngine) NetworkDisconnect(ctx context.Context, networkname st
 
 // NetworkConnect removes a container from a given network
 func (ic *ContainerEngine) NetworkConnect(ctx context.Context, networkname string, opts entities.NetworkConnectOptions) error {
-	options := new(network.ConnectOptions).WithAliases(opts.Aliases)
-	return network.Connect(ic.ClientCtx, networkname, opts.Container, options)
+	return network.Connect(ic.ClientCtx, networkname, opts.Container, &opts.PerNetworkOptions)
 }
 
 // NetworkExists checks if the given network exists
diff --git a/pkg/domain/infra/tunnel/play.go b/pkg/domain/infra/tunnel/play.go
index 75952ce2c..103be0cf1 100644
--- a/pkg/domain/infra/tunnel/play.go
+++ b/pkg/domain/infra/tunnel/play.go
@@ -11,7 +11,7 @@ import (
 func (ic *ContainerEngine) PlayKube(ctx context.Context, path string, opts entities.PlayKubeOptions) (*entities.PlayKubeReport, error) {
 	options := new(play.KubeOptions).WithAuthfile(opts.Authfile).WithUsername(opts.Username).WithPassword(opts.Password)
 	options.WithCertDir(opts.CertDir).WithQuiet(opts.Quiet).WithSignaturePolicy(opts.SignaturePolicy).WithConfigMaps(opts.ConfigMaps)
-	options.WithLogDriver(opts.LogDriver).WithNetwork(opts.Network).WithSeccompProfileRoot(opts.SeccompProfileRoot)
+	options.WithLogDriver(opts.LogDriver).WithNetwork(opts.Networks).WithSeccompProfileRoot(opts.SeccompProfileRoot)
 	options.WithStaticIPs(opts.StaticIPs).WithStaticMACs(opts.StaticMACs)
 	if len(opts.LogOptions) > 0 {
 		options.WithLogOptions(opts.LogOptions)
diff --git a/pkg/ps/ps.go b/pkg/ps/ps.go
index 90ad23f49..391bd54d6 100644
--- a/pkg/ps/ps.go
+++ b/pkg/ps/ps.go
@@ -207,7 +207,7 @@ func ListContainerBatch(rt *libpod.Runtime, ctr *libpod.Container, opts entities
 		return entities.ListContainer{}, err
 	}
 
-	networks, _, err := ctr.Networks()
+	networks, err := ctr.Networks()
 	if err != nil {
 		return entities.ListContainer{}, err
 	}
diff --git a/pkg/specgen/container_validate.go b/pkg/specgen/container_validate.go
index caea51ea8..d06a047c1 100644
--- a/pkg/specgen/container_validate.go
+++ b/pkg/specgen/container_validate.go
@@ -29,25 +29,10 @@ func exclusiveOptions(opt1, opt2 string) error {
 // Validate verifies that the given SpecGenerator is valid and satisfies required
 // input for creating a container.
 func (s *SpecGenerator) Validate() error {
-	if rootless.IsRootless() && len(s.CNINetworks) == 0 {
-		if s.StaticIP != nil || s.StaticIPv6 != nil {
-			return ErrNoStaticIPRootless
-		}
-		if s.StaticMAC != nil {
-			return ErrNoStaticMACRootless
-		}
-	}
-
 	// Containers being added to a pod cannot have certain network attributes
 	// associated with them because those should be on the infra container.
 	if len(s.Pod) > 0 && s.NetNS.NSMode == FromPod {
-		if s.StaticIP != nil || s.StaticIPv6 != nil {
-			return errors.Wrap(define.ErrNetworkOnPodContainer, "static ip addresses must be defined when the pod is created")
-		}
-		if s.StaticMAC != nil {
-			return errors.Wrap(define.ErrNetworkOnPodContainer, "MAC addresses must be defined when the pod is created")
-		}
-		if len(s.CNINetworks) > 0 {
+		if len(s.Networks) > 0 {
 			return errors.Wrap(define.ErrNetworkOnPodContainer, "networks must be defined when the pod is created")
 		}
 		if len(s.PortMappings) > 0 || s.PublishExposedPorts {
@@ -204,5 +189,10 @@ func (s *SpecGenerator) Validate() error {
 	if err := validateNetNS(&s.NetNS); err != nil {
 		return err
 	}
+	if s.NetNS.NSMode != Bridge && len(s.Networks) > 0 {
+		// Note that we also get the ip and mac in the networks map
+		return errors.New("Networks and static ip/mac address can only be used with Bridge mode networking")
+	}
+
 	return nil
 }
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go
index df5d2e8ff..331c9393a 100644
--- a/pkg/specgen/generate/container_create.go
+++ b/pkg/specgen/generate/container_create.go
@@ -160,10 +160,6 @@ func MakeContainer(ctx context.Context, rt *libpod.Runtime, s *specgen.SpecGener
 	}
 	options = append(options, opts...)
 
