libpod,netavark: correctly set `/etc/resolv.conf` for custom dns server and make `--dns` functional #16297

flouthoc · 2022-10-26T07:21:14Z

Following PR ensures two things

podman: relay custom DNS servers to network stack
- Aardvark-dns and netavark now accepts custom DNS servers for containers
  via new config field dns_servers. New field allows containers to use
  custom resolvers instead of host's default resolvers.
- See netavark ,aardvark: accept and populate custom dns_servers for containers netavark#452
  and aardvark-dns: add support for container's custom dns_servers aardvark-dns#240
libpod,netavark: correctly populate /etc/resolv.conf with custom dns server
- After netavark ,aardvark: accept and populate custom dns_servers for containers netavark#452 netavark is
  incharge of deciding custom_dns_servers if any so lets honor that and
  libpod should not set these manually.

This also ensures docker parity since Podman populates container's /etc/resolv.conf with custom DNS servers
( specified via --dns or dns_server in containers.conf ) even when container is connected to a network where dns_enabled is true. Current behavior does not matches with docker, hence following commit ensures that podman only populates custom DNS server when container is not connected to any network where DNS is enabled and for the cases where dns_enabled is true
the resolution for custom DNS server will happen via ( aardvark-dns ).

Reference: https://docs.docker.com/config/containers/container-networking/#dns-services

container: `--dns` and `dns_server` behavior for containers connected to network matches with docker now when netavark is used

Closes: #16172
Closes: RFC in BZ#2128675

flouthoc · 2022-10-26T08:32:19Z

Following PR needs netavark and aardvark-dns from main, @cevich any clue how can I get netavark and aardvark-dns from main so I can make CI green and get this PR in ?

Luap99

How does this behave with --dns=none? Does it still work, it should ignore /etc/resolv.conf setup.

libpod/container_internal_common.go

flouthoc · 2022-10-26T11:45:26Z

How does this behave with --dns=none? Does it still work, it should ignore /etc/resolv.conf setup.

In case of --dns=none no /etc/resolv.conf is created inside the container.

Luap99

LGTM
I think we have skip the test until me make new nv/av releases and get them into the CI VMs.

flouthoc · 2022-10-26T15:20:16Z

Is it possible to only pull nv/av from main only for this PR so I can verify entire CI ? @cevich @baude any hints ?

flouthoc · 2022-10-26T16:34:08Z

LGTM I think we have skip the test until me make new nv/av releases and get them into the CI VMs.

@Luap99 Problem with skipping is that I will also have to skip some older nameserver tests as well since now nameservers are being returned from netavark but CI is using old netavark. However I am okay to skip those tests if everybody is ok with it.

Luap99 · 2022-10-26T16:37:15Z

Lets wait then, there is no rush to get this in, the next feature release is 4.4 which I assume is at least over a month away.

flouthoc · 2022-11-15T09:04:38Z

I think CI should pass if new netavark/aardvark are already in CI.

TomSweeneyRedHat · 2022-11-16T20:04:58Z

Just leaving a reminder that we promised to have this upstream for QE testing on November 28. @flouthoc , if that's not likely to happen, that's fine, but we'll just need to adjust expectations.

flouthoc · 2022-11-17T04:32:09Z

Just leaving a reminder that we promised to have this upstream for QE testing on November 28. @flouthoc , if that's not likely to happen, that's fine, but we'll just need to adjust expectations.

@TomSweeneyRedHat Recently there was change of requirements for original RFE so this PR does not covers the epic, this is the old implementation before requirements were changed so this PR might not be applicable for epic anymore but still needed for docker compat.

Scope of new RFE is bigger and requirement is still under consideration, work on that part has not been started yet so definitely it will not make it on nov28. But I am not aware when requirements will be finalized but @baude can help better here.

Overall this PR is still needed for docker compatibility so I think this will be still merged.

github-actions · 2023-01-17T00:06:45Z

A friendly reminder that this PR had no activity for 30 days.

mheon · 2023-01-17T16:52:40Z

What's going on here - is this abandoned in favor of a newer PR?

