While using the crazy fast Halogen Flash server i ran into an issue and this is a solution to a problem you also might run into…
The Halogen Flash server is demanding to run alone on a system (plenty of reasons, but those make it so fast), so i started to evacuate the development environments from my Framework desktop.But the SSH based port forwarding to another system did not work.
After some hours thinking i get senile or simply stupid, i found the real reason: The Halogen Flash server is implemented as a podman based container and the SELinux profiles of the SSH server block to tunnel the OpenAI compatible API running on localhost TCP port 8731 to another machine.
This local port forwarding issue is scoped to only SELinux enforcing distributions like Bazzite. On these distros the SELinux enforcement disallows ssh -L 8731:127.0.0.1:8731 <you>@<your-framework-desktop> from another machine to connect the remote clients to the local port in the podman based services.
Qwen3.8 Flash Next describes this as “sshd-sessions’s outbound name_connect to an unlabeled (unreserved_port_t) port is denied” (I won’t argue with that).
Binding the server to all local network interfaces (0.0.0.0) instead was working, but that is not what i want to (for various security reasons).
Since this is a security feature and not a bug, disabling SELinux is also a bad practice.
The solution needs root permissions, but who wants to fiddle around with SELinux when the remaining stack can live in user space?!?
Instead of keeping the solution to this in my own tool belt i published a pull request to the fabulous ai-toolbox-cockpit by @kyuz0. I was using it in the first place and at first i started to “repair” this in kyuz0’s scripts until i found the real culprit. Anyhow i found that a good place to publish this and maybe this.
The shell script in the pull request can activate and remove the needed SELinux configuration to your system, but it needs sudo permissions for that. To be able to set the configuration up, the server must have been started before running the script.
Edit: This soon seems to not be necessary anymore, it is just getting fixed in the upstream Fedora projects…