1 files changed, 20 insertions, 4 deletions
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
index 5f56b242b..e62c8b709 100644
--- a/pkg/specgen/namespaces.go
+++ b/pkg/specgen/namespaces.go
@@ -108,7 +108,19 @@ func validateNetNS(n *Namespace) error {
 		return nil
 	}
 	switch n.NSMode {
-	case "", Default, Host, Path, FromContainer, FromPod, Private, NoNetwork, Bridge, Slirp:
+	case Slirp:
+		if n.Value != "" {
+			parts := strings.Split(n.Value, ",")
+			for _, p := range parts {
+				switch p {
+				case "port_handler=slirp4netns", "port_handler=rootlesskit":
+				default:
+					return errors.Errorf("invalid value for slirp %q", n.Value)
+				}
+			}
+		}
+		break
+	case "", Default, Host, Path, FromContainer, FromPod, Private, NoNetwork, Bridge:
 		break
 	default:
 		return errors.Errorf("invalid network %q", n.NSMode)
@@ -119,8 +131,8 @@ func validateNetNS(n *Namespace) error {
 		if len(n.Value) < 1 {
 			return errors.Errorf("namespace mode %s requires a value", n.NSMode)
 		}
-	} else {
-		// All others must NOT set a string value
+	} else if n.NSMode != Slirp {
+		// All others except must NOT set a string value
 		if len(n.Value) > 0 {
 			return errors.Errorf("namespace value %s cannot be provided with namespace mode %s", n.Value, n.NSMode)
 		}
@@ -250,8 +262,12 @@ func ParseNetworkNamespace(ns string) (Namespace, []string, error) {
 	var cniNetworks []string
 	// Net defaults to Slirp on rootless
 	switch {
-	case ns == "slirp4netns":
+	case ns == "slirp4netns", strings.HasPrefix(ns, "slirp4netns:"):
+		split := strings.SplitN(ns, ":", 2)
 		toReturn.NSMode = Slirp
+		if len(split) > 1 {
+			toReturn.Value = split[1]
+		}
 	case ns == "pod":
 		toReturn.NSMode = FromPod
 	case ns == "":