NET_ADMIN and name based communication

[Onotot]

Hello. I have an nginx.container and a service in a .kube file, where one of the containers is warp. Nginx and the service are on the same network. Warp requires NET_ADMIN to create a network interface, and it breaks the internal DNS of podman by modifying /etc/resolv.conf, after which the service cannot reach nginx by name. I haven't found a way to fix this, as .kube doesn't have DNS options. It only works when specifying the nginx IP address, which is inconvenient because it changes upon reboot. Can you suggest a way to fix this? Can I add any DNS-related instructions to the yml file used in .kube? Or is there a simpler solution?

If I move the warp to a separate container and place it on the same network, I cannot access its interface from within the .kube service. Network=container:name does not work for .kube.

[Luap99]

dns config can be set in the kube yml https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config

But is is not clear to me why you think that changes something? If the container is overwriting resolv.conf then it will just as well overwrite the dns settings you specified.

It would likely be better than if you can tell wrap not do do that. Or otherwise I guess you can mount an empty file to /etc/resolv.conf for just the wrap container than it would not affect other containers in the pod.

[Onotot]

But is is not clear to me why you think that changes something? If the container is overwriting resolv.conf then it will just as well overwrite the dns settings you specified.

You are right. I should have removed the DNS settings from the WireGuard (warp) config. I made a mistake and assumed /etc/resolv.conf was being changed due to NET_ADMIN, without considering the service's own settings.

Could you please advise if it's possible for me to specify a network interface created in one container for another, if they are on the same network but not in the same pod? Or is this not possible?

[Onotot]

@Luap99 I've resolved the answer to my own question. For two separate containers, I'll either use Network: container:name or put them in a Pod. Sorry to bother you.