-	if len(s.Aliases) > 0 {
-		options = append(options, libpod.WithNetworkAliases(s.Aliases))
-	}
-
 	if containerType := s.InitContainerType; len(containerType) > 0 {
 		options = append(options, libpod.WithInitCtrType(containerType))
 	}
diff --git a/pkg/specgen/generate/namespaces.go b/pkg/specgen/generate/namespaces.go
index 7d63fc10f..a2bc37e34 100644
--- a/pkg/specgen/generate/namespaces.go
+++ b/pkg/specgen/generate/namespaces.go
@@ -10,6 +10,7 @@ import (
 	"github.com/containers/common/pkg/config"
 	"github.com/containers/podman/v3/libpod"
 	"github.com/containers/podman/v3/libpod/define"
+	"github.com/containers/podman/v3/libpod/network/types"
 	"github.com/containers/podman/v3/pkg/rootless"
 	"github.com/containers/podman/v3/pkg/specgen"
 	"github.com/containers/podman/v3/pkg/util"
@@ -66,7 +67,7 @@ func GetDefaultNamespaceMode(nsType string, cfg *config.Config, pod *libpod.Pod)
 	case "cgroup":
 		return specgen.ParseCgroupNamespace(cfg.Containers.CgroupNS)
 	case "net":
-		ns, _, err := specgen.ParseNetworkNamespace(cfg.Containers.NetNS, cfg.Containers.RootlessNetworking == "cni")
+		ns, _, _, err := specgen.ParseNetworkFlag(nil)
 		return ns, err
 	}
 
@@ -250,7 +251,7 @@ func namespaceOptions(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.
 		if s.NetNS.Value != "" {
 			val = fmt.Sprintf("slirp4netns:%s", s.NetNS.Value)
 		}
-		toReturn = append(toReturn, libpod.WithNetNS(portMappings, expose, postConfigureNetNS, val, s.CNINetworks))
+		toReturn = append(toReturn, libpod.WithNetNS(portMappings, expose, postConfigureNetNS, val, nil))
 	case specgen.Private:
 		fallthrough
 	case specgen.Bridge:
@@ -258,7 +259,34 @@ func namespaceOptions(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.
 		if err != nil {
 			return nil, err
 		}
-		toReturn = append(toReturn, libpod.WithNetNS(portMappings, expose, postConfigureNetNS, "bridge", s.CNINetworks))
+
+		rtConfig, err := rt.GetConfigNoCopy()
+		if err != nil {
+			return nil, err
+		}
+		// if no network was specified use add the default
+		if len(s.Networks) == 0 {
+			// backwards config still allow the old cni networks list and convert to new format
+			if len(s.CNINetworks) > 0 {
+				logrus.Warn(`specgen "cni_networks" option is deprecated use the "networks" map instead`)
+				networks := make(map[string]types.PerNetworkOptions, len(s.CNINetworks))
+				for _, net := range s.CNINetworks {
+					networks[net] = types.PerNetworkOptions{}
+				}
+				s.Networks = networks
+			} else {
+				// no networks given but bridge is set so use default network
+				s.Networks = map[string]types.PerNetworkOptions{
+					rtConfig.Network.DefaultNetwork: {},
+				}
+			}
+		}
+		// rename the "default" network to the correct default name
+		if opts, ok := s.Networks["default"]; ok {
+			s.Networks[rtConfig.Network.DefaultNetwork] = opts
+			delete(s.Networks, "default")
+		}
+		toReturn = append(toReturn, libpod.WithNetNS(portMappings, expose, postConfigureNetNS, "bridge", s.Networks))
 	}
 
