支持公网IPV4分配，单独IPV6分配，以及混合网络分配。

backend/internal/lxc/lxc.go

@@ -218,24 +218,34 @@ func NewManager() *Manager {
 
 // ContainerConfig defines container creation parameters
 type ContainerConfig struct {
-	Name             string  `json:"name"`
-	Virtualization   string  `json:"virtualization,omitempty"`
-	TemplateID       string  `json:"template_id"`
-	VCPU             float64 `json:"vcpu"`
-	CPUPercent       int     `json:"cpu_percent"`
-	RAMMB            int     `json:"ram_mb"`
-	DiskGB           int     `json:"disk_gb"`
-	NetworkBWMbps    int     `json:"network_bw_mbps"`
-	MonthlyTrafficGB int     `json:"monthly_traffic_gb"`
-	TrafficMode      string  `json:"traffic_mode"`   // "total" or "in_out"
-	TrafficInGB      int     `json:"traffic_in_gb"`  // 0=unlimited
-	TrafficOutGB     int     `json:"traffic_out_gb"` // 0=unlimited
-	IOSpeedMBps      int     `json:"io_speed_mbps"`
-	ExtraPorts       []int   `json:"extra_ports"`
-	PortMappingCount int     `json:"port_mapping_count"`
-	SnapshotLimit    int     `json:"snapshot_limit"`
-	AssignIPv6       bool    `json:"assign_ipv6"`
-	ExpiresAt        string  `json:"expires_at"`
+	Name             string   `json:"name"`
+	Virtualization   string   `json:"virtualization,omitempty"`
+	TemplateID       string   `json:"template_id"`
+	VCPU             float64  `json:"vcpu"`
+	CPUPercent       int      `json:"cpu_percent"`
+	RAMMB            int      `json:"ram_mb"`
+	DiskGB           int      `json:"disk_gb"`
+	NetworkBWMbps    int      `json:"network_bw_mbps"`
+	MonthlyTrafficGB int      `json:"monthly_traffic_gb"`
+	TrafficMode      string   `json:"traffic_mode"`   // "total" or "in_out"
+	TrafficInGB      int      `json:"traffic_in_gb"`  // 0=unlimited
+	TrafficOutGB     int      `json:"traffic_out_gb"` // 0=unlimited
+	IOSpeedMBps      int      `json:"io_speed_mbps"`
+	ExtraPorts       []int    `json:"extra_ports"`
+	PortMappingCount int      `json:"port_mapping_count"`
+	AssignNAT        *bool    `json:"assign_nat,omitempty"`
+	SnapshotLimit    int      `json:"snapshot_limit"`
+	AssignIPv4       bool     `json:"assign_ipv4"`
+	IPv4Count        int      `json:"ipv4_count,omitempty"`
+	PublicIPv4s      []string `json:"public_ipv4s,omitempty"`
+	AssignIPv6       bool     `json:"assign_ipv6"`
+	IPv6Count        int      `json:"ipv6_count,omitempty"`
+	IPv6Addresses    []string `json:"ipv6_addresses,omitempty"`
+	ExpiresAt        string   `json:"expires_at"`
+}
+
+func (cfg ContainerConfig) WantsNAT() bool {
+	return cfg.AssignNAT == nil || *cfg.AssignNAT
 }
 
 // CreateContainer creates a new LXC container. Uses ct-{id} as LXC name internally.
@@ -244,8 +254,11 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 	if tmpl == nil {
 		return fmt.Errorf("template not found: %s", cfg.TemplateID)
 	}
-	if cfg.PortMappingCount < 2 {
+	if cfg.WantsNAT() && cfg.PortMappingCount < 2 {
 		cfg.PortMappingCount = 2
+	} else if !cfg.WantsNAT() {
+		cfg.PortMappingCount = 0
+		cfg.ExtraPorts = nil
 	}
 	if cfg.SnapshotLimit <= 0 {
 		cfg.SnapshotLimit = config.DefaultSnapshotLimit
@@ -296,50 +309,64 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 		return err
 	}
 
-	ipv6 := ""
-	ipv6PrefixLen := 0
-	ipv6Interface := ""
-	if cfg.AssignIPv6 {
-		assigned, prefixLen, iface, err := m.allocateIPv6ForContainer(id)
+	publicIPv4s, err := AllocatePublicIPv4Assignments(id, cfg.PublicIPv4s, cfg.IPv4Count, cfg.AssignIPv4)
+	if err != nil {
+		_ = m.cleanupContainerStorage(lxcName)
+		return err
+	}
+
+	ipv6Assignments := []config.IPv6Assignment{}
+	if cfg.AssignIPv6 || len(cfg.IPv6Addresses) > 0 {
+		assigned, err := m.allocateIPv6AssignmentsForContainer(id, cfg.IPv6Addresses, cfg.IPv6Count, true)
 		if err != nil {
 			_ = m.cleanupContainerStorage(lxcName)
 			return err
 		}
-		ipv6 = assigned
-		ipv6PrefixLen = prefixLen
-		ipv6Interface = iface
-		if err := m.applyIPv6Config(lxcName, ipv6); err != nil {
+		ipv6Assignments = assigned
+		if err := m.applyIPv6Config(lxcName, ipv6AssignmentAddresses(ipv6Assignments)...); err != nil {
 			_ = m.cleanupContainerStorage(lxcName)
 			return err
 		}
 	}
 