Luap99 · 2023-01-17T16:57:06Z

This is still needed AFAIK

flouthoc · 2023-01-18T10:32:21Z

@mheon This is still needed but needs newer versions of nv/av in CI so waiting for that.

Luap99 · 2023-01-18T13:16:43Z

when you rebase and make sure test passes with newer nv/av I am fine with merging this with the test skipped like the other PR.

Aardvark-dns and netavark now accepts custom DNS servers for containers via new config field `dns_servers`. New field allows containers to use custom resolvers instead of host's default resolvers. Following commit instruments libpod to pass these custom DNS servers set via `--dns` or central config to the network stack. Depends-on: * Common: containers/common#1189 * Netavark: containers/netavark#452 * Aardvark-dns: containers/aardvark-dns#240 Signed-off-by: Aditya R <arajan@redhat.com>

…server After containers/netavark#452 `netavark` is incharge of deciding `custom_dns_servers` if any so lets honor that and libpod should not set these manually. This also ensures docker parity Podman populates container's `/etc/resolv.conf` with custom DNS servers ( specified via `--dns` or `dns_server` in containers.conf ) even when container is connected to a network where `dns_enabled` is `true`. Current behavior does not matches with docker, hence following commit ensures that podman only populates custom DNS server when container is not connected to any network where DNS is enabled and for the cases where `dns_enabled` is `true` the resolution for custom DNS server will happen via ( `aardvark-dns` or `dnsname` ). Reference: https://docs.docker.com/config/containers/container-networking/#dns-services Closes: containers#16172 Signed-off-by: Aditya R <arajan@redhat.com>

Set search domain irrespective of nameservers. Signed-off-by: Aditya R <arajan@redhat.com>

flouthoc · 2023-01-22T16:17:37Z

Failing tests seems unrelated.

flouthoc · 2023-01-23T12:14:37Z

I think this should become green now.

Signed-off-by: Aditya R <arajan@redhat.com>

flouthoc · 2023-01-23T16:08:40Z

@Luap99 @containers/podman-maintainers PTAL

Luap99

LGTM

openshift-ci · 2023-01-23T16:14:24Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: flouthoc, Luap99

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Luap99,flouthoc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

mheon · 2023-01-23T17:24:15Z

/lgtm

openshift-ci bot added release-note approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Oct 26, 2022

This was referenced Oct 26, 2022

[wip] libpod: propogate custom DNS server to /etc/resolv.conf only when dns_enabled for network #16175

Closed

podman: relay custom DNS servers to network stack ( netavark/aardvark-dns ) #16197

Closed

flouthoc changed the title ~~libpod,netavark: correctly set /etc/resolv.conf for custom dns server when using netavark/aardvark-dns~~ libpod,netavark: correctly set /etc/resolv.conf for custom dns server and make --dns functional Oct 26, 2022

flouthoc requested a review from Luap99 October 26, 2022 07:24

Luap99 reviewed Oct 26, 2022

View reviewed changes

libpod/container_internal_common.go Outdated Show resolved Hide resolved

flouthoc force-pushed the netavark-custom-dns branch from 401ce6e to 1938e9b Compare October 26, 2022 11:48

flouthoc requested a review from Luap99 October 26, 2022 11:49

Luap99 reviewed Oct 26, 2022

View reviewed changes

vrothberg changed the title ~~libpod,netavark: correctly set /etc/resolv.conf for custom dns server and make --dns functional~~ WIP: libpod,netavark: correctly set /etc/resolv.conf for custom dns server and make --dns functional Nov 9, 2022

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 9, 2022

flouthoc force-pushed the netavark-custom-dns branch from 18544c4 to 2fbe263 Compare November 15, 2022 09:04

flouthoc changed the title ~~WIP: libpod,netavark: correctly set /etc/resolv.conf for custom dns server and make --dns functional~~ libpod,netavark: correctly set /etc/resolv.conf for custom dns server and make --dns functional Nov 15, 2022

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 15, 2022

flouthoc force-pushed the netavark-custom-dns branch from 2fbe263 to 2ef38c1 Compare November 20, 2022 02:04