 	if s.UseImageHosts {
@@ -281,12 +309,6 @@ func namespaceOptions(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.
 	if len(s.DNSOptions) > 0 {
 		toReturn = append(toReturn, libpod.WithDNSOption(s.DNSOptions))
 	}
-	if s.StaticIP != nil {
-		toReturn = append(toReturn, libpod.WithStaticIP(*s.StaticIP))
-	}
-	if s.StaticMAC != nil {
-		toReturn = append(toReturn, libpod.WithStaticMAC(*s.StaticMAC))
-	}
 	if s.NetworkOptions != nil {
 		toReturn = append(toReturn, libpod.WithNetworkOptions(s.NetworkOptions))
 	}
diff --git a/pkg/specgen/generate/pod_create.go b/pkg/specgen/generate/pod_create.go
index 72dd249e7..0a797c571 100644
--- a/pkg/specgen/generate/pod_create.go
+++ b/pkg/specgen/generate/pod_create.go
@@ -218,9 +218,7 @@ func MapSpec(p *specgen.PodSpecGenerator) (*specgen.SpecGenerator, error) {
 	case specgen.Host:
 		logrus.Debugf("Pod will use host networking")
 		if len(p.InfraContainerSpec.PortMappings) > 0 ||
-			p.InfraContainerSpec.StaticIP != nil ||
-			p.InfraContainerSpec.StaticMAC != nil ||
-			len(p.InfraContainerSpec.CNINetworks) > 0 ||
+			len(p.InfraContainerSpec.Networks) > 0 ||
 			p.InfraContainerSpec.NetNS.NSMode == specgen.NoNetwork {
 			return nil, errors.Wrapf(define.ErrInvalidArg, "cannot set host network if network-related configuration is specified")
 		}
@@ -234,9 +232,7 @@ func MapSpec(p *specgen.PodSpecGenerator) (*specgen.SpecGenerator, error) {
 	case specgen.NoNetwork:
 		logrus.Debugf("Pod will not use networking")
 		if len(p.InfraContainerSpec.PortMappings) > 0 ||
-			p.InfraContainerSpec.StaticIP != nil ||
-			p.InfraContainerSpec.StaticMAC != nil ||
-			len(p.InfraContainerSpec.CNINetworks) > 0 ||
+			len(p.InfraContainerSpec.Networks) > 0 ||
 			p.InfraContainerSpec.NetNS.NSMode == "host" {
 			return nil, errors.Wrapf(define.ErrInvalidArg, "cannot disable pod network if network-related configuration is specified")
 		}
@@ -264,15 +260,13 @@ func MapSpec(p *specgen.PodSpecGenerator) (*specgen.SpecGenerator, error) {
 	if len(p.DNSSearch) > 0 {
 		p.InfraContainerSpec.DNSSearch = p.DNSSearch
 	}
-	if p.StaticIP != nil {
-		p.InfraContainerSpec.StaticIP = p.StaticIP
-	}
-	if p.StaticMAC != nil {
-		p.InfraContainerSpec.StaticMAC = p.StaticMAC
-	}
 	if p.NoManageResolvConf {
 		p.InfraContainerSpec.UseImageResolvConf = true
 	}
+	if len(p.Networks) > 0 {
+		p.InfraContainerSpec.Networks = p.Networks
+	}
+	// deprecated cni networks for api users
 	if len(p.CNINetworks) > 0 {
 		p.InfraContainerSpec.CNINetworks = p.CNINetworks
 	}
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
index bb5385ef1..15a8ece17 100644
--- a/pkg/specgen/namespaces.go
+++ b/pkg/specgen/namespaces.go
@@ -2,10 +2,13 @@ package specgen
 
 import (
 	"fmt"
+	"net"
 	"os"
 	"strings"
 
 	"github.com/containers/common/pkg/cgroups"
+	"github.com/containers/podman/v3/libpod/define"
+	"github.com/containers/podman/v3/libpod/network/types"
 	"github.com/containers/podman/v3/pkg/rootless"
 	"github.com/containers/podman/v3/pkg/util"
 	"github.com/containers/storage"
@@ -271,9 +274,9 @@ func ParseUserNamespace(ns string) (Namespace, error) {
 // ParseNetworkNamespace parses a network namespace specification in string
 // form.
 // Returns a namespace and (optionally) a list of CNI networks to join.
-func ParseNetworkNamespace(ns string, rootlessDefaultCNI bool) (Namespace, []string, error) {
+func ParseNetworkNamespace(ns string, rootlessDefaultCNI bool) (Namespace, map[string]types.PerNetworkOptions, error) {
 	toReturn := Namespace{}
-	var cniNetworks []string
+	networks := make(map[string]types.PerNetworkOptions)
 	// Net defaults to Slirp on rootless
 	switch {
 	case ns == string(Slirp), strings.HasPrefix(ns, string(Slirp)+":"):
@@ -313,28 +316,174 @@ func ParseNetworkNamespace(ns string, rootlessDefaultCNI bool) (Namespace, []str
 	default:
 		// Assume we have been given a list of CNI networks.
 		// Which only works in bridge mode, so set that.
-		cniNetworks = strings.Split(ns, ",")
+		networkList := strings.Split(ns, ",")
+		for _, net := range networkList {
+			networks[net] = types.PerNetworkOptions{}
+		}
+
 		toReturn.NSMode = Bridge
 	}
 
-	return toReturn, cniNetworks, nil
+	return toReturn, networks, nil
 }
 
-func ParseNetworkString(network string) (Namespace, []string, map[string][]string, error) {
+// ParseNetworkFlag parses a network string slice into the network options
+// If the input is nil or empty it will use the default setting from containers.conf
+func ParseNetworkFlag(networks []string) (Namespace, map[string]types.PerNetworkOptions, map[string][]string, error) {
 	var networkOptions map[string][]string
-	parts := strings.SplitN(network, ":", 2)
+	// by default we try to use the containers.conf setting
+	// if we get at least one value use this instead
+	ns := containerConfig.Containers.NetNS
+	if len(networks) > 0 {
+		ns = networks[0]
+	}
 