-	sshPort := config.AllocateSSHPort()
 	sshPassword := generateRandomString(16)
 
-	// Setup default port mappings (SSH only)
-	portMappings := SetupDefaultPortMappings(sshPort)
-	tempC := &config.Container{PortMappings: portMappings}
+	sshPort := 0
+	portMappings := []config.PortMapping{}
+	if cfg.WantsNAT() {
+		sshPort = config.AllocateSSHPort()
 
-	extraPorts := cfg.ExtraPorts
-	if len(extraPorts) == 0 && cfg.PortMappingCount > 1 {
-		extraPorts = allocateDefaultEqualPorts(tempC, cfg.PortMappingCount-1)
-	}
-	for _, containerPort := range extraPorts {
-		if containerPort <= 0 {
-			continue
+		// Setup default port mappings (SSH only)
+		portMappings = SetupDefaultPortMappings(sshPort)
+		defaultHostIP := defaultPortMappingHostIP(publicIPv4s)
+		if defaultHostIP != "" {
+			for i := range portMappings {
+				portMappings[i].HostIP = defaultHostIP
+			}
 		}
-		pm, err := normalizePortMapping(tempC, -1, config.PortMapping{
-			ContainerPort: containerPort,
-			HostPort:      containerPort,
-			Protocol:      "tcp",
-			Description:   fmt.Sprintf("Port-%d", containerPort),
-		})
-		if err != nil {
-			continue
+		tempC := &config.Container{ID: id, PublicIPv4s: publicIPv4s, PortMappings: portMappings}
+
+		extraPorts := cfg.ExtraPorts
+		if len(extraPorts) == 0 && cfg.PortMappingCount > 1 {
+			extraPorts = allocateDefaultEqualPorts(tempC, cfg.PortMappingCount-1)
+		}
+		for _, containerPort := range extraPorts {
+			if containerPort <= 0 {
+				continue
+			}
+			pm, err := normalizePortMapping(tempC, -1, config.PortMapping{
+				ContainerPort: containerPort,
+				HostPort:      containerPort,
+				HostIP:        defaultHostIP,
+				Protocol:      "tcp",
+				Description:   fmt.Sprintf("Port-%d", containerPort),
+			})
+			if err != nil {
+				continue
+			}
+			tempC.PortMappings = append(tempC.PortMappings, pm)
+			portMappings = tempC.PortMappings
 		}
-		tempC.PortMappings = append(tempC.PortMappings, pm)
-		portMappings = tempC.PortMappings
 	}
 
 	now := time.Now().Format("2006-01-02 15:04:05")
@@ -368,9 +395,8 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 		IOSpeedMBps:      cfg.IOSpeedMBps,
 		Status:           "stopped",
 		IP:               "",
-		IPv6:             ipv6,
-		IPv6PrefixLen:    ipv6PrefixLen,
-		IPv6Interface:    ipv6Interface,
+		PublicIPv4s:      publicIPv4s,
+		IPv6Addresses:    ipv6Assignments,
 		VNCPort:          0,
 		SSHPort:          sshPort,
 		SSHPassword:      sshPassword,
@@ -380,13 +406,14 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 		CreatedAt:        now,
 		ExpiresAt:        cfg.ExpiresAt,
 	}
+	container.NormalizeNetworkAssignments()
 	config.AddContainer(container)
 
 	// Pre-configure network and SSH in the rootfs before first boot.
 	rootfsPath := filepath.Join(m.LxcPath, lxcName, "rootfs")
 	m.preconfigureNetwork(rootfsPath, cfg.TemplateID)
-	if ipv6 != "" {
-		if err := installContainerIPv6Init(rootfsPath, ipv6); err != nil {
+	if len(ipv6Assignments) > 0 {
+		if err := installContainerIPv6Init(rootfsPath, ipv6AssignmentAddresses(ipv6Assignments)...); err != nil {
 			fmt.Printf("Warning: failed to install IPv6 init in %s: %v\n", lxcName, err)
 		}
 	}
@@ -525,7 +552,7 @@ func (m *Manager) applyResourceLimits(lxcName string, cfg ContainerConfig) error
 	if err != nil {
 		return err
 	}
-	apparmorProfile, err := findAppArmorProfile()
+	apparmorProfile, err := appArmorProfileForTemplate(cfg.TemplateID)
 	if err != nil {
 		return err
 	}
@@ -940,6 +967,26 @@ func findAppArmorProfile() (string, error) {
 	return "", errors.New("required LXC AppArmor profile not loaded")
 }
 
