didericis/bot-bottle
1
0
Fork 0
Code Issues 37 Pull Requests 4 Actions Packages Releases Wiki Activity

fix(macos): install podman 5's full networking stack
test / integration-docker (pull_request) Successful in 43s
Details
test / unit (pull_request) Successful in 52s
Details
lint / lint (push) Successful in 1m0s
Details
test / integration-firecracker (pull_request) Successful in 3m36s
Details
test / coverage (pull_request) Successful in 16s
Details
test / publish-infra (pull_request) Has been skipped
Details
tracker-policy-pr / check-pr (pull_request) Failing after 11m9s
Details

Browse Source 
netavark shells out to `nft` for the bridge network every compose file
expects, and aardvark-dns serves name resolution inside nested
containers. Neither arrives with the base image's
`--no-install-recommends` podman, and each fails at a different and
misleading layer: without nft containers are created but never start;
without aardvark-dns DNS inside a container fails while the engine, the
pulls, and the bridge all look healthy. That last one is the likeliest
explanation for the "DNS inside nested containers fails entirely" note
in #392 — a missing package, not a design gap.

Verified on the macOS host: with passt alone, `docker run` reached
netavark and died on "unable to execute nft".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
didericis
2026-07-21 19:28:42 -04:00
parent e267ba24d9
commit 41959fe2a2
3 changed files with 29 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bot_bottle/backend/macos_container/nested_containers.py
+14 -5
View File
@@ -82,12 +82,21 @@ def build_image(
"COPY --from=docker_cli /usr/local/libexec/docker/cli-plugins/"
"docker-compose /usr/local/libexec/docker/cli-plugins/docker-compose\n"
"RUN apt-get update \\\n"
# passt provides `pasta`, which podman 5 uses by default for
# rootless networking (podman 4 defaulted to slirp4netns). Without
# it every container fails to start with "could not find pasta".
# slirp4netns stays as the documented fallback.
# podman 5's networking stack, installed explicitly because the
# base image's `--no-install-recommends` podman does not pull it
# in and each piece fails at a different, misleading layer:
# passt -> `pasta`, the default rootless netns helper
# (podman 4 used slirp4netns); without it
# nothing starts: "could not find pasta"
# nftables -> `nft`, which netavark shells out to for the
# bridge network every compose file expects
# aardvark-dns -> name resolution *inside* nested containers;
# without it DNS fails while everything else
# looks healthy
# slirp4netns stays as the documented fallback for pasta.
" && apt-get install -y --no-install-recommends "
"fuse-overlayfs passt slirp4netns uidmap \\\n"
"aardvark-dns fuse-overlayfs netavark nftables passt "
"slirp4netns uidmap \\\n"
" && rm -rf /var/lib/apt/lists/* \\\n"
# Deliberate: an empty subordinate range keeps podman on the
# single-UID mapping that needs no CAP_SYS_ADMIN. Adding ranges