Containers in the same pod binding to same port cause runtime failure without warning

Issue Description

When using podman play kube, it would be helpful if Podman could validate the pod YAML file and detect duplicate hostPort values before starting containers. This would prevent confusing behavior and save users from debugging runtime port binding issues.

Steps to reproduce the issue

1. Create a file named nginx-pod.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
spec:
  containers:
    - name: nginx-1
      image: docker.io/library/nginx:latest
      ports:
        - containerPort: 80
          hostPort: 8077

    - name: nginx-2
      image: docker.io/library/nginx:latest
      ports:
        - containerPort: 80
          hostPort: 8077

2. Run the pod:

$ podman play kube nginx-pod.yaml

Describe the results you received

1. Check container status

$ podman container ls

# Only one container successfully binds to host port 8077
# The other fails silently and keeps restarting
CONTAINER ID  IMAGE                           COMMAND               STATUS         PORTS                 NAMES
...           docker.io/library/nginx:latest  nginx ...             Up 32 minutes  0.0.0.0:8077->80/tcp  nginx-pod-nginx-1
...           docker.io/library/nginx:latest  nginx ...             Restarting     0.0.0.0:8077->80/tcp  nginx-pod-nginx-2

2. Check the logs for the failing container:

$ podman logs -f nginx-pod-nginx-2
[emerg] 1#1: bind() to 0.0.0.0:80 failed (98: Address already in use)

Describe the results you expected

If multiple containers in a pod define the same hostPort, podman play kube should fail early with a clear error message, instead of letting one container fail at runtime.

This validation would help users avoid subtle port conflicts.

podman info output

host:
  arch: amd64
  buildahVersion: 1.41.0-dev
  cgroupControllers:
  - cpuset
  - cpu
  - cpuacct
  - blkio
  - memory
  - devices
  - freezer
  - net_cls
  - perf_event
  - net_prio
  - hugetlb
  - pids
  - rdma
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: conmon-2.1.10-1.module+el8.10.0+1948+4b5cd4a9.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: 267637e798c683580abd360ac57435c36c11a2a3'
  cpuUtilization:
    idlePercent: 99.24
    systemPercent: 0.19
    userPercent: 0.57
  cpus: 8
  databaseBackend: sqlite
  distribution:
    distribution: rocky
    version: "8.10"
  eventLogger: file
  freeLocks: 2040
  hostname: localhost.localdomain
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 4.18.0-553.53.1.el8_10.x86_64
  linkmode: dynamic
  logDriver: k8s-file
  memFree: 153968640
  memTotal: 7870763008
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.10.1-2.module+el8.10.0+1948+4b5cd4a9.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.10.1-rhel
    package: netavark-1.10.3-1.module+el8.10.0+1948+4b5cd4a9.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.10.3
  ociRuntime:
    name: runc
    package: runc-1.1.12-6.module+el8.10.0+1948+4b5cd4a9.x86_64
    path: /usr/bin/runc
    version: |-
      runc version 1.1.12
      spec: 1.2.0+dev
      go: go1.22.11 (Red Hat 1.22.11-1.module+el8.10.0+1936+ea614e46)
      libseccomp: 2.5.2
  os: linux
  pasta:
    executable: ""
    package: ""
    version: ""
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_NET_RAW,CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.3-1.module+el8.10.0+1948+4b5cd4a9.x86_64
    version: |-
      slirp4netns version 1.2.3
      commit: c22fde291bb35b354e6ca44d13be181c76a0a432
      libslirp: 4.4.0
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.2
  swapFree: 6851907584
  swapTotal: 8262774784
  uptime: 215h 33m 57.00s (Approximately 8.96 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.access.redhat.com
  - registry.redhat.io
  - docker.io
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 3
    paused: 0
    running: 3
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 75125227520
  graphRootUsed: 11435118592
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "true"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 3
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 5.6.0-dev
  Built: 1749733359
  BuiltTime: Thu Jun 12 09:02:39 2025
  GitCommit: 1e53cacb08373b24dcc5c64ecb0cddfb405ec3eb
  GoVersion: go1.23.3
  Os: linux
  OsArch: linux/amd64
  Version: 5.6.0-dev

Podman in a container

No

Privileged Or Rootless

None

Upstream Latest Release

Yes

Additional environment details

$ podman --version
podman version 5.6.0-dev

Additional information

I'm happy to contribute a fix if this issue makes sense