+func appArmorProfileForTemplate(templateID string) (string, error) {
+	if systemdTemplateNeedsUnconfinedAppArmor(templateID) {
+		return "unconfined", nil
+	}
+	return findAppArmorProfile()
+}
+
+func systemdTemplateNeedsUnconfinedAppArmor(templateID string) bool {
+	id := strings.ToLower(strings.TrimSpace(templateID))
+	if id == "" || strings.Contains(id, "alpine") {
+		return false
+	}
+	for _, token := range []string{"ubuntu", "debian", "centos", "fedora", "rocky", "rockylinux", "archlinux"} {
+		if strings.Contains(id, token) {
+			return true
+		}
+	}
+	return false
+}
+
 func unprivilegedIDMap() (int, int, error) {
 	if err := ensureSubIDRange("/etc/subuid", "root", 100000, 65536); err != nil {
 		return 0, 0, err
@@ -1197,27 +1244,31 @@ func (m *Manager) StartContainer(id int) error {
 			NetworkBWMbps:    c.NetworkBWMbps,
 			MonthlyTrafficGB: c.MonthlyTrafficGB,
 			IOSpeedMBps:      c.IOSpeedMBps,
-			AssignIPv6:       c.IPv6 != "",
+			AssignIPv6:       c.IPv6 != "" || len(c.IPv6Addresses) > 0,
 			ExpiresAt:        c.ExpiresAt,
 		}); err != nil {
 			return err
 		}
 	}
-	if c.IPv6 != "" {
-		if err := m.applyIPv6Config(lxcName, c.IPv6); err != nil {
+	if c.IPv6 != "" || len(c.IPv6Addresses) > 0 {
+		c.NormalizeNetworkAssignments()
+		if err := m.applyIPv6Config(lxcName, c.IPv6AddressStrings()...); err != nil {
 			return err
 		}
 		if err := m.ApplyIPv6(id); err != nil {
 			return err
 		}
 	}
+	EnsureAssignedPublicIPv4s(c.PublicIPv4s)
 
-	logFile := filepath.Join(os.TempDir(), "clicd-"+lxcName+"-start.log")
-	os.Remove(logFile)
-	cmd := exec.Command("lxc-start", "-n", lxcName, "-d", "--logfile", logFile, "--logpriority", "DEBUG")
-	output, err := cmd.CombinedOutput()
+	logFile, consoleLog, output, err := m.startLXCContainerDaemon(lxcName)
 	if err != nil {
-		return fmt.Errorf("failed to start container: %v, output: %s, lxc log: %s", err, string(output), tailFile(logFile, 80))
+		config.UpdateContainerStatus(id, "stopped")
+		return fmt.Errorf("failed to start container: %v, output: %s, lxc log: %s, console: %s", err, string(output), tailFile(logFile, 80), tailFile(consoleLog, 80))
+	}
+	if err := m.waitForLXCStartup(lxcName, logFile, consoleLog); err != nil {
+		config.UpdateContainerStatus(id, "stopped")
+		return err
 	}
 
 	config.UpdateContainerStatus(id, "running")
@@ -1262,7 +1313,7 @@ func (m *Manager) StartContainer(id int) error {
 	if err := m.ApplyPortMappings(id); err != nil {
 		fmt.Printf("Warning: failed to apply port mappings: %v\n", err)
 	}
-	if c.IPv6 != "" {
+	if c.IPv6 != "" || len(c.IPv6Addresses) > 0 {
 		if err := m.ApplyIPv6(id); err != nil {
 			fmt.Printf("Warning: failed to apply IPv6 routing for %s: %v\n", lxcName, err)
 		}
@@ -1272,6 +1323,41 @@ func (m *Manager) StartContainer(id int) error {
 	return nil
 }
 
+func (m *Manager) startLXCContainerDaemon(lxcName string) (string, string, []byte, error) {
+	logFile := filepath.Join(os.TempDir(), "clicd-"+lxcName+"-start.log")
+	consoleLog := filepath.Join(os.TempDir(), "clicd-"+lxcName+"-console.log")
+	os.Remove(logFile)
+	os.Remove(consoleLog)
+	cmd := exec.Command("lxc-start", "-n", lxcName, "-d", "--logfile", logFile, "--logpriority", "DEBUG", "--console-log", consoleLog)
+	output, err := cmd.CombinedOutput()
+	return logFile, consoleLog, output, err
+}
+
+func (m *Manager) waitForLXCStartup(lxcName, logFile, consoleLog string) error {
+	runningChecks := 0
+	lastStatus := "unknown"
+	for retry := 0; retry < 10; retry++ {
+		time.Sleep(1 * time.Second)
+		status, err := m.GetContainerStatus(lxcName)
+		if err != nil {
+			lastStatus = "unknown"
+			continue
+		}
+		lastStatus = status
+		if status == "running" {
+			runningChecks++
+			if runningChecks >= 3 {
+				return nil
+			}
+			continue
+		}
+		if runningChecks > 0 || retry >= 1 {
+			break
+		}
+	}
+	return fmt.Errorf("container exited immediately after start (status: %s), lxc log: %s, console: %s", lastStatus, tailFile(logFile, 80), tailFile(consoleLog, 80))
+}
+
 // applyBandwidthLimit applies tc-based bandwidth limit on container's veth interface
 // ApplyContainerLimits re-applies resource limits (CPU, RAM, IO, BW) to a running container.
 func (m *Manager) ApplyContainerLimits(c *config.Container) error {
@@ -1553,8 +1639,17 @@ func (m *Manager) DestroyContainer(id int) error {
 		return fmt.Errorf("container not found: %d", id)
 	}
 	lxcName := c.LxcName()
-	if c.IPv6 != "" && c.IPv6Interface != "" {
-		removeHostIPv6Routing(c.IPv6, c.IPv6Interface)
+	if c.IPv6 != "" || len(c.IPv6Addresses) > 0 {
+		c.NormalizeNetworkAssignments()
+		for _, assignment := range c.IPv6Addresses {
+			uplink := assignment.Interface
+			if uplink == "" {
+				uplink = c.IPv6Interface
+			}
+			if uplink != "" {
+				removeHostIPv6Routing(assignment.Address, uplink)
+			}
+		}
 	}
 
 	if err := m.StopContainer(id); err != nil {
@@ -1799,6 +1894,11 @@ install_sshd() {
 	return 1
 }
 
