podman: switch from CNI to netavark as sole network backend

Podman's vendored containers/common library removed CNI support
entirely in commit 8d1f636e40 (March 2026). The NetworkBackend()
function now unconditionally rejects any backend other than netavark,
making network_backend = "cni" in containers.conf a runtime error.

The vpdmn rootfs originally used CNI because netavark's dependency
chain (nmap -> libpcap -> bluez5 -> cairo) was too heavy for the
vruntime BBMASK environment. That dependency chain no longer exists
— netavark v1.16.0+ uses a built-in Rust connection tester and has
no heavyweight runtime dependencies.

Recipe changes:
- Clear BUILDTAGS_EXTRA default (was CNI build tag, now a no-op)
- Set VIRTUAL-RUNTIME_container_networking and _container_dns with
  strong assignments so podman always RDEPENDS on netavark and
  aardvark-dns regardless of distro config
- Remove ${sysconfdir}/cni from FILES

vpdmn rootfs changes:
- Replace cni with netavark + aardvark-dns in IMAGE_INSTALL
- Update containers.conf network_backend from cni to netavark

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 3 insertions, 6 deletions

diff --git a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
index f061ce08..cca9191f 100644
--- a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
+++ b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
@@ -50,7 +50,8 @@ IMAGE_INSTALL = " \
     crun \
     skopeo \
     conmon \
-    cni \
+    netavark \
+    aardvark-dns \
     busybox \
     iproute2 \
     iptables \
@@ -121,13 +122,9 @@ additionalimagestores = []
 EOF
 
     # Create containers.conf for podman engine settings
-    # Use CNI instead of netavark — netavark's dependency chain
-    # (nmap → libpcap → bluez5 → python3-pygobject → cairo) is too
-    # heavy for the vruntime BBMASK environment.
     cat > ${IMAGE_ROOTFS}/etc/containers/containers.conf << 'EOF'
 [network]
-network_backend = "cni"
-cni_plugin_dirs = ["/opt/cni/bin", "/usr/libexec/cni"]
+network_backend = "netavark"
 EOF
 
     # Prevent libnss_systemd segfaults — systemd is not running in the