design: add nspawn LocalDNS proposal

[hbc (bcho)]

Summary

• propose running a two-listener CoreDNS cache inside the active nspawn machine
• define machine resolver, kubelet DNS, host network, NOTRACK, watchdog, resource, and lifecycle behavior based on AgentBaker LocalDNS
• define online/offline CoreDNS artifact acquisition, plugin verification, metrics, preflight, and AKS Flex Node ownership boundaries
• document remaining AgentBaker parity gaps and intentional architectural differences

Validation

• git diff --check
• documentation-only change

[Copilot]

Pull request overview

This pull request adds a design proposal describing an optional CoreDNS-based “LocalDNS” cache that runs as a systemd service inside the active systemd-nspawn machine, including expected resolver wiring, lifecycle ordering, artifact acquisition (online/offline), preflight checks, and operational behavior.

Changes:

• Introduces a two-listener LocalDNS model (node/default vs ClusterFirst) with explicit kubelet + machine resolver integration.
• Specifies operational requirements: startup ordering, watchdog/health probing, resource limits, conntrack bypass rules, and reset/repave semantics.
• Defines artifact + configuration contracts: CoreDNS acquisition, required plugin verification, and templated Corefile rendering/validation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Patrick W. Healy (phealy)]

Basic design sounds like what aks-local-dns does but adapted quite well for unbounded. A few minor details commented.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (2)

designs/agent-nspawn-localdns.md:602

• The sentence breaks the phrase "Disable LocalDNS through repave" across lines using a trailing hyphen ("Disable-through-") which reads like an unintended hyphenation and makes the text harder to read/search. Consider keeping the phrase intact without a line-ending hyphen.

Host boot orders this reconciliation after `nftables-flush.service` and before
the nspawn machine. Enabled-to-enabled repave keeps the rules. Disable-through-
repave and full reset remove all rules carrying the Unbounded ownership comment
after no active machine depends on LocalDNS.

designs/agent-nspawn-localdns.md:674

• This section says memory limits come from MemoryLimitInMB, but the rendered systemd value uses MemoryMax=128M where M is a binary unit in systemd. To avoid ambiguity about whether "MB" here means decimal MB or MiB, consider clarifying the conversion/unit semantics in the text.

The rendered values come from `CPULimitInMilliCores` and `MemoryLimitInMB`;
2000 millicores converts to `CPUQuota=200%`. CoreDNS does not need to manage the
dummy interface. The host agent reconciles that state before machine startup.