Changed host network configuration is not reflected to containers created with --network host

[StayPirate]

/kind bug

Description

If I create a container with --network host the host's file /etc/resolv.conf is copied within the container. When I later connect the host to a VPN which reconfigure the resolvers, by passing new DNS servers via DHCP, these changes are not reflected inside the container.

Steps to reproduce the issue:

1. create a container with --network host

2. change your host /etc/resolv.conf

3. From the container, try to resolve a domain name which is only resolvable with the new configured DNS servers.

Describe the results you received:

This prevent me to access new available network resources from the container.

Describe the results you expected:

I'd like to continue to use the container as I would do from the host system after I connected the host to the VPN.

Output of podman version:

Version:      3.0.1
API Version:  3.0.0
Go Version:   go1.16
Git Commit:   c640670e85c4aaaff92741691d6a854a90229d8d
Built:        Sun Feb 21 16:29:46 2021
OS/Arch:      linux/amd64

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide?

Yes

[Luap99]

I think the problem is that we copy the content in /etc/resolv.conf before we bind mount it in the container. I think when --network host is used we can directly bind mount /etc/resolv.conf and /etc/hosts.

@mheon @baude WDYT?

[rhatdan]

I believe we copied the behaviour of Docker for this. One issue with not copying the contents, is the contents become non writable from within the container. Since you don't want the container to modify the hosts resolv.conf.

[Luap99]

@rhatdan You are right I just tested this with docker.

[mheon]

Concur, this is a Docker compat measure.

For folks who don't want this, we added the --dns=none flag to disable Podman's management of /etc/resolv.conf, then you can bind-mount in the original from the host.

[alitvak69]

Will application in the container react to a changed resolve.conf file? Some apps at least from my experience read resolver info only once on start.

[rhatdan]

If you do a -v /etc/resolv.conf:/etc/resolv.conf it should work as long as the resolver file is not renamed and replaced.

There is no guarantee that any application will reread the /etc/resolv.conf ever.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[alitvak69]

OK to close.

[StayPirate]

Unfortunately I had not spare time to follow this up until today. I appreciated all your suggestions and tried them out, but without any luck.

Even if I use --dns=none and -v /etc/resolv.conf:/etc/resolv.conf, /etc/resolv.conf inside the container does not reflect the changes I make to the host's one. Here what I did:

host > cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 192.168.1.1

host > podman container run --rm -ti --dns=none -v /etc/resolv.conf:/etc/resolv.conf alpine:latest sh
guest > cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 192.168.1.1

Then I change the /etc/resolv.conf in the host.

host > cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.160.0.1
nameserver 10.160.2.88
nameserver 2620:113:80c0:8080:10:160:2:88
# NOTE: the libc resolver may not support more than 3 nameservers.
# The nameservers listed below may not be recognized.
nameserver 2620:113:80c0:8080:10:160:0:1
nameserver 192.168.1.1

I then check again the file from the container, expecting to see the above changes reflected:

guest > cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 192.168.1.1

But that's not the case. Am I doing something wrong here or have I hit a bug?