fix: display containers belonging to multiple networks in nerdctl network inspect

When a container belongs to multiple networks, running the nerdctl network
inspect command on the network to which the container belongs does not
display the container in the current implementation.

Specifically, it is displayed as follows.

```
$ sudo nerdctl run -d --name net --net=foo --net=bar nginx
d88e878f0c60823bd0c361bad250f27b19ad117fb3336fcf18fa26ab1910c367

$ sudo nerdctl network inspect foo | jq .[0].Containers
{}

$ sudo nerdctl network inspect bar | jq .[0].Containers
{}
```

Ideally, running the nerdctl network inspect command on the networks to
which the contaienr belongs should display the container name as follows.

```
$ sudo nerdctl network inspect foo | jq .[0].Containers
{
  "d88e878f0c60823bd0c361bad250f27b19ad117fb3336fcf18fa26ab1910c367": {
    "Name": "net"
  }
}

$ sudo nerdctl network inspect bar | jq .[0].Containers
{
  "d88e878f0c60823bd0c361bad250f27b19ad117fb3336fcf18fa26ab1910c367": {
    "Name": "net"
  }
}
```

Therefore, this behaviour is fixed in this PR.

Signed-off-by: Hayato Kiwata <[email protected]>

Author: haytok

cmd/nerdctl/network/network_inspect_test.go

@@ -320,6 +320,39 @@ func TestNetworkInspect(t *testing.T) {
 				}
 			},
 		},
+		{
+			Description: "Display containers belonging to multiple networks in the output of nerdctl network inspect",
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("network", "create", data.Identifier("nginx-network-1"))
+				helpers.Ensure("network", "create", data.Identifier("nginx-network-2"))
+
+				helpers.Ensure("run", "-d", "--name", data.Identifier(), "--network", data.Identifier("nginx-network-1"), "--network", data.Identifier("nginx-network-2"), testutil.NginxAlpineImage)
+
+				data.Labels().Set("containerID", strings.Trim(helpers.Capture("inspect", data.Identifier(), "--format", "{{.Id}}"), "\n"))
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier())
+				helpers.Anyhow("network", "remove", data.Identifier("nginx-network-1"))
+				helpers.Anyhow("network", "remove", data.Identifier("nginx-network-2"))
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("network", "inspect", data.Identifier("nginx-network-1"))
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: func(stdout string, info string, t *testing.T) {
+						var dc []dockercompat.Network
+						err := json.Unmarshal([]byte(stdout), &dc)
+
+						assert.NilError(t, err, "Unable to unmarshal output\n"+info)
+						assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
+						assert.Equal(t, dc[0].Name, data.Identifier("nginx-network-1"))
+						assert.Equal(t, 1, len(dc[0].Containers), "Expected a single container as per configuration, but got multiple.")
+						assert.Equal(t, data.Identifier(), dc[0].Containers[data.Labels().Get("containerID")].Name)
+					},
+				}
+			},
+		},
 	}
 
 	testCase.Run(t)

pkg/cmd/network/inspect.go

@@ -21,6 +21,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 
 	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/log"
@@ -58,16 +59,14 @@ func Inspect(ctx context.Context, client *containerd.Client, options types.Netwo
 		}
 
 		network := netList[0]
-		var filters = []string{fmt.Sprintf("labels.%q==%q", labels.Networks, []string{network.Name})}
 
+		var filters = []string{fmt.Sprintf("labels.%q~=%q", labels.Networks, network.Name)}
 		filteredContainers, err := client.Containers(ctx, filters...)
-
 		if err != nil {
 			return err
 		}
 
 		var containers []*native.Container
-
 		for _, container := range filteredContainers {
 			nativeContainer, err := containerinspector.Inspect(ctx, container)
 			if err != nil {
@@ -76,7 +75,14 @@ func Inspect(ctx context.Context, client *containerd.Client, options types.Netwo
 			if nativeContainer.Process == nil || nativeContainer.Process.Status.Status != containerd.Running {
 				continue
 			}
-			containers = append(containers, nativeContainer)
+
+			isNetworkMember, err := isContainerInNetwork(ctx, container, network.Name)
+			if err != nil {
+				return err
+			}
+			if isNetworkMember {
+				containers = append(containers, nativeContainer)
+			}
 		}
 
 		r := &native.Network{
@@ -113,3 +119,20 @@ func Inspect(ctx context.Context, client *containerd.Client, options types.Netwo
 
 	return err
 }
+
+func isContainerInNetwork(ctx context.Context, container containerd.Container, networkName string) (bool, error) {
+	info, err := container.Info(ctx)
+	if err != nil {
+		return false, err
+	}
+	networkLabels, ok := info.Labels[labels.Networks]
+	if !ok {
+		return false, nil
+	}
+
+	var containerNetworks []string
+	if err := json.Unmarshal([]byte(networkLabels), &containerNetworks); err != nil {
+		return false, err
+	}
+	return slices.Contains(containerNetworks, networkName), nil
+}