-	ns, cniNets, err := ParseNetworkNamespace(network, containerConfig.Containers.RootlessNetworking == "cni")
-	if err != nil {
-		return Namespace{}, nil, nil, err
+	toReturn := Namespace{}
+	podmanNetworks := make(map[string]types.PerNetworkOptions)
+
+	switch {
+	case ns == string(Slirp), strings.HasPrefix(ns, string(Slirp)+":"):
+		parts := strings.SplitN(ns, ":", 2)
+		if len(parts) > 1 {
+			networkOptions = make(map[string][]string)
+			networkOptions[parts[0]] = strings.Split(parts[1], ",")
+		}
+		toReturn.NSMode = Slirp
+	case ns == string(FromPod):
+		toReturn.NSMode = FromPod
+	case ns == "" || ns == string(Default) || ns == string(Private):
+		// Net defaults to Slirp on rootless
+		if rootless.IsRootless() && containerConfig.Containers.RootlessNetworking != "cni" {
+			toReturn.NSMode = Slirp
+			break
+		}
+		// if not slirp we use bridge
+		fallthrough
+	case ns == string(Bridge), strings.HasPrefix(ns, string(Bridge)+":"):
+		toReturn.NSMode = Bridge
+		parts := strings.SplitN(ns, ":", 2)
+		netOpts := types.PerNetworkOptions{}
+		if len(parts) > 1 {
+			var err error
+			netOpts, err = parseBridgeNetworkOptions(parts[1])
+			if err != nil {
+				return toReturn, nil, nil, err
+			}
+		}
+		// we have to set the special default network name here
+		podmanNetworks["default"] = netOpts
+
+	case ns == string(NoNetwork):
+		toReturn.NSMode = NoNetwork
+	case ns == string(Host):
+		toReturn.NSMode = Host
+	case strings.HasPrefix(ns, "ns:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, nil, nil, errors.Errorf("must provide a path to a namespace when specifying ns:")
+		}
+		toReturn.NSMode = Path
+		toReturn.Value = split[1]
+	case strings.HasPrefix(ns, string(FromContainer)+":"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, nil, nil, errors.Errorf("must provide name or ID or a container when specifying container:")
+		}
+		toReturn.NSMode = FromContainer
+		toReturn.Value = split[1]
+	default:
+		// we should have a normal network
+		parts := strings.SplitN(ns, ":", 2)
+		if len(parts) == 1 {
+			// Assume we have been given a comma separated list of networks for backwards compat.
+			networkList := strings.Split(ns, ",")
+			for _, net := range networkList {
+				podmanNetworks[net] = types.PerNetworkOptions{}
+			}
+		} else {
+			if parts[0] == "" {
+				return toReturn, nil, nil, errors.New("network name cannot be empty")
+			}
+			netOpts, err := parseBridgeNetworkOptions(parts[1])
+			if err != nil {
+				return toReturn, nil, nil, errors.Wrapf(err, "invalid option for network %s", parts[0])
+			}
+			podmanNetworks[parts[0]] = netOpts
+		}
+
+		// networks need bridge mode
+		toReturn.NSMode = Bridge
+	}
+
+	if len(networks) > 1 {
+		if !toReturn.IsBridge() {
+			return toReturn, nil, nil, errors.Wrapf(define.ErrInvalidArg, "cannot set multiple networks without bridge network mode, selected mode %s", toReturn.NSMode)
+		}
+
+		for _, network := range networks[1:] {
+			parts := strings.SplitN(network, ":", 2)
+			if parts[0] == "" {
+				return toReturn, nil, nil, errors.Wrapf(define.ErrInvalidArg, "network name cannot be empty")
+			}
+			if util.StringInSlice(parts[0], []string{string(Bridge), string(Slirp), string(FromPod), string(NoNetwork),
+				string(Default), string(Private), string(Path), string(FromContainer), string(Host)}) {
+				return toReturn, nil, nil, errors.Wrapf(define.ErrInvalidArg, "can only set extra network names, selected mode %s conflicts with bridge", parts[0])
+			}
+			netOpts := types.PerNetworkOptions{}
+			if len(parts) > 1 {
+				var err error
+				netOpts, err = parseBridgeNetworkOptions(parts[1])
+				if err != nil {
+					return toReturn, nil, nil, errors.Wrapf(err, "invalid option for network %s", parts[0])
+				}
+			}
+			podmanNetworks[parts[0]] = netOpts
+		}
+	}
+
+	return toReturn, podmanNetworks, networkOptions, nil
+}
+
+func parseBridgeNetworkOptions(opts string) (types.PerNetworkOptions, error) {
+	netOpts := types.PerNetworkOptions{}
+	if len(opts) == 0 {
+		return netOpts, nil
 	}
+	allopts := strings.Split(opts, ",")
+	for _, opt := range allopts {
+		split := strings.SplitN(opt, "=", 2)
+		switch split[0] {
+		case "ip", "ip6":
+			ip := net.ParseIP(split[1])
+			if ip == nil {
+				return netOpts, errors.Errorf("invalid ip address %q", split[1])
+			}
+			netOpts.StaticIPs = append(netOpts.StaticIPs, ip)
 
