NetVM: replace resolv.conf symlink with real file (bwrap-safe DNS fix)

2026-10-03 01:48:33 -04:00
parent 1d79a69cec
commit aff5683165
1 changed files with 6 additions and 1 deletions
@@ -1,6 +1,11 @@
 #!/usr/bin/env bash
 # runs as root inside the netns + a private mount ns; drops privs, execs cmd.
 set -euo pipefail
-mount --bind "$NETVM_RESOLV" /etc/resolv.conf
+# /etc/resolv.conf is a symlink to the systemd stub (127.0.0.53, unreachable
+# in the netns). Replace with a real file (private mount ns) so bwrap
+# children see the fix too: bwrap's --ro-bind /etc is non-recursive and
+# cannot bind over a dangling symlink.
+rm -f /etc/resolv.conf
+cp "$NETVM_RESOLV" /etc/resolv.conf
 exec setpriv --reuid="$NETVM_UID" --regid="$NETVM_GID" --clear-groups \
  env HOME="$NETVM_HOME" "$@"