Update existing networks after network quadlet has changed

[xoxys]

At the moment, podman does not seem to be able to automatically update existing podman networks after modifying the corresponding .network quadlet. Looking at /run/systemd/generator/*-network.service, it runs /usr/bin/podman network create --ignore, which silently fails if the network exists.

After podman network update was added to Podman 4.5, would it be possible to make network updates work through quadlet changes?

[rhatdan]

@ygalblum @Luap99 WDYT?

[Luap99]

It does not silently fail, it does exactly what is asked. Create or ignore if it already exists.

The problem is that networks cannot be bound to the same systemd life cycle as containers. A single network can be used by multiple containers so we cannot really remove it after all containers are stopped as this would be very racy.

Manually stopping all containers that use that network then removing the network and then restart the container units again should make it work but is not very nice. I don't think there is a good solution for this.

[xoxys]

It does not fail silently, but does exactly what is asked. Create it or ignore it if it already exists.

Sure, but that service file is automatically generated, more or less transparent to the end user. That's why a user might not know that --ignore is being used. My first thought was, if I create the network via a .network file.

The problem is that networks cannot be bound to the same systemd life cycle as containers. A single network can be used by multiple containers so we cannot really remove it after all containers are stopped as this would be very racy.

Make sense to me, I thought podman network update might be able to update networks in-place but after reading the docs again this was also a misunderstanding as only DNS updates seems to be supported.

In any case, thanks for your feedback 👍

[Luap99]

Yeah I think the quadlet docs needs to be updated to mentioned that changes are not propagated to the network until it is manually removed by a user.

[Luap99]

Current wording is

The generated service is a one-time command that ensures
that the network exists on the host, creating it if needed.

This may give a hit but we should document the behavior more explicitly.

[xoxys]

In that case, that's my fault. Totally missed that.