-	if len(parts) > 1 {
-		networkOptions = make(map[string][]string)
-		networkOptions[parts[0]] = strings.Split(parts[1], ",")
-		cniNets = nil
+		case "mac":
+			mac, err := net.ParseMAC(split[1])
+			if err != nil {
+				return netOpts, err
+			}
+			netOpts.StaticMAC = types.HardwareAddr(mac)
+
+		case "alias":
+			if split[1] == "" {
+				return netOpts, errors.New("alias cannot be empty")
+			}
+			netOpts.Aliases = append(netOpts.Aliases, split[1])
+
+		case "interface_name":
+			if split[1] == "" {
+				return netOpts, errors.New("interface_name cannot be empty")
+			}
+			netOpts.InterfaceName = split[1]
+
+		default:
+			return netOpts, errors.Errorf("unknown bridge network option: %s", split[0])
+		}
 	}
-	return ns, cniNets, networkOptions, nil
+	return netOpts, nil
 }
 
 func SetupUserNS(idmappings *storage.IDMappingOptions, userns Namespace, g *generate.Generator) (string, error) {
diff --git a/pkg/specgen/namespaces_test.go b/pkg/specgen/namespaces_test.go
new file mode 100644
index 000000000..4f69e6b98
--- /dev/null
+++ b/pkg/specgen/namespaces_test.go
@@ -0,0 +1,265 @@
+package specgen
+
+import (
+	"net"
+	"testing"
+
+	"github.com/containers/podman/v3/libpod/network/types"
+	"github.com/containers/podman/v3/pkg/rootless"
+	"github.com/stretchr/testify/assert"
+)
+
+func parsMacNoErr(mac string) types.HardwareAddr {
+	m, _ := net.ParseMAC(mac)
+	return types.HardwareAddr(m)
+}
+
+func TestParseNetworkFlag(t *testing.T) {
+	// root and rootless have different defaults
+	defaultNetName := "default"
+	defaultNetworks := map[string]types.PerNetworkOptions{
+		defaultNetName: {},
+	}
+	defaultNsMode := Namespace{NSMode: Bridge}
+	if rootless.IsRootless() {
+		defaultNsMode = Namespace{NSMode: Slirp}
+		defaultNetworks = map[string]types.PerNetworkOptions{}
+	}
+
+	tests := []struct {
+		name     string
+		args     []string
+		nsmode   Namespace
+		networks map[string]types.PerNetworkOptions
+		options  map[string][]string
+		err      string
+	}{
+		{
+			name:     "empty input",
+			args:     nil,
+			nsmode:   defaultNsMode,
+			networks: defaultNetworks,
+		},
+		{
+			name:     "empty string as input",
+			args:     []string{},
+			nsmode:   defaultNsMode,
+			networks: defaultNetworks,
+		},
+		{
+			name:     "default mode",
+			args:     []string{"default"},
+			nsmode:   defaultNsMode,
+			networks: defaultNetworks,
+		},
+		{
+			name:     "private mode",
+			args:     []string{"private"},
+			nsmode:   defaultNsMode,
+			networks: defaultNetworks,
+		},
+		{
+			name:   "bridge mode",
+			args:   []string{"bridge"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				defaultNetName: {},
+			},
+		},
+		{
+			name:     "slirp4netns mode",
+			args:     []string{"slirp4netns"},
+			nsmode:   Namespace{NSMode: Slirp},
+			networks: map[string]types.PerNetworkOptions{},
+		},
+		{
+			name:     "from pod mode",
+			args:     []string{"pod"},
+			nsmode:   Namespace{NSMode: FromPod},
+			networks: map[string]types.PerNetworkOptions{},
+		},
+		{
+			name:     "no network mode",
+			args:     []string{"none"},
+			nsmode:   Namespace{NSMode: NoNetwork},
+			networks: map[string]types.PerNetworkOptions{},
+		},
+		{
+			name:     "container mode",
+			args:     []string{"container:abc"},
+			nsmode:   Namespace{NSMode: FromContainer, Value: "abc"},
+			networks: map[string]types.PerNetworkOptions{},
+		},
+		{
+			name:     "ns path mode",
+			args:     []string{"ns:/path"},
+			nsmode:   Namespace{NSMode: Path, Value: "/path"},
+			networks: map[string]types.PerNetworkOptions{},
+		},
+		{
+			name:     "slirp4netns mode with options",
+			args:     []string{"slirp4netns:cidr=10.0.0.0/24"},
+			nsmode:   Namespace{NSMode: Slirp},
+			networks: map[string]types.PerNetworkOptions{},
+			options: map[string][]string{
+				"slirp4netns": {"cidr=10.0.0.0/24"},
+			},
+		},
+		{
+			name:   "bridge mode with options 1",
+			args:   []string{"bridge:ip=10.0.0.1,mac=11:22:33:44:55:66"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				defaultNetName: {
+					StaticIPs: []net.IP{net.ParseIP("10.0.0.1")},
+					StaticMAC: parsMacNoErr("11:22:33:44:55:66"),
+				},
+			},
+		},
+		{
+			name:   "bridge mode with options 2",
+			args:   []string{"bridge:ip=10.0.0.1,ip=10.0.0.5"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				defaultNetName: {
+					StaticIPs: []net.IP{net.ParseIP("10.0.0.1"), net.ParseIP("10.0.0.5")},
+				},
+			},
+		},
+		{
+			name:   "bridge mode with ip6 option",
+			args:   []string{"bridge:ip6=fd10::"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				defaultNetName: {
+					StaticIPs: []net.IP{net.ParseIP("fd10::")},
+				},
+			},
+		},
+		{
+			name:   "bridge mode with alias option",
+			args:   []string{"bridge:alias=myname,alias=myname2"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				defaultNetName: {
+					Aliases: []string{"myname", "myname2"},
+				},
+			},
+		},
+		{
+			name:   "bridge mode with alias option",
+			args:   []string{"bridge:alias=myname,alias=myname2"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				defaultNetName: {
+					Aliases: []string{"myname", "myname2"},
+				},
+			},
+		},
+		{
+			name:   "bridge mode with interface option",
+			args:   []string{"bridge:interface_name=eth123"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				defaultNetName: {
+					InterfaceName: "eth123",
+				},
+			},
+		},
+		{
+			name:   "bridge mode with invalid option",
+			args:   []string{"bridge:abc=123"},
+			nsmode: Namespace{NSMode: Bridge},
+			err:    "unknown bridge network option: abc",
+		},
+		{
+			name:   "bridge mode with invalid ip",
+			args:   []string{"bridge:ip=10..1"},
+			nsmode: Namespace{NSMode: Bridge},
+			err:    "invalid ip address \"10..1\"",
+		},
+		{
+			name:   "bridge mode with invalid mac",
+			args:   []string{"bridge:mac=123"},
+			nsmode: Namespace{NSMode: Bridge},
+			err:    "address 123: invalid MAC address",
+		},
+		{
+			name:   "network name",
+			args:   []string{"someName"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				"someName": {},
+			},
+		},
+		{
+			name:   "network name with options",
+			args:   []string{"someName:ip=10.0.0.1"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				"someName": {StaticIPs: []net.IP{net.ParseIP("10.0.0.1")}},
+			},
+		},
+		{
+			name:   "multiple networks",
+			args:   []string{"someName", "net2"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				"someName": {},
+				"net2":     {},
+			},
+		},
+		{
+			name:   "multiple networks with options",
+			args:   []string{"someName:ip=10.0.0.1", "net2:ip=10.10.0.1"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				"someName": {StaticIPs: []net.IP{net.ParseIP("10.0.0.1")}},
+				"net2":     {StaticIPs: []net.IP{net.ParseIP("10.10.0.1")}},
+			},
+		},
+		{
+			name:   "multiple networks with bridge mode first should map to default net",
+			args:   []string{"bridge", "net2"},
+			nsmode: Namespace{NSMode: Bridge},
+			networks: map[string]types.PerNetworkOptions{
+				defaultNetName: {},
+				"net2":         {},
+			},
+		},
+		{
+			name:   "conflicting network modes should error",
+			args:   []string{"bridge", "host"},
+			nsmode: Namespace{NSMode: Bridge},
+			err:    "can only set extra network names, selected mode host conflicts with bridge: invalid argument",
+		},
+		{
+			name:   "multiple networks empty name should error",
+			args:   []string{"someName", ""},
+			nsmode: Namespace{NSMode: Bridge},
+			err:    "network name cannot be empty: invalid argument",
+		},
+		{
+			name:   "multiple networks on invalid mode should error",
+			args:   []string{"host", "net2"},
+			nsmode: Namespace{NSMode: Host},
+			err:    "cannot set multiple networks without bridge network mode, selected mode host: invalid argument",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			got, got1, got2, err := ParseNetworkFlag(tt.args)
+			if tt.err != "" {
+				assert.EqualError(t, err, tt.err, tt.name)
+			} else {
+				assert.NoError(t, err, tt.name)
+			}
+
+			assert.Equal(t, tt.nsmode, got, tt.name)
+			assert.Equal(t, tt.networks, got1, tt.name)
+			assert.Equal(t, tt.options, got2, tt.name)
+		})
+	}
+}
diff --git a/pkg/specgen/pod_validate.go b/pkg/specgen/pod_validate.go
index bca7b6dbe..c5a66189c 100644
--- a/pkg/specgen/pod_validate.go
+++ b/pkg/specgen/pod_validate.go
@@ -1,7 +1,6 @@
 package specgen
 
 import (
-	"github.com/containers/podman/v3/pkg/rootless"
 	"github.com/containers/podman/v3/pkg/util"
 	"github.com/pkg/errors"
 )
@@ -19,15 +18,6 @@ func exclusivePodOptions(opt1, opt2 string) error {
 
