Merge pull request containerd#4309 from haytok/fix_network_results_by_nerdctl_network_inspect

fix: display containers belonging to multiple networks in nerdctl network inspect

Author: fahedouch

cmd/nerdctl/network/network_inspect_test.go

@@ -320,6 +320,39 @@ func TestNetworkInspect(t *testing.T) {
 				}
 			},
 		},
+		{
+			Description: "Display containers belonging to multiple networks in the output of nerdctl network inspect",
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("network", "create", data.Identifier("nginx-network-1"))
+				helpers.Ensure("network", "create", data.Identifier("nginx-network-2"))
+
+				helpers.Ensure("run", "-d", "--name", data.Identifier(), "--network", data.Identifier("nginx-network-1"), "--network", data.Identifier("nginx-network-2"), testutil.NginxAlpineImage)
+
+				data.Labels().Set("containerID", strings.Trim(helpers.Capture("inspect", data.Identifier(), "--format", "{{.Id}}"), "\n"))
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier())
+				helpers.Anyhow("network", "remove", data.Identifier("nginx-network-1"))
+				helpers.Anyhow("network", "remove", data.Identifier("nginx-network-2"))
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("network", "inspect", data.Identifier("nginx-network-1"))
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: func(stdout string, info string, t *testing.T) {
+						var dc []dockercompat.Network
+						err := json.Unmarshal([]byte(stdout), &dc)
+
+						assert.NilError(t, err, "Unable to unmarshal output\n"+info)
+						assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
+						assert.Equal(t, dc[0].Name, data.Identifier("nginx-network-1"))
+						assert.Equal(t, 1, len(dc[0].Containers), "Expected a single container as per configuration, but got multiple.")
+						assert.Equal(t, data.Identifier(), dc[0].Containers[data.Labels().Get("containerID")].Name)
+					},
+				}
+			},
+		},
 	}
 
 	testCase.Run(t)

pkg/cmd/network/inspect.go

@@ -21,6 +21,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 
 	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/log"
@@ -58,16 +59,14 @@ func Inspect(ctx context.Context, client *containerd.Client, options types.Netwo
 		}
 
 		network := netList[0]
-		var filters = []string{fmt.Sprintf("labels.%q==%q", labels.Networks, []string{network.Name})}
 
+		var filters = []string{fmt.Sprintf("labels.%q~=%q", labels.Networks, network.Name)}
 		filteredContainers, err := client.Containers(ctx, filters...)
-
 		if err != nil {
 			return err
 		}
 
 		var containers []*native.Container
-
 		for _, container := range filteredContainers {
 			nativeContainer, err := containerinspector.Inspect(ctx, container)
 			if err != nil {
@@ -76,7 +75,14 @@ func Inspect(ctx context.Context, client *containerd.Client, options types.Netwo
 			if nativeContainer.Process == nil || nativeContainer.Process.Status.Status != containerd.Running {
 				continue
 			}
-			containers = append(containers, nativeContainer)
+
+			isNetworkMember, err := isContainerInNetwork(ctx, container, network.Name)
+			if err != nil {
+				return err
+			}
+			if isNetworkMember {
+				containers = append(containers, nativeContainer)
+			}
 		}
 
 		r := &native.Network{
@@ -113,3 +119,20 @@ func Inspect(ctx context.Context, client *containerd.Client, options types.Netwo
 
 	return err
 }
+
+func isContainerInNetwork(ctx context.Context, container containerd.Container, networkName string) (bool, error) {
+	info, err := container.Info(ctx)
+	if err != nil {
+		return false, err
+	}
+	networkLabels, ok := info.Labels[labels.Networks]
+	if !ok {
+		return false, nil
+	}
+
+	var containerNetworks []string
+	if err := json.Unmarshal([]byte(networkLabels), &containerNetworks); err != nil {
+		return false, err
+	}
+	return slices.Contains(containerNetworks, networkName), nil
+}