Allow localhost DNS servers when using host network

This commit addresses the issue where nerdctl was unconditionally stripping
localhost DNS servers from /etc/resolv.conf when containers used --network=host.

Changes made:
1. Modified FilterResolvDNS() to support preserving localhost DNS servers via
   a new FilterResolvDNSWithLocalhostOption() function
2. Added allowLocalhostDNS parameter to fetchDNSResolverConfig()
3. Updated hostNetworkManager to use allowLocalhostDNS=true to preserve host DNS
4. Added comprehensive test coverage for the new functionality

The fix ensures:
- Host network mode respects host's /etc/resolv.conf including localhost resolvers
- Isolated networks (bridge, CNI) continue to have fallback Google DNS
- Backward compatible - all existing behavior unchanged
- Docker-compatible behavior

Fixes: #4651
Signed-off-by: Youfu Zhang <[email protected]>

Author: zhangyoufu

pkg/containerutil/container_network_manager.go

@@ -90,6 +90,10 @@ func withCustomHosts(src string) func(context.Context, oci.Client, *containers.C
 }
 
 func fetchDNSResolverConfig(netOpts types.NetworkOptions) ([]string, []string, []string, error) {
+	return fetchDNSResolverConfigWithOptions(netOpts, false)
+}
+
+func fetchDNSResolverConfigWithOptions(netOpts types.NetworkOptions, allowLocalhostDNS bool) ([]string, []string, []string, error) {
 	dns := netOpts.DNSServers
 	dnsSearch := netOpts.DNSSearchDomains
 	dnsOptions := netOpts.DNSResolvConfOptions
@@ -103,7 +107,7 @@ func fetchDNSResolverConfig(netOpts types.NetworkOptions) ([]string, []string, [
 		conf = &resolvconf.File{}
 		log.L.WithError(err).Debugf("resolvConf file doesn't exist on host")
 	}
-	conf, err = resolvconf.FilterResolvDNS(conf.Content, true)
+	conf, err = resolvconf.FilterResolvDNSWithLocalhostOption(conf.Content, true, allowLocalhostDNS)
 	if err != nil {
 		return nil, nil, nil, err
 	}
@@ -671,7 +675,7 @@ func (m *hostNetworkManager) ContainerNetworkingOpts(_ context.Context, containe
 	}
 
 	resolvConfPath := filepath.Join(stateDir, "resolv.conf")
-	dns, dnsSearch, dnsOptions, err := fetchDNSResolverConfig(m.netOpts)
+	dns, dnsSearch, dnsOptions, err := fetchDNSResolverConfigWithOptions(m.netOpts, true)
 	if err != nil {
 		return nil, nil, err
 	}

pkg/resolvconf/resolvconf.go

@@ -181,10 +181,27 @@ func GetLastModified() *File {
 //  1. It looks for localhost (127.*|::1) entries in the provided
 //     resolv.conf, removing local nameserver entries, and, if the resulting
 //     cleaned config has no defined nameservers left, adds default DNS entries
+//     The removal of localhost entries is controlled by the allowLocalhostDNS parameter.
 //  2. Given the caller provides the enable/disable state of IPv6, the filter
 //     code will remove all IPv6 nameservers if it is not enabled for containers
 func FilterResolvDNS(resolvConf []byte, ipv6Enabled bool) (*File, error) {
-	cleanedResolvConf := localhostNSRegexp.ReplaceAll(resolvConf, []byte{})
+	return FilterResolvDNSWithLocalhostOption(resolvConf, ipv6Enabled, false)
+}
+
+// FilterResolvDNSWithLocalhostOption is like FilterResolvDNS but allows controlling
+// whether localhost nameservers are preserved. This is useful for host network mode
+// where the container should inherit the host's DNS configuration including localhost resolvers.
+//
+// Parameters:
+//   - resolvConf: the resolv.conf file content
+//   - ipv6Enabled: whether IPv6 nameservers should be preserved
+//   - allowLocalhostDNS: if true, localhost nameservers are preserved; if false, they are filtered out
+func FilterResolvDNSWithLocalhostOption(resolvConf []byte, ipv6Enabled bool, allowLocalhostDNS bool) (*File, error) {
+	cleanedResolvConf := resolvConf
+	// if allowLocalhostDNS is false, remove localhost nameservers
+	if !allowLocalhostDNS {
+		cleanedResolvConf = localhostNSRegexp.ReplaceAll(cleanedResolvConf, []byte{})
+	}
 	// if IPv6 is not enabled, also clean out any IPv6 address nameserver
 	if !ipv6Enabled {
 		cleanedResolvConf = nsIPv6Regexp.ReplaceAll(cleanedResolvConf, []byte{})