 // Validate verifies the input is valid
 func (p *PodSpecGenerator) Validate() error {
-	if rootless.IsRootless() && len(p.CNINetworks) == 0 {
-		if p.StaticIP != nil {
-			return ErrNoStaticIPRootless
-		}
-		if p.StaticMAC != nil {
-			return ErrNoStaticMACRootless
-		}
-	}
-
 	// PodBasicConfig
 	if p.NoInfra {
 		if len(p.InfraCommand) > 0 {
@@ -52,11 +42,10 @@ func (p *PodSpecGenerator) Validate() error {
 		if p.NetNS.NSMode != Default && p.NetNS.NSMode != "" {
 			return errors.New("NoInfra and network modes cannot be used together")
 		}
-		if p.StaticIP != nil {
-			return exclusivePodOptions("NoInfra", "StaticIP")
-		}
-		if p.StaticMAC != nil {
-			return exclusivePodOptions("NoInfra", "StaticMAC")
+		// Note that networks might be set when --ip or --mac was set
+		// so we need to check that no networks are set without the infra
+		if len(p.Networks) > 0 {
+			return errors.New("cannot set networks options without infra container")
 		}
 		if len(p.DNSOption) > 0 {
 			return exclusivePodOptions("NoInfra", "DNSOption")
@@ -78,10 +67,8 @@ func (p *PodSpecGenerator) Validate() error {
 		if len(p.PortMappings) > 0 {
 			return errors.New("PortMappings can only be used with Bridge or slirp4netns networking")
 		}
-		if len(p.CNINetworks) > 0 {
-			return errors.New("CNINetworks can only be used with Bridge mode networking")
-		}
 	}
+
 	if p.NoManageResolvConf {
 		if len(p.DNSServer) > 0 {
 			return exclusivePodOptions("NoManageResolvConf", "DNSServer")
diff --git a/pkg/specgen/podspecgen.go b/pkg/specgen/podspecgen.go
index 948fb990c..e59d11c0a 100644
--- a/pkg/specgen/podspecgen.go
+++ b/pkg/specgen/podspecgen.go
@@ -86,33 +86,26 @@ type PodNetworkConfig struct {
 	// Defaults to Bridge as root and Slirp as rootless.
 	// Mandatory.
 	NetNS Namespace `json:"netns,omitempty"`
-	// StaticIP sets a static IP for the infra container. As the infra
-	// container's network is used for the entire pod by default, this will
-	// thus be a static IP for the whole pod.
-	// Only available if NetNS is set to Bridge (the default for root).
-	// As such, conflicts with NoInfra=true by proxy.
-	// Optional.
-	StaticIP *net.IP `json:"static_ip,omitempty"`
-	// StaticMAC sets a static MAC for the infra container. As the infra
-	// container's network is used for the entire pod by default, this will
-	// thus be a static MAC for the entire pod.
-	// Only available if NetNS is set to Bridge (the default for root).
-	// As such, conflicts with NoInfra=true by proxy.
-	// Optional.
-	// swagger:strfmt string
-	StaticMAC *types.HardwareAddr `json:"static_mac,omitempty"`
 	// PortMappings is a set of ports to map into the infra container.
 	// As, by default, containers share their network with the infra
 	// container, this will forward the ports to the entire pod.
 	// Only available if NetNS is set to Bridge or Slirp.
 	// Optional.
 	PortMappings []types.PortMapping `json:"portmappings,omitempty"`
-	// CNINetworks is a list of CNI networks that the infra container will
-	// join. As, by default, containers share their network with the infra
-	// container, these networks will effectively be joined by the
-	// entire pod.
-	// Only available when NetNS is set to Bridge, the default for root.
-	// Optional.
+	// Map of networks names ot ids the container should join to.
+	// You can request additional settings for each network, you can
+	// set network aliases, static ips, static mac address  and the
+	// network interface name for this container on the specifc network.
+	// If the map is empty and the bridge network mode is set the container
+	// will be joined to the default network.
+	Networks map[string]types.PerNetworkOptions
+	// CNINetworks is a list of CNI networks to join the container to.
+	// If this list is empty, the default CNI network will be joined
+	// instead. If at least one entry is present, we will not join the
+	// default network (unless it is part of this list).
+	// Only available if NetNS is set to bridge.
+	// Optional.
+	// Deprecated: as of podman 4.0 use "Networks" instead.
