Should allow localhost DNS servers when using host network

[zhangyoufu]

Description

When a container is using host network, we should respect host's /etc/resolv.conf and allow DNS servers serving on loopback addresses, instead of override them with Google Public DNS. Docker did what I expect. nerdctl always override DNS servers when it found loopback addresses.

nerdctl/pkg/resolvconf/resolvconf.go

Lines 180 to 208 in 246b6c1

	// FilterResolvDNS cleans up the config in resolvConf. It has two main jobs:
	// 1. It looks for localhost (127.*|::1) entries in the provided
	// resolv.conf, removing local nameserver entries, and, if the resulting
	// cleaned config has no defined nameservers left, adds default DNS entries
	// 2. Given the caller provides the enable/disable state of IPv6, the filter
	// code will remove all IPv6 nameservers if it is not enabled for containers
	func FilterResolvDNS(resolvConf []byte, ipv6Enabled bool) (*File, error) {
	cleanedResolvConf := localhostNSRegexp.ReplaceAll(resolvConf, []byte{})
	// if IPv6 is not enabled, also clean out any IPv6 address nameserver
	if !ipv6Enabled {
	cleanedResolvConf = nsIPv6Regexp.ReplaceAll(cleanedResolvConf, []byte{})
	}
	// if the resulting resolvConf has no more nameservers defined, add appropriate
	// default DNS servers for IPv4 and (optionally) IPv6
	if len(GetNameservers(cleanedResolvConf, IP)) == 0 {
	log.L.Infof("No non-localhost DNS nameservers are left in resolv.conf. Using default external servers: %v", defaultIPv4Dns)
	dns := defaultIPv4Dns
	if ipv6Enabled {
	log.L.Infof("IPv6 enabled; Adding default IPv6 external servers: %v", defaultIPv6Dns)
	dns = append(dns, defaultIPv6Dns...)
	}
	cleanedResolvConf = append(cleanedResolvConf, []byte("\n"+strings.Join(dns, "\n"))...)
	}
	hash, err := hashData(bytes.NewReader(cleanedResolvConf))
	if err != nil {
	return nil, err
	}
	return &File{Content: cleanedResolvConf, Hash: hash}, nil
	}

host /etc/resolv.conf:

# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search .

• docker run --network host --rm alpine cat /etc/resolv.conf:

# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.

nameserver 127.0.0.53
search .
options edns0 trust-ad

# Based on host file: '/etc/resolv.conf'
# Overrides: []

• nerdctl run --network host --rm alpine cat /etc/resolv.conf:

INFO[0000] No non-localhost DNS nameservers are left in resolv.conf. Using default external servers: [nameserver 8.8.8.8 nameserver 8.8.4.4]
INFO[0000] IPv6 enabled; Adding default IPv6 external servers: [nameserver 2001:4860:4860::8888 nameserver 2001:4860:4860::8844]
nameserver 8.8.8.8
nameserver 8.8.4.4
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844

Steps to reproduce the issue

nerdctl run --network host --rm alpine cat /etc/resolv.conf

Describe the results you received and expected

INFO[0000] No non-localhost DNS nameservers are left in resolv.conf. Using default external servers: [nameserver 8.8.8.8 nameserver 8.8.4.4]
INFO[0000] IPv6 enabled; Adding default IPv6 external servers: [nameserver 2001:4860:4860::8888 nameserver 2001:4860:4860::8844]
nameserver 8.8.8.8
nameserver 8.8.4.4
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844

What version of nerdctl are you using?

Client:
 Version:	v2.2.0
 OS/Arch:	linux/arm64
 Git commit:	4eb4cbdb6b7ae82ab864a9829d1162a20eb61f81
 buildctl:
  Version:

Server:
 containerd:
  Version:	v2.2.0
  GitCommit:	1c4457e00facac03ce1d75f7b6777a7a851e5c41
 runc:
  Version:	1.4.0
  GitCommit:	v1.4.0-0-g8bd78a99

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

No response