How to disable inheriting host DNS server?

[baodrate]

man 5 containers.conf states:

dns_servers=[]
A list of dns servers to override the DNS configuration passed to the container.

I understood that to mean that /etc/resolv.conf inside the container should contain exclusively the dns servers specified in that configuration setting. But

$ podman run -it --rm ubuntu cat /etc/resolv.conf
search host.domain.tld
nameserver 169.254.1.1
nameserver 192.168.1.254
options edns0 trust-ad

Where 169.254.1.1 is the sole address in the dns_servers array in containers.conf and 192.168.1.254 is the dns server inherited from the host.

Is there a way I can disable this behavior so that the container's resolv.conf points exclusively at the configured dns_servers?

[Luap99]

What version are you running? Please provide podman info.

I understood that to mean that /etc/resolv.conf inside the container should contain exclusively the dns servers specified in that configuration setting.

This is correct, if it adds host resolvers in this case it is a bug.

[baodrate]

Version 4.4.2 running on Arch. podman info:

host:
  arch: amd64
  buildahVersion: 1.29.0
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - hugetlb
  - pids
  - rdma
  - misc
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: /usr/bin/conmon is owned by conmon 1:2.1.7-1
    path: /usr/bin/conmon
    version: 'conmon version 2.1.7, commit: f633919178f6c8ee4fb41b848a056ec33f8d707d'
  cpuUtilization:
    idlePercent: 87.09
    systemPercent: 4.63
    userPercent: 8.28
  cpus: 4
  distribution:
    distribution: arch
    version: unknown
  eventLogger: journald
  hostname: xavin
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 6.2.2-arch1-1
  linkmode: dynamic
  logDriver: journald
  memFree: 999182336
  memTotal: 8324898816
  networkBackend: netavark
  ociRuntime:
    name: crun
    package: /usr/bin/crun is owned by crun 1.8.1-1
    path: /usr/bin/crun
    version: |-
      crun version 1.8.1
      commit: f8a096be060b22ccd3d5f3ebe44108517fbf6c30
      rundir: /run/user/0/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /etc/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: /usr/bin/slirp4netns is owned by slirp4netns 1.2.0-1
    version: |-
      slirp4netns version 1.2.0
      commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.4
  swapFree: 3961778176
  swapTotal: 4162318336
  uptime: 26h 53m 20.00s (Approximately 1.08 days)
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  cr.hotio.dev:
    Blocked: false
    Insecure: false
    Location: cr.hotio.dev
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: registry-mirror-hotio.services.lumpen.party
      PullFromMirror: ""
    Prefix: cr.hotio.dev
    PullFromMirror: ""
  cr.portainer.io:
    Blocked: false
    Insecure: false
    Location: cr.portainer.io
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: registry-mirror-portainer.services.lumpen.party
      PullFromMirror: ""
    Prefix: cr.portainer.io
    PullFromMirror: ""
  docker.elastic.co:
    Blocked: false
    Insecure: false
    Location: docker.elastic.co
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: registry-mirror-elastic.services.lumpen.party
      PullFromMirror: ""
    Prefix: docker.elastic.co
    PullFromMirror: ""
  docker.io:
    Blocked: false
    Insecure: false
    Location: registry-1.docker.io
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: registry-mirror-docker.services.lumpen.party
      PullFromMirror: ""
    - Insecure: true
      Location: registry-mirror-docker.service.consul:5001
      PullFromMirror: ""
    Prefix: docker.io
    PullFromMirror: ""
  ghcr.io:
    Blocked: false
    Insecure: false
    Location: ghcr.io
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: registry-mirror-ghcr.services.lumpen.party
      PullFromMirror: ""
    Prefix: ghcr.io
    PullFromMirror: ""
  lscr.io:
    Blocked: false
    Insecure: false
    Location: lscr.io
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: registry-mirror-lscr.services.lumpen.party
      PullFromMirror: ""
    Prefix: lscr.io
    PullFromMirror: ""
  quay.io:
    Blocked: false
    Insecure: false
    Location: quay.io
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: registry-mirror-quay.services.lumpen.party
      PullFromMirror: ""
    Prefix: quay.io
    PullFromMirror: ""
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 16
    paused: 0
    running: 16
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 30813401088
  graphRootUsed: 7093399552
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "true"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 22
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 4.4.2
  Built: 1677255177
  BuiltTime: Fri Feb 24 10:12:57 2023
  GitCommit: 74afe26887f814d1c39925a1624851ef3590e79c-dirty
  GoVersion: go1.20.1
  Os: linux
  OsArch: linux/amd64
  Version: 4.4.2

[Luap99]

I think I already fixed the bug in #17578
Should be fixed with the next release 4.4.3 next week.

[baodrate]

I think I already fixed the bug in #17578
Should be fixed with the next release 4.4.3 next week.

oh wow thanks. I'll see if I can build and test it out locally

[baodrate]

can confirm that this is no longer an issue on the main branch