 	CNINetworks []string `json:"cni_networks,omitempty"`
 	// NoManageResolvConf indicates that /etc/resolv.conf should not be
 	// managed by the pod. Instead, each container will create and manage a
diff --git a/pkg/specgen/specgen.go b/pkg/specgen/specgen.go
index 0e257ad4c..e650c1966 100644
--- a/pkg/specgen/specgen.go
+++ b/pkg/specgen/specgen.go
@@ -394,26 +394,10 @@ type ContainerCgroupConfig struct {
 // ContainerNetworkConfig contains information on a container's network
 // configuration.
 type ContainerNetworkConfig struct {
-	// Aliases are a list of network-scoped aliases for container
-	// Optional
-	Aliases map[string][]string `json:"aliases"`
 	// NetNS is the configuration to use for the container's network
 	// namespace.
 	// Mandatory.
 	NetNS Namespace `json:"netns,omitempty"`
-	// StaticIP is the a IPv4 address of the container.
-	// Only available if NetNS is set to Bridge.
-	// Optional.
-	StaticIP *net.IP `json:"static_ip,omitempty"`
-	// StaticIPv6 is a static IPv6 address to set in the container.
-	// Only available if NetNS is set to Bridge.
-	// Optional.
-	StaticIPv6 *net.IP `json:"static_ipv6,omitempty"`
-	// StaticMAC is a static MAC address to set in the container.
-	// Only available if NetNS is set to bridge.
-	// Optional.
-	// swagger:strfmt string
-	StaticMAC *nettypes.HardwareAddr `json:"static_mac,omitempty"`
 	// PortBindings is a set of ports to map into the container.
 	// Only available if NetNS is set to bridge or slirp.
 	// Optional.
@@ -434,12 +418,20 @@ type ContainerNetworkConfig struct {
 	// PublishExposedPorts is set.
 	// Optional.
 	Expose map[uint16]string `json:"expose,omitempty"`
+	// Map of networks names ot ids the container should join to.
+	// You can request additional settings for each network, you can
+	// set network aliases, static ips, static mac address  and the
+	// network interface name for this container on the specifc network.
+	// If the map is empty and the bridge network mode is set the container
+	// will be joined to the default network.
+	Networks map[string]nettypes.PerNetworkOptions
 	// CNINetworks is a list of CNI networks to join the container to.
 	// If this list is empty, the default CNI network will be joined
 	// instead. If at least one entry is present, we will not join the
 	// default network (unless it is part of this list).
 	// Only available if NetNS is set to bridge.
 	// Optional.
+	// Deprecated: as of podman 4.0 use "Networks" instead.
 	CNINetworks []string `json:"cni_networks,omitempty"`
 	// UseImageResolvConf indicates that resolv.conf should not be managed
 	// by Podman, but instead sourced from the image.
diff --git a/pkg/specgenutil/specgen.go b/pkg/specgenutil/specgen.go
index 5e4bd2f65..123c0073b 100644
--- a/pkg/specgenutil/specgen.go
+++ b/pkg/specgenutil/specgen.go
@@ -11,7 +11,6 @@ import (
 	"github.com/containers/image/v5/manifest"
 	"github.com/containers/podman/v3/cmd/podman/parse"
 	"github.com/containers/podman/v3/libpod/define"
-	"github.com/containers/podman/v3/libpod/network/types"
 	ann "github.com/containers/podman/v3/pkg/annotations"
 	"github.com/containers/podman/v3/pkg/domain/entities"
 	envLib "github.com/containers/podman/v3/pkg/env"
@@ -434,19 +433,7 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 	}
 
 	if c.Net != nil {
-		s.CNINetworks = c.Net.CNINetworks
-	}
-
-	// Network aliases
-	if c.Net != nil {
-		if len(c.Net.Aliases) > 0 {
-			// build a map of aliases where key=cniName
-			aliases := make(map[string][]string, len(s.CNINetworks))
-			for _, cniNetwork := range s.CNINetworks {
-				aliases[cniNetwork] = c.Net.Aliases
-			}
-			s.Aliases = aliases
-		}
+		s.Networks = c.Net.Networks
 	}
 
 	if c.Net != nil {
@@ -455,9 +442,6 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 		s.DNSServers = c.Net.DNSServers
 		s.DNSSearch = c.Net.DNSSearch
 		s.DNSOptions = c.Net.DNSOptions
-		s.StaticIP = c.Net.StaticIP
-		// type cast to types.HardwareAddr
-		s.StaticMAC = (*types.HardwareAddr)(c.Net.StaticMAC)
 		s.NetworkOptions = c.Net.NetworkOptions
 		s.UseImageHosts = c.Net.NoHosts
 	}