fix(gitlab): fix nested-container DNS by propagating netns and mounting containers.conf

Root cause (confirmed live on s390x runner):

  podman build RUN steps run inside a nested container created by inner
  Podman inside the docker executor container.  Inner Podman (using
  Netavark) creates a new bridge for these build-step containers, but the
  privileged-but-bridge-networked outer container has no working iptables/
  nftables NAT, so packets from the 10.88.0.0/16 bridge subnet can never
  reach the DNS servers.  The inner containers' /etc/resolv.conf had the
  correct nameservers written but DNS queries timed out because they could
  not be routed.

  The previous chmod 644 and dns_servers fixes correctly configured the
  outer executor container but did not propagate into the nested build-step
  containers.

Fixes applied:

  1. Add netns = "host" to /etc/containers/containers.conf.
     When the file is bind-mounted into the executor container (see #3),
     inner Podman reads this and creates all build-step containers sharing
     the outer container's network namespace instead of a new bridge.
     They inherit the working resolv.conf with no NAT required.

  2. Guarantee /etc/containers/containers.conf exists before runner
     registration even when DNS detection finds no upstream servers, so
     the bind mount in #3 always has a real file to attach to.

  3. Add --docker-volumes to the runner registration so that every
     executor container gets the host's containers.conf bind-mounted at
     /etc/containers/containers.conf:ro.  This makes the nested inner
     Podman pick up both dns_servers and netns = "host" automatically,
     without any change to the CI job Dockerfile or podman build invocation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: adrianriobo

pkg/integrations/gitlab/snippet-linux.sh

@@ -43,8 +43,8 @@ if [ -n "$_dns_servers" ]; then
     done
     sudo mkdir -p /etc/containers
     if [ ! -f /etc/containers/containers.conf ]; then
-        printf '[containers]\ndns_servers = [%s]\n' "$_toml_list" \
-            | sudo tee /etc/containers/containers.conf > /dev/null
+        printf '[containers]\ndns_servers = [%s]\ndns_options = ["timeout:2", "attempts:5", "single-request"]\n' \
+            "$_toml_list" | sudo tee /etc/containers/containers.conf > /dev/null
     elif grep -q '^\[containers\]' /etc/containers/containers.conf; then
         # Scope the dns_servers check to the [containers] section only
         if awk '/^\[containers\]/{f=1;next} /^\[/{f=0} f && /^dns_servers/{found=1} END{exit !found}' \
@@ -60,10 +60,28 @@ if [ -n "$_dns_servers" ]; then
             sudo sed -i "/^\[containers\]/a dns_servers = [${_toml_list}]" \
                 /etc/containers/containers.conf
         fi
+        # Add or update dns_options within [containers]
+        if grep -q '^dns_options' /etc/containers/containers.conf; then
+            sudo sed -i 's|^dns_options.*|dns_options = ["timeout:2", "attempts:5", "single-request"]|' \
+                /etc/containers/containers.conf
+        else
+            sudo sed -i '/^\[containers\]/a dns_options = ["timeout:2", "attempts:5", "single-request"]' \
+                /etc/containers/containers.conf
+        fi
     else
-        printf '\n[containers]\ndns_servers = [%s]\n' "$_toml_list" \
-            | sudo tee -a /etc/containers/containers.conf > /dev/null
+        printf '\n[containers]\ndns_servers = [%s]\ndns_options = ["timeout:2", "attempts:5", "single-request"]\n' \
+            "$_toml_list" | sudo tee -a /etc/containers/containers.conf > /dev/null
     fi
+    # Ensure the file is world-readable so rootless Podman can also load it
+    sudo chmod 644 /etc/containers/containers.conf
+fi
+
+# Guarantee the file exists even when DNS detection found nothing, so that the
+# volume mount added to the runner below always has a real file to bind.
+sudo mkdir -p /etc/containers
+if [ ! -f /etc/containers/containers.conf ]; then
+    printf '[containers]\n' | sudo tee /etc/containers/containers.conf > /dev/null
+    sudo chmod 644 /etc/containers/containers.conf
 fi
 
 {{- if .LogToJournald}}
@@ -90,8 +108,35 @@ else
     printf '\n[containers]\nlog_driver = "journald"\n' \
         | sudo tee -a /etc/containers/containers.conf > /dev/null
 fi
+sudo chmod 644 /etc/containers/containers.conf
 {{- end}}
 
+# Set netns = "host" so inner Podman (running inside the CI executor container)
+# uses the outer container's network namespace for nested build-step containers.
+# Without this, Netavark creates a bridge for inner containers but that bridge
+# has no working NAT inside a privileged non-host-network container, causing DNS
+# and internet access to fail in every podman build RUN step.
+if [ ! -f /etc/containers/containers.conf ]; then
+    printf '[containers]\nnetns = "host"\n' \
+        | sudo tee /etc/containers/containers.conf > /dev/null
+elif grep -q '^\[containers\]' /etc/containers/containers.conf; then
+    if awk '/^\[containers\]/{f=1;next} /^\[/{f=0} f && /^netns/{found=1} END{exit !found}' \
+            /etc/containers/containers.conf; then
+        awk '/^\[containers\]/{s=1} /^\[/ && !/^\[containers\]/{s=0}
+             s && /^netns/{$0="netns = \"host\""} 1' \
+            /etc/containers/containers.conf \
+            | sudo tee /etc/containers/containers.conf.tmp > /dev/null \
+            && sudo mv /etc/containers/containers.conf.tmp /etc/containers/containers.conf
+    else
+        sudo sed -i '/^\[containers\]/a netns = "host"' \
+            /etc/containers/containers.conf
+    fi
+else
+    printf '\n[containers]\nnetns = "host"\n' \
+        | sudo tee -a /etc/containers/containers.conf > /dev/null
+fi
+sudo chmod 644 /etc/containers/containers.conf
+
 # Register runner using docker executor backed by Podman
 # --docker-privileged is required for Podman: containers need CAP_SYS_ADMIN to mount /proc
 sudo gitlab-runner register \
@@ -102,7 +147,8 @@ sudo gitlab-runner register \
   --executor "docker" \
   --docker-image "fedora:latest" \
   --docker-host "unix:///run/podman/podman.sock" \
-  --docker-privileged
+  --docker-privileged \
+  --docker-volumes "/etc/containers/containers.conf:/etc/containers/containers.conf:ro"
 
 {{- if not .Unsecure}}
 # Create a dedicated system user for running CI jobs