From 0ab5d81a5f5ccd985ca2e4819bb515268a04f2e1 Mon Sep 17 00:00:00 2001 From: Bruce Ashfield Date: Thu, 4 Jun 2026 03:16:13 +0000 Subject: podman: switch from CNI to netavark as sole network backend MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Podman's vendored containers/common library removed CNI support entirely in commit 8d1f636e40 (March 2026). The NetworkBackend() function now unconditionally rejects any backend other than netavark, making network_backend = "cni" in containers.conf a runtime error. The vpdmn rootfs originally used CNI because netavark's dependency chain (nmap -> libpcap -> bluez5 -> cairo) was too heavy for the vruntime BBMASK environment. That dependency chain no longer exists — netavark v1.16.0+ uses a built-in Rust connection tester and has no heavyweight runtime dependencies. Recipe changes: - Clear BUILDTAGS_EXTRA default (was CNI build tag, now a no-op) - Set VIRTUAL-RUNTIME_container_networking and _container_dns with strong assignments so podman always RDEPENDS on netavark and aardvark-dns regardless of distro config - Remove ${sysconfdir}/cni from FILES vpdmn rootfs changes: - Replace cni with netavark + aardvark-dns in IMAGE_INSTALL - Update containers.conf network_backend from cni to netavark Signed-off-by: Bruce Ashfield --- conf/distro/include/meta-virt-container-podman.inc | 2 ++ recipes-containers/podman/podman_git.bb | 18 +++++++++--------- recipes-containers/vcontainer/vpdmn-rootfs-image.bb | 9 +++------ 3 files changed, 14 insertions(+), 15 deletions(-) diff --git a/conf/distro/include/meta-virt-container-podman.inc b/conf/distro/include/meta-virt-container-podman.inc index b57eaaca..96ea7d7b 100644 --- a/conf/distro/include/meta-virt-container-podman.inc +++ b/conf/distro/include/meta-virt-container-podman.inc @@ -2,6 +2,8 @@ include meta-virt-container.inc VIRTUAL-RUNTIME_container_engine ?= "podman" VIRTUAL-RUNTIME_container_runtime ?= "crun" +# netavark is the only supported network backend since podman 6.0 +# (containers/common removed CNI support entirely) VIRTUAL-RUNTIME_container_networking ?= "netavark" VIRTUAL-RUNTIME_container_dns ?= "aardvark-dns" VIRTUAL-RUNTIME_container_orchestration ?= "" diff --git a/recipