podman: switch from CNI to netavark as sole network backend

Podman's vendored containers/common library removed CNI support
entirely in commit 8d1f636e40 (March 2026). The NetworkBackend()
function now unconditionally rejects any backend other than netavark,
making network_backend = "cni" in containers.conf a runtime error.

The vpdmn rootfs originally used CNI because netavark's dependency
chain (nmap -> libpcap -> bluez5 -> cairo) was too heavy for the
vruntime BBMASK environment. That dependency chain no longer exists
— netavark v1.16.0+ uses a built-in Rust connection tester and has
no heavyweight runtime dependencies.

Recipe changes:
- Clear BUILDTAGS_EXTRA default (was CNI build tag, now a no-op)
- Set VIRTUAL-RUNTIME_container_networking and _container_dns with
  strong assignments so podman always RDEPENDS on netavark and
  aardvark-dns regardless of distro config
- Remove ${sysconfdir}/cni from FILES

vpdmn rootfs changes:
- Replace cni with netavark + aardvark-dns in IMAGE_INSTALL
- Update containers.conf network_backend from cni to netavark

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

3 files changed, 14 insertions, 15 deletions

diff --git a/conf/distro/include/meta-virt-container-podman.inc b/conf/distro/include/meta-virt-container-podman.inc
index b57eaaca..96ea7d7b 100644
--- a/conf/distro/include/meta-virt-container-podman.inc
+++ b/conf/distro/include/meta-virt-container-podman.inc
@@ -2,6 +2,8 @@ include meta-virt-container.inc
 
 VIRTUAL-RUNTIME_container_engine ?= "podman"
 VIRTUAL-RUNTIME_container_runtime ?= "crun"
+# netavark is the only supported network backend since podman 6.0
+# (containers/common removed CNI support entirely)
 VIRTUAL-RUNTIME_container_networking ?= "netavark"
 VIRTUAL-RUNTIME_container_dns ?= "aardvark-dns"
 VIRTUAL-RUNTIME_container_orchestration ?= ""
diff --git a/recipes-containers/podman/podman_git.bb b/recipes-containers/podman/podman_git.bb
index 75e2fae3..36c80c0e 100644
--- a/recipes-containers/podman/podman_git.bb
+++ b/recipes-containers/podman/podman_git.bb
@@ -36,13 +36,10 @@ PACKAGES =+ "${PN}-contrib"
 
 PODMAN_PKG = "github.com/containers/podman"
 
-# Include the cni build tag unless the distro explicitly selects netavark-only.
-# The runtime backend is selected via containers.conf (network_backend),
-# but podman must be compiled with the cni tag to support it at all.
-# Previously this was gated on VIRTUAL-RUNTIME_container_networking == "cni",
-# which excluded cni in vruntime builds where that variable is intentionally
-# blank (vpdmn-rootfs-image installs cni packages directly in IMAGE_INSTALL).
-BUILDTAGS_EXTRA ?= "${@'' if d.getVar('VIRTUAL-RUNTIME_container_networking') == 'netavark' else 'cni'}"
+# Podman's vendored containers/common library removed CNI support entirely
+# (commit 8d1f636e40, March 2026). The network backend is now unconditionally
+# netavark — the cni build tag is a no-op.
+BUILDTAGS_EXTRA ?= ""
 BUILDTAGS ?= "seccomp varlink \
 ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', '', d)} \
 exclude_graphdriver_btrfs exclude_graphdriver_devicemapper ${BUILDTAGS_EXTRA}"
@@ -137,7 +134,6 @@ FILES:${PN} += " \
     ${systemd_user_unitdir}/* \
     ${nonarch_libdir}/tmpfiles.d/* \
     ${datadir}/user-tmpfiles.d/* \
-    ${sysconfdir}/cni \
 "
 
 SYSTEMD_SERVICE:${PN} = "podman.service podman.socket"
@@ -148,9 +144,13 @@ VIRTUAL-RUNTIME_base-utils-nsenter ?= "util-linux-nsenter"
 
 COMPATIBLE_HOST = "^(?!mips).*"
 
+# netavark is the only supported network backend since podman 6.0
+VIRTUAL-RUNTIME_container_networking = "netavark"
+VIRTUAL-RUNTIME_container_dns = "aardvark-dns"
+
 RDEPENDS:${PN} += "\
         catatonit conmon ${VIRTUAL-RUNTIME_container_runtime} gpgme iptables libdevmapper \
-        ${VIRTUAL-RUNTIME_container_dns} ${VIRTUAL-RUNTIME_container_networking} ${VIRTUAL-RUNTIME_base-utils-nsenter} \
+        ${VIRTUAL-RUNTIME_container_networking} ${VIRTUAL-RUNTIME_container_dns} ${VIRTUAL-RUNTIME_base-utils-nsenter} \
 "
 RRECOMMENDS:${PN} += "slirp4netns \
                       kernel-module-xt-masquerade \
diff --git a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
index f061ce08..cca9191f 100644
--- a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
+++ b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
@@ -50,7 +50,8 @@ IMAGE_INSTALL = " \
     crun \
     skopeo \
     conmon \
-    cni \
+    netavark \
+    aardvark-dns \
     busybox \
     iproute2 \
     iptables \
@@ -121,13 +122,9 @@ additionalimagestores = []
 EOF
 
     # Create containers.conf for podman engine settings
-    # Use CNI instead of netavark — netavark's dependency chain
-    # (nmap → libpcap → bluez5 → python3-pygobject → cairo) is too
-    # heavy for the vruntime BBMASK environment.
     cat > ${IMAGE_ROOTFS}/etc/containers/containers.conf << 'EOF'
 [network]
-network_backend = "cni"
-cni_plugin_dirs = ["/opt/cni/bin", "/usr/libexec/cni"]
+network_backend = "netavark"
 EOF
 
     # Prevent libnss_systemd segfaults — systemd is not running in the