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 17, 2022

rlenferink mentioned this pull request Jan 16, 2023

Add podman support mailcow/mailcow-dockerized#4982

Draft

github-actions bot added the stale-pr label Jan 17, 2023

github-actions bot removed the stale-pr label Jan 18, 2023

flouthoc added 3 commits January 22, 2023 12:48

libpod: set search domain independently of nameservers

e2c44c3

Set search domain irrespective of nameservers. Signed-off-by: Aditya R <arajan@redhat.com>

flouthoc force-pushed the netavark-custom-dns branch from 2ef38c1 to e2c44c3 Compare January 22, 2023 07:19

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 22, 2023

flouthoc force-pushed the netavark-custom-dns branch 4 times, most recently from db19977 to 47bbbb2 Compare January 23, 2023 11:58

systems: retrofit dns options test to honor other search domains

b7ab889

Signed-off-by: Aditya R <arajan@redhat.com>

flouthoc force-pushed the netavark-custom-dns branch from 47bbbb2 to b7ab889 Compare January 23, 2023 13:45

flouthoc requested a review from Luap99 January 23, 2023 16:08

Luap99 approved these changes Jan 23, 2023

View reviewed changes

flouthoc requested a review from mheon January 23, 2023 16:32

openshift-ci bot assigned mheon Jan 23, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 23, 2023

openshift-merge-robot merged commit 1a90189 into containers:main Jan 23, 2023

flouthoc mentioned this pull request Jan 23, 2023

copying system image from manifest list: writing/storing blob: happened during read: unexpected EOF #17193

Open

Luap99 mentioned this pull request Feb 14, 2023

Impossible to override container's DNS with network #17499

Closed

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 14, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 14, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

libpod,netavark: correctly set `/etc/resolv.conf` for custom dns server and make `--dns` functional #16297

libpod,netavark: correctly set `/etc/resolv.conf` for custom dns server and make `--dns` functional #16297

flouthoc commented Oct 26, 2022 •

edited

Loading

flouthoc commented Oct 26, 2022

Luap99 left a comment

flouthoc commented Oct 26, 2022

Luap99 left a comment

flouthoc commented Oct 26, 2022

flouthoc commented Oct 26, 2022

Luap99 commented Oct 26, 2022

flouthoc commented Nov 15, 2022

TomSweeneyRedHat commented Nov 16, 2022

flouthoc commented Nov 17, 2022

github-actions bot commented Jan 17, 2023

mheon commented Jan 17, 2023

Luap99 commented Jan 17, 2023

flouthoc commented Jan 18, 2023

Luap99 commented Jan 18, 2023

flouthoc commented Jan 22, 2023

flouthoc commented Jan 23, 2023

flouthoc commented Jan 23, 2023

Luap99 left a comment

openshift-ci bot commented Jan 23, 2023

mheon commented Jan 23, 2023

libpod,netavark: correctly set /etc/resolv.conf for custom dns server and make --dns functional #16297

libpod,netavark: correctly set /etc/resolv.conf for custom dns server and make --dns functional #16297

Conversation

flouthoc commented Oct 26, 2022 • edited Loading

flouthoc commented Oct 26, 2022

Luap99 left a comment

Choose a reason for hiding this comment

flouthoc commented Oct 26, 2022

Luap99 left a comment

Choose a reason for hiding this comment

flouthoc commented Oct 26, 2022

flouthoc commented Oct 26, 2022

Luap99 commented Oct 26, 2022

flouthoc commented Nov 15, 2022

TomSweeneyRedHat commented Nov 16, 2022

flouthoc commented Nov 17, 2022

github-actions bot commented Jan 17, 2023

mheon commented Jan 17, 2023

Luap99 commented Jan 17, 2023

flouthoc commented Jan 18, 2023

Luap99 commented Jan 18, 2023

flouthoc commented Jan 22, 2023

flouthoc commented Jan 23, 2023

flouthoc commented Jan 23, 2023

Luap99 left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Jan 23, 2023

mheon commented Jan 23, 2023

libpod,netavark: correctly set `/etc/resolv.conf` for custom dns server and make `--dns` functional #16297

libpod,netavark: correctly set `/etc/resolv.conf` for custom dns server and make `--dns` functional #16297

flouthoc commented Oct 26, 2022 •

edited

Loading