Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
3715df4
fix: prevent DNS bind-mount from escaping namespace and corrupting host
ammario Nov 2, 2025
0a89b9f
fix: create /etc/netns/<namespace>/ directory before writing resolv.conf
ammario Nov 3, 2025
4d1fab2
fix: create NamespaceConfig resource after writing resolv.conf file
ammario Nov 3, 2025
1fadbda
fix: use mkdir command for more robust directory creation
ammario Nov 3, 2025
b8f4832
fix: use DNAT to intercept all DNS queries
ammario Nov 3, 2025
b518b3a
feat: run DNS server inside namespace for localhost compatibility
ammario Nov 3, 2025
731d015
fix: make test_weak_mode_allows_localhost tolerant of timeouts
ammario Nov 3, 2025
78929a3
fix: bind DNS server to multiple addresses for resolv.conf compatibility
ammario Nov 3, 2025
2581a62
fix: implement two-pronged DNS strategy for robust resolution
ammario Nov 3, 2025
0aea20b
refactor: use /etc/netns/ for DNS resolution (simpler, kernel-native)
ammario Nov 3, 2025
d8b7399
fix: create placeholder /etc/resolv.conf in namespace for bind-mount
ammario Nov 3, 2025
4faad0b
fix: use mount namespace with bind-mount for safe /etc/resolv.conf ha…
ammario Nov 3, 2025
b4a0ec9
fix: directly bind-mount custom resolv.conf over /etc/resolv.conf
ammario Nov 3, 2025
25da027
fix: let ip netns exec handle mount namespace and resolv.conf bind-mount
ammario Nov 3, 2025
76c309a
fix: create symlink target placeholder in ip netns exec mount namespace
ammario Nov 3, 2025
95ed568
fix: use nsenter + unshare for manual bind-mount control
ammario Nov 3, 2025
58139da
fix: mount to resolved symlink target path using readlink
ammario Nov 3, 2025
e252e3f
fix: revert to simple ip netns exec with documented limitations
ammario Nov 3, 2025
98046b1
✨🎉🔧 FIX: unmount bind-mount on symlinked resolv.conf during cleanup 🎉✨
ammario Nov 3, 2025
e06724b
refactor: DRY cleanup and improved documentation for NetnsResolv
ammario Nov 3, 2025
9b00a97
fix: reorder struct fields to ensure proper cleanup order
ammario Nov 3, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions src/jail/linux/dns.rs
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,12 @@ pub struct DummyDnsServer {
thread_handle: Option<thread::JoinHandle<()>>,
}

impl Default for DummyDnsServer {
fn default() -> Self {
Self::new()
}
}

impl DummyDnsServer {
pub fn new() -> Self {
Self {
Expand Down Expand Up @@ -141,6 +147,10 @@ fn build_dummy_response(query: Packet<'_>) -> Result<Vec<u8>> {
.map_err(|e| anyhow::anyhow!("Failed to build DNS response: {}", e))
}

// Note: The run_dns_server_blocking function has been removed as we no longer spawn
// separate DNS server processes inside the namespace. Instead, we mount a custom
// /etc/resolv.conf that points to the host DNS server, which is simpler and more robust.

#[cfg(test)]
mod tests {
use super::*;
Expand Down
Loading