+ensure_sshd_runtime_dir() {
+	mkdir -p /run/sshd /var/run/sshd
+	chmod 0755 /run/sshd /var/run/sshd 2>/dev/null || true
+}
+
 set_sshd_option() {
 	key="$1"
 	value="$2"
@@ -1825,7 +1925,8 @@ set_sshd_option() {
 
 install_sshd || exit 30
 
-mkdir -p /run/sshd /var/run/sshd /etc/ssh /etc/ssh/sshd_config.d
+mkdir -p /etc/ssh /etc/ssh/sshd_config.d
+ensure_sshd_runtime_dir
 ssh-keygen -A >/dev/null 2>&1 || true
 
 cat >/etc/ssh/sshd_config.d/99-clicd.conf <<'EOF'
@@ -1858,6 +1959,7 @@ if command -v chkconfig >/dev/null 2>&1; then
 fi
 
 SSHD_BIN="$(sshd_path)" || exit 32
+ensure_sshd_runtime_dir
 "$SSHD_BIN" -t -f /etc/ssh/sshd_config >/tmp/clicd-sshd-test.log 2>&1 || {
 	cat /tmp/clicd-sshd-test.log
 	exit 32
@@ -1872,6 +1974,7 @@ if command -v systemctl >/dev/null 2>&1; then
 	systemctl stop ssh.socket 2>/dev/null || true
 	systemctl disable ssh.socket 2>/dev/null || true
 fi
+ensure_sshd_runtime_dir
 if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
 	systemctl restart ssh >/dev/null 2>&1 || systemctl restart sshd >/dev/null 2>&1 || true
 fi
@@ -1882,9 +1985,22 @@ service ssh restart >/dev/null 2>&1 ||
 	/etc/init.d/sshd restart >/dev/null 2>&1 ||
 	true
 
+ensure_sshd_runtime_dir
+
+for i in 1 2 3 4 5; do
+	if (ss -ltn 2>/dev/null || netstat -tln 2>/dev/null) | grep -Eq '(^|[[:space:]])[^[:space:]]*:22[[:space:]]'; then
+		exit 0
+	fi
+	if pgrep -x sshd >/dev/null 2>&1; then
+		exit 0
+	fi
+	sleep 1
+done
+
 if ! (ss -ltn 2>/dev/null || netstat -tln 2>/dev/null) | grep -Eq '(^|[[:space:]])[^[:space:]]*:22[[:space:]]'; then
 	pkill -x sshd >/dev/null 2>&1 || killall sshd >/dev/null 2>&1 || true
 	rm -f /run/sshd.pid /var/run/sshd.pid
+	ensure_sshd_runtime_dir
 	"$SSHD_BIN" -f /etc/ssh/sshd_config >/dev/null 2>&1 || exit 32
 fi
 
@@ -2425,14 +2541,15 @@ func (m *Manager) ReinstallContainer(id int, templateID string) error {
 		NetworkBWMbps:    c.NetworkBWMbps,
 		MonthlyTrafficGB: c.MonthlyTrafficGB,
 		IOSpeedMBps:      c.IOSpeedMBps,
-		AssignIPv6:       c.IPv6 != "",
+		AssignIPv6:       c.IPv6 != "" || len(c.IPv6Addresses) > 0,
 		ExpiresAt:        c.ExpiresAt,
 	}
 	if err := m.applyResourceLimits(lxcName, cfg); err != nil {
 		return err
 	}
-	if c.IPv6 != "" {
-		if err := m.applyIPv6Config(lxcName, c.IPv6); err != nil {
+	if c.IPv6 != "" || len(c.IPv6Addresses) > 0 {
+		c.NormalizeNetworkAssignments()
+		if err := m.applyIPv6Config(lxcName, c.IPv6AddressStrings()...); err != nil {
 			return err
 		}
 	}
@@ -2440,8 +2557,8 @@ func (m *Manager) ReinstallContainer(id int, templateID string) error {
 	// Set root password and pre-configure network/SSH via chroot.
 	rootfsPath := filepath.Join(m.LxcPath, lxcName, "rootfs")
 	m.preconfigureNetwork(rootfsPath, templateID)
-	if c.IPv6 != "" {
-		if err := installContainerIPv6Init(rootfsPath, c.IPv6); err != nil {
+	if c.IPv6 != "" || len(c.IPv6Addresses) > 0 {
+		if err := installContainerIPv6Init(rootfsPath, c.IPv6AddressStrings()...); err != nil {
 			fmt.Printf("Warning: failed to install IPv6 init in %s after reinstall: %v\n", lxcName, err)
 		}
 	}
@@ -2470,14 +2587,17 @@ func (m *Manager) ReinstallContainer(id int, templateID string) error {
 		config.SaveConfig()
 		return err
 	}
-	logFile := filepath.Join(os.TempDir(), "clicd-"+lxcName+"-start.log")
-	os.Remove(logFile)
-	startCmd := exec.Command("lxc-start", "-n", lxcName, "-d", "--logfile", logFile, "--logpriority", "DEBUG")
-	if output, err := startCmd.CombinedOutput(); err != nil {
+	logFile, consoleLog, output, err := m.startLXCContainerDaemon(lxcName)
+	if err != nil {
 		fmt.Printf("Warning: failed to start container after reinstall: %v\n", err)
 		c.Status = "stopped"
 		config.SaveConfig()
-		return fmt.Errorf("reinstalled but failed to start: %v, output: %s, lxc log: %s", err, string(output), tailFile(logFile, 80))
+		return fmt.Errorf("reinstalled but failed to start: %v, output: %s, lxc log: %s, console: %s", err, string(output), tailFile(logFile, 80), tailFile(consoleLog, 80))
+	}
+	if err := m.waitForLXCStartup(lxcName, logFile, consoleLog); err != nil {
+		c.Status = "stopped"
+		config.SaveConfig()
+		return fmt.Errorf("reinstalled but container did not stay running: %v", err)
 	}
 
