From aff568316503f774aa0fbdd183ea66b062a95a37 Mon Sep 17 00:00:00 2001 From: Antigravity Agent Date: Sat, 3 Oct 2026 01:48:33 -0400 Subject: [PATCH] NetVM: replace resolv.conf symlink with real file (bwrap-safe DNS fix) --- bin/netvm-enter-inner.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/bin/netvm-enter-inner.sh b/bin/netvm-enter-inner.sh index bdd47a1..fb369a3 100755 --- a/bin/netvm-enter-inner.sh +++ b/bin/netvm-enter-inner.sh @@ -1,6 +1,11 @@ #!/usr/bin/env bash # runs as root inside the netns + a private mount ns; drops privs, execs cmd. set -euo pipefail -mount --bind "$NETVM_RESOLV" /etc/resolv.conf +# /etc/resolv.conf is a symlink to the systemd stub (127.0.0.53, unreachable +# in the netns). Replace with a real file (private mount ns) so bwrap +# children see the fix too: bwrap's --ro-bind /etc is non-recursive and +# cannot bind over a dangling symlink. +rm -f /etc/resolv.conf +cp "$NETVM_RESOLV" /etc/resolv.conf exec setpriv --reuid="$NETVM_UID" --regid="$NETVM_GID" --clear-groups \ env HOME="$NETVM_HOME" "$@"