pkg/resolvconf/resolvconf_linux_test.go

@@ -320,3 +320,96 @@ func TestFilterResolvDns(t *testing.T) {
 		}
 	}
 }
+
+func TestFilterResolvDnsWithLocalhostOption(t *testing.T) {
+	// Test 1: allowLocalhostDNS=false should strip localhost (original behavior)
+	ns1 := "nameserver 127.0.0.1\nnameserver 10.16.60.14\n"
+	expected := "nameserver 10.16.60.14\n"
+	if result, _ := FilterResolvDNSWithLocalhostOption([]byte(ns1), true, false); result != nil {
+		if expected != string(result.Content) {
+			t.Fatalf("Failed allowLocalhostDNS=false: expected \n<%s> got \n<%s>", expected, string(result.Content))
+		}
+	}
+
+	// Test 2: allowLocalhostDNS=true should preserve localhost DNS
+	ns1 = "nameserver 127.0.0.1\nnameserver 10.16.60.14\n"
+	expected = "nameserver 127.0.0.1\nnameserver 10.16.60.14\n"
+	if result, _ := FilterResolvDNSWithLocalhostOption([]byte(ns1), true, true); result != nil {
+		if expected != string(result.Content) {
+			t.Fatalf("Failed allowLocalhostDNS=true with mixed servers: expected \n<%s> got \n<%s>", expected, string(result.Content))
+		}
+	}
+
+	// Test 3: allowLocalhostDNS=true with only localhost DNS should be preserved
+	ns1 = "nameserver 127.0.0.1\n"
+	expected = "nameserver 127.0.0.1\n"
+	if result, _ := FilterResolvDNSWithLocalhostOption([]byte(ns1), true, true); result != nil {
+		if expected != string(result.Content) {
+			t.Fatalf("Failed allowLocalhostDNS=true with only localhost: expected \n<%s> got \n<%s>", expected, string(result.Content))
+		}
+	}
+
+	// Test 4: allowLocalhostDNS=true with IPv6 localhost (::1) should preserve it
+	ns1 = "nameserver ::1\nnameserver 10.16.60.14\n"
+	expected = "nameserver ::1\nnameserver 10.16.60.14\n"
+	if result, _ := FilterResolvDNSWithLocalhostOption([]byte(ns1), true, true); result != nil {
+		if expected != string(result.Content) {
+			t.Fatalf("Failed allowLocalhostDNS=true with IPv6 localhost: expected \n<%s> got \n<%s>", expected, string(result.Content))
+		}
+	}
+
+	// Test 5: allowLocalhostDNS=true with 127.0.0.53 (systemd-resolved) should preserve it
+	ns1 = "nameserver 127.0.0.53\nnameserver 10.16.60.14\n"
+	expected = "nameserver 127.0.0.53\nnameserver 10.16.60.14\n"
+	if result, _ := FilterResolvDNSWithLocalhostOption([]byte(ns1), true, true); result != nil {
+		if expected != string(result.Content) {
+			t.Fatalf("Failed allowLocalhostDNS=true with 127.0.0.53: expected \n<%s> got \n<%s>", expected, string(result.Content))
+		}
+	}
+
+	// Test 6: allowLocalhostDNS=false should filter localhost even with IPv6 enabled
+	ns1 = "nameserver 127.0.0.1\nnameserver ::1\nnameserver 10.16.60.14\nnameserver 2002:dead:beef::1\n"
+	expected = "nameserver 10.16.60.14\nnameserver 2002:dead:beef::1\n"
+	if result, _ := FilterResolvDNSWithLocalhostOption([]byte(ns1), true, false); result != nil {
+		if expected != string(result.Content) {
+			t.Fatalf("Failed allowLocalhostDNS=false with mixed IPv4/IPv6: expected \n<%s> got \n<%s>", expected, string(result.Content))
+		}
+	}
+
+	// Test 7: allowLocalhostDNS=true with IPv6 disabled should strip IPv6 but keep localhost
+	ns1 = "nameserver 127.0.0.1\nnameserver ::1\nnameserver 10.16.60.14\nnameserver 2002:dead:beef::1\n"
+	expected = "nameserver 127.0.0.1\nnameserver 10.16.60.14\n"
+	if result, _ := FilterResolvDNSWithLocalhostOption([]byte(ns1), false, true); result != nil {
+		if expected != string(result.Content) {
+			t.Fatalf("Failed allowLocalhostDNS=true with IPv6 disabled: expected \n<%s> got \n<%s>", expected, string(result.Content))
+		}
+	}
+
+	// Test 8: allowLocalhostDNS=true with only localhost and no external DNS, IPv6 enabled
+	// should preserve localhost even though we would normally add defaults
+	ns1 = "nameserver 127.0.0.1\nnameserver ::1\n"
+	expected = "nameserver 127.0.0.1\nnameserver ::1\n"
+	if result, _ := FilterResolvDNSWithLocalhostOption([]byte(ns1), true, true); result != nil {
+		if expected != string(result.Content) {
+			t.Fatalf("Failed allowLocalhostDNS=true with only localhost IPs: expected \n<%s> got \n<%s>", expected, string(result.Content))
+		}
+	}
+
+	// Test 9: allowLocalhostDNS=false with only localhost should fall back to Google DNS (IPv4+IPv6)
+	ns0 := "\nnameserver 8.8.8.8\nnameserver 8.8.4.4\nnameserver 2001:4860:4860::8888\nnameserver 2001:4860:4860::8844"
+	ns1 = "nameserver 127.0.0.1\nnameserver ::1\n"
+	if result, _ := FilterResolvDNSWithLocalhostOption([]byte(ns1), true, false); result != nil {
+		if ns0 != string(result.Content) {
+			t.Fatalf("Failed allowLocalhostDNS=false fallback: expected \n<%s> got \n<%s>", ns0, string(result.Content))
+		}
+	}
+
+	// Test 10: Verify backward compatibility - FilterResolvDNS still filters localhost
+	ns1 = "nameserver 127.0.0.1\nnameserver 10.16.60.14\n"
+	expected = "nameserver 10.16.60.14\n"
+	if result, _ := FilterResolvDNS([]byte(ns1), true); result != nil {
+		if expected != string(result.Content) {
+			t.Fatalf("Failed backward compatibility: expected \n<%s> got \n<%s>", expected, string(result.Content))
+		}
+	}
+}