 	// Wait for network and install SSH
@@ -2503,7 +2623,7 @@ func (m *Manager) ReinstallContainer(id int, templateID string) error {
 	if c.NetworkBWMbps > 0 {
 		m.applyBandwidthLimit(c.LxcName(), c.NetworkBWMbps)
 	}
-	if c.IPv6 != "" {
+	if c.IPv6 != "" || len(c.IPv6Addresses) > 0 {
 		if err := m.ApplyIPv6(id); err != nil {
 			fmt.Printf("Warning: failed to apply IPv6 after reinstall: %v\n", err)
 		}

backend/internal/lxc/portmap.go

@@ -2,8 +2,10 @@ package lxc
 
 import (
 	"fmt"
+	"net/netip"
 	"os/exec"
 	"strconv"
+	"strings"
 
 	"clicd/internal/config"
 )
@@ -17,6 +19,7 @@ func (m *Manager) ApplyPortMappings(id int) error {
 	if c.IP == "" {
 		return fmt.Errorf("container has no IP")
 	}
+	EnsureAssignedPublicIPv4s(c.PublicIPv4s)
 	tag := clicdTag(id)
 	bridge := "lxcbr0"
 	subnet := "10.0.3.0/24"
@@ -27,35 +30,180 @@ func (m *Manager) ApplyPortMappings(id int) error {
 
 	EnsureForwardRules(bridge)
 	m.CleanPortMappings(id)
+	deleteBridgeMasquerade(subnet)
 
 	for _, pm := range c.PortMappings {
-		cmd := exec.Command("iptables",
-			"-t", "nat",
-			"-I", "PREROUTING", "1",
-			"-p", pm.Protocol,
-			"--dport", fmt.Sprintf("%d", pm.HostPort),
-			"-j", "DNAT",
-			"--to-destination", fmt.Sprintf("%s:%d", c.IP, pm.ContainerPort),
-			"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-%d", tag, pm.HostPort),
-		)
-		output, err := cmd.CombinedOutput()
-		if err != nil {
-			fmt.Printf("Warning: failed to apply port mapping %d->%s:%d: %v, output: %s\n",
-				pm.HostPort, c.IP, pm.ContainerPort, err, string(output))
-			continue
+		for _, hostIP := range expandPortMappingHostIPs(c, pm) {
+			args := []string{
+				"-t", "nat",
+				"-I", "PREROUTING", "1",
+				"-p", pm.Protocol,
+			}
+			if hostIP != "" {
+				args = append(args, "-d", hostIP)
+			}
+			args = append(args,
+				"--dport", fmt.Sprintf("%d", pm.HostPort),
+				"-j", "DNAT",
+				"--to-destination", fmt.Sprintf("%s:%d", c.IP, pm.ContainerPort),
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-%s-%d", tag, natRuleIPTag(hostIP), pm.HostPort),
+			)
+			cmd := exec.Command("iptables", args...)
+			output, err := cmd.CombinedOutput()
+			if err != nil {
+				fmt.Printf("Warning: failed to apply port mapping %s:%d->%s:%d: %v, output: %s\n",
+					displayHostIP(hostIP), pm.HostPort, c.IP, pm.ContainerPort, err, string(output))
+				continue
+			}
+			fmt.Printf("Port mapping: %s:%d -> %s:%d\n", displayHostIP(hostIP), pm.HostPort, c.IP, pm.ContainerPort)
 		}
-		fmt.Printf("Port mapping: host:%d -> %s:%d\n", pm.HostPort, c.IP, pm.ContainerPort)
 	}
 
-	if exec.Command("iptables", "-t", "nat", "-C", "POSTROUTING", "-s", subnet, "-o", "eth+", "-j", "MASQUERADE").Run() != nil {
-		exec.Command("iptables", "-t", "nat", "-I", "POSTROUTING", "1", "-s", subnet, "-o", "eth+", "-j", "MASQUERADE").Run()
-	}
+	applyIPv4EgressPolicy(c, bridge, subnet, tag)
 
 	return nil
 }
 
+func applyIPv4EgressPolicy(c *config.Container, bridge, subnet, tag string) {
+	if c == nil || strings.TrimSpace(c.IP) == "" {
+		return
+	}
+	if containerAllowsPublicIPv4Egress(c) {
+		if _, ok := primaryPublicIPv4Assignment(c); ok {
+			applyPublicIPv4SNAT(c, tag)
+			return
+		}
+		ensureContainerMasquerade(c, tag)
+		return
+	}
+	ensureIPv4EgressBlocked(c, bridge, subnet, tag)
+}
+
+func containerAllowsPublicIPv4Egress(c *config.Container) bool {
+	if c == nil {
+		return false
+	}
+	if len(c.PublicIPv4s) > 0 {
+		return true
+	}
+	return c.PortMappingLimit > 0 || len(c.PortMappings) > 0
+}
+
+func ensureContainerMasquerade(c *config.Container, tag string) {
+	args := []string{
+		"-s", c.IP + "/32",
+		"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-masq", tag),
+		"-j", "MASQUERADE",
+	}
+	if host := DetectPublicIPv4(); strings.TrimSpace(host.Interface) != "" {
+		args = append([]string{"-o", strings.TrimSpace(host.Interface)}, args...)
+	} else {
+		args = append([]string{"-o", "eth+"}, args...)
+	}
+	ensureNATRule("POSTROUTING", args)
+}
+
+func ensureIPv4EgressBlocked(c *config.Container, bridge, subnet, tag string) {
+	args := []string{
+		"-i", bridge,
+		"-s", c.IP + "/32",
+		"!", "-d", subnet,
+		"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-v4-egress-block", tag),
+		"-j", "REJECT",
+	}
+	ensureFilterRule("FORWARD", args)
+}
+
+func ensureNATRule(chain string, args []string) {
+	check := append([]string{"-t", "nat", "-C", chain}, args...)
+	if exec.Command("iptables", check...).Run() == nil {
+		return
+	}
+	add := append([]string{"-t", "nat", "-I", chain, "1"}, args...)
+	exec.Command("iptables", add...).Run()
+}
+
+func ensureFilterRule(chain string, args []string) {
+	check := append([]string{"-C", chain}, args...)
+	if exec.Command("iptables", check...).Run() == nil {
+		return
+	}
+	add := append([]string{"-I", chain, "1"}, args...)
+	exec.Command("iptables", add...).Run()
+}
+
+func deleteBridgeMasquerade(subnet string) {
+	for exec.Command("iptables", "-t", "nat", "-D", "POSTROUTING", "-s", subnet, "-o", "eth+", "-j", "MASQUERADE").Run() == nil {
+	}
+}
+
+func applyPublicIPv4SNAT(c *config.Container, tag string) {
+	if c == nil || strings.TrimSpace(c.IP) == "" {
+		return
+	}
+	assignment, ok := primaryPublicIPv4Assignment(c)
+	if !ok {
+		return
+	}
+	hostIP := strings.TrimSpace(assignment.Address)
+	if hostIP == "" {
+		return
+	}
+	iface := strings.TrimSpace(assignment.Interface)
+	if iface == "" {
+		if info, ok := publicIPv4InfoByAddress(hostIP); ok {
+			iface = strings.TrimSpace(info.Interface)
+		}
+	}
+	if iface == "" {
+		if host := DetectPublicIPv4(); host.Interface != "" {
+			iface = host.Interface
+		}
+	}
+	args := []string{
+		"-t", "nat",
+		"-I", "POSTROUTING", "1",
+		"-s", c.IP + "/32",
+	}
+	if iface != "" {
+		args = append(args, "-o", iface)
+	}
+	args = append(args,
+		"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-snat-%s", tag, natRuleIPTag(hostIP)),
+		"-j", "SNAT", "--to-source", hostIP,
+	)
+	if output, err := exec.Command("iptables", args...).CombinedOutput(); err != nil {
+		fmt.Printf("Warning: failed to apply public IPv4 SNAT %s -> %s: %v, output: %s\n", c.IP, hostIP, err, string(output))
+	}
+}
+
+func primaryPublicIPv4Assignment(c *config.Container) (config.PublicIPv4Assignment, bool) {
+	if c == nil {
+		return config.PublicIPv4Assignment{}, false
+	}
+	for _, item := range c.PublicIPv4s {
+		if strings.TrimSpace(item.Address) != "" {
+			return item, true
+		}
+	}
+	return config.PublicIPv4Assignment{}, false
+}
+
 func clicdTag(id int) string { return "c" + strconv.Itoa(id) }
 
+func EnsureAllRunningPortMappings() {
+	m := NewManager()
+	for i := range config.AppConfig.Containers {
+		c := &config.AppConfig.Containers[i]
+		if c.Status != "running" || strings.TrimSpace(c.IP) == "" {
+			continue
+		}
+		if err := m.ApplyPortMappings(c.ID); err != nil {
+			fmt.Printf("Warning: failed to restore port mappings for %s: %v\n", c.Name, err)
+		}
+	}
+}
+
 // EnsureForwardRules makes sure iptables FORWARD chain allows bridge traffic.
 func EnsureForwardRules(bridge string) {
 	if bridge == "" {
@@ -81,8 +229,13 @@ func EnsureForwardRules(bridge string) {
 // CleanPortMappings removes all iptables rules for a container
 func (m *Manager) CleanPortMappings(id int) error {
 	tag := clicdTag(id)
+	for _, chain := range []string{"PREROUTING", "POSTROUTING"} {
+		cmd := exec.Command("sh", "-c",
+			fmt.Sprintf("iptables -t nat -L %s -n --line-numbers 2>/dev/null | grep 'clicd-%s-' | awk '{print $1}' | sort -rn | while read num; do iptables -t nat -D %s $num; done", chain, tag, chain))
+		cmd.Run()
+	}
 	cmd := exec.Command("sh", "-c",
-		fmt.Sprintf("iptables -t nat -L PREROUTING -n --line-numbers 2>/dev/null | grep 'clicd-%s' | awk '{print $1}' | sort -rn | while read num; do iptables -t nat -D PREROUTING $num; done", tag))
+		fmt.Sprintf("iptables -S FORWARD 2>/dev/null | grep 'clicd-%s-' | sed 's/^-A /-D /' | while read rule; do iptables $rule; done", tag))
 	cmd.Run()
 	return nil
 }
@@ -94,12 +247,26 @@ func SetupDefaultPortMappings(sshPort int) []config.PortMapping {
 	}
 }
 
+func DefaultPortMappingHostIP(assignments []config.PublicIPv4Assignment) string {
+	if len(assignments) == 1 {
+		return strings.TrimSpace(assignments[0].Address)
+	}
+	return ""
+}
+
+func defaultPortMappingHostIP(assignments []config.PublicIPv4Assignment) string {
+	return DefaultPortMappingHostIP(assignments)
+}
+
 // AddPortMapping adds a NAT rule to a container
 func (m *Manager) AddPortMapping(id int, pm config.PortMapping) ([]config.PortMapping, error) {
 	c := config.FindContainer(id)
 	if c == nil {
 		return nil, fmt.Errorf("container not found: %d", id)
 	}
+	if c.PortMappingLimit <= 0 {
+		return nil, fmt.Errorf("container has no IPv4 NAT port quota")
+	}
 	if c.PortMappingLimit > 0 && len(c.PortMappings) >= c.PortMappingLimit {
 		return nil, fmt.Errorf("port mapping quota exceeded: %d/%d", len(c.PortMappings), c.PortMappingLimit)
 	}
@@ -168,6 +335,17 @@ func normalizePortMapping(c *config.Container, skipIndex int, pm config.PortMapp
 	if pm.Protocol == "" {
 		pm.Protocol = "tcp"
 	}
+	pm.Protocol = strings.ToLower(strings.TrimSpace(pm.Protocol))
+	pm.HostIP = strings.TrimSpace(pm.HostIP)
+	if pm.HostIP != "" {
+		addr, err := netip.ParseAddr(pm.HostIP)
+		if err != nil || !addr.Is4() {
+			return pm, fmt.Errorf("host_ip must be a valid IPv4 address")
+		}
+		if !containerHasPublicIPv4(c, pm.HostIP) {
+			return pm, fmt.Errorf("host_ip %s is not assigned to this container", pm.HostIP)
+		}
+	}
 	if pm.Description == "" {
 		pm.Description = fmt.Sprintf("Port-%d", pm.ContainerPort)
 	}
@@ -179,8 +357,8 @@ func normalizePortMapping(c *config.Container, skipIndex int, pm config.PortMapp
 		if i == skipIndex {
 			continue
 		}
-		if existing.HostPort == pm.HostPort && existing.Protocol == pm.Protocol {
-			return pm, fmt.Errorf("host port %d/%s already mapped in this container", pm.HostPort, pm.Protocol)
+		if portMappingsConflict(c, pm, c, existing) {
+			return pm, fmt.Errorf("host port %d/%s already mapped on the same IPv4 in this container", pm.HostPort, pm.Protocol)
 		}
 	}
 	// Check all other containers (LXC + KVM) for port conflicts
@@ -189,8 +367,9 @@ func normalizePortMapping(c *config.Container, skipIndex int, pm config.PortMapp
 			continue
 		}
 		for _, existing := range oc.PortMappings {
-			if existing.HostPort == pm.HostPort && existing.Protocol == pm.Protocol {
-				return pm, fmt.Errorf("host port %d/%s already used by container %s (ID: %d)", pm.HostPort, pm.Protocol, oc.Name, oc.ID)
+			oc := oc
+			if portMappingsConflict(c, pm, &oc, existing) {
+				return pm, fmt.Errorf("host port %d/%s already used on the same IPv4 by container %s (ID: %d)", pm.HostPort, pm.Protocol, oc.Name, oc.ID)
 			}
 		}
 	}
@@ -204,7 +383,9 @@ func allocateDefaultEqualPorts(c *config.Container, count int) []int {
 	used := map[int]bool{}
 	// Mark current container's ports
 	for _, pm := range c.PortMappings {
-		used[pm.HostPort] = true
+		for _, hostIP := range expandPortMappingHostIPs(c, pm) {
+			used[hostPortKey(hostIP, pm.HostPort)] = true
+		}
 		used[pm.ContainerPort] = true
 	}
 	// Also mark all other containers' host ports (LXC + KVM)
@@ -213,13 +394,17 @@ func allocateDefaultEqualPorts(c *config.Container, count int) []int {
 			continue
 		}
 		for _, pm := range oc.PortMappings {
-			used[pm.HostPort] = true
+			oc := oc
+			for _, hostIP := range expandPortMappingHostIPs(&oc, pm) {
+				used[hostPortKey(hostIP, pm.HostPort)] = true
+			}
 		}
 	}
 	ports := make([]int, 0, count)
 	next := 20000
 	for len(ports) < count {
-		if !used[next] {
+		hostIP := c.PrimaryPublicIPv4()
+		if !used[hostPortKey(hostIP, next)] && !used[next] {
 			ports = append(ports, next)
 		}
 		next++
@@ -229,3 +414,118 @@ func allocateDefaultEqualPorts(c *config.Container, count int) []int {
 	}
 	return ports
 }
+
+func HostPortAvailable(c *config.Container, hostIP string, hostPort int, protocol string) bool {
+	if c == nil || hostPort <= 0 {
+		return false
+	}
+	pm := config.PortMapping{HostIP: strings.TrimSpace(hostIP), HostPort: hostPort, Protocol: protocol}
+	for _, existing := range c.PortMappings {
+		if portMappingsConflict(c, pm, c, existing) {
+			return false
+		}
+	}
+	for _, oc := range config.AppConfig.Containers {
+		if oc.ID == c.ID {
+			continue
+		}
+		oc := oc
+		for _, existing := range oc.PortMappings {
+			if portMappingsConflict(c, pm, &oc, existing) {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func expandPortMappingHostIPs(c *config.Container, pm config.PortMapping) []string {
+	if strings.TrimSpace(pm.HostIP) != "" {
+		return []string{strings.TrimSpace(pm.HostIP)}
+	}
+	if c != nil && len(c.PublicIPv4s) > 0 {
+		values := make([]string, 0, len(c.PublicIPv4s))
+		for _, item := range c.PublicIPv4s {
+			if strings.TrimSpace(item.Address) != "" {
+				values = append(values, strings.TrimSpace(item.Address))
+			}
+		}
+		if len(values) > 0 {
+			return values
+		}
+	}
+	return []string{""}
+}
+
+func containerHasPublicIPv4(c *config.Container, hostIP string) bool {
+	if c == nil {
+		return false
+	}
+	for _, item := range c.PublicIPv4s {
+		if item.Address == hostIP {
+			return true
+		}
+	}
+	return false
+}
+
+func portMappingsConflict(aContainer *config.Container, a config.PortMapping, bContainer *config.Container, b config.PortMapping) bool {
+	if a.HostPort != b.HostPort || !protocolsOverlap(a.Protocol, b.Protocol) {
+		return false
+	}
+	aIPs := expandPortMappingHostIPs(aContainer, a)
+	bIPs := expandPortMappingHostIPs(bContainer, b)
+	for _, aIP := range aIPs {
+		for _, bIP := range bIPs {
+			if aIP == "" || bIP == "" || aIP == bIP {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func protocolsOverlap(a, b string) bool {
+	a = strings.ToLower(strings.TrimSpace(a))
+	b = strings.ToLower(strings.TrimSpace(b))
+	if a == "" {
+		a = "tcp"
+	}
+	if b == "" {
+		b = "tcp"
+	}
+	if a == b || a == "all" || b == "all" {
+		return true
+	}
+	return (a == "tcp+udp" && (b == "tcp" || b == "udp")) ||
+		(b == "tcp+udp" && (a == "tcp" || a == "udp"))
+}
+
+func natRuleIPTag(ip string) string {
+	ip = strings.TrimSpace(ip)
+	if ip == "" {
+		return "any"
+	}
+	return strings.ReplaceAll(ip, ".", "_")
+}
+
+func displayHostIP(ip string) string {
+	if strings.TrimSpace(ip) == "" {
+		return "host"
+	}
+	return ip
+}
+
+func hostPortKey(hostIP string, port int) int {
+	if hostIP == "" {
+		return port
+	}
+	sum := 0
+	for _, r := range hostIP {
+		sum = sum*31 + int(r)
+	}
+	if sum < 0 {
+		sum = -sum
+	}
+	return port + (sum % 1000000 * 100000)
+}

backend/internal/lxc/templates.go

@@ -46,17 +46,17 @@ func GetTemplates() []Template {
 		},
 		{
 			ID: "archlinux-current", Name: "Arch Linux",
-			Distro: "archlinux", Release: "current", Arch: "amd64", Variant: "cloud",
+			Distro: "archlinux", Release: "current", Arch: "amd64",
 			Description: "Arch Linux (Rolling)",
 		},
 		{
 			ID: "fedora-44", Name: "Fedora 44",
-			Distro: "fedora", Release: "44", Arch: "amd64", Variant: "cloud",
+			Distro: "fedora", Release: "44", Arch: "amd64",
 			Description: "Fedora 44",
 		},
 		{
 			ID: "rockylinux-10", Name: "Rocky Linux 10",
-			Distro: "rockylinux", Release: "10", Arch: "amd64", Variant: "cloud",
+			Distro: "rockylinux", Release: "10", Arch: "amd64",
 			Description: "Rocky Linux 10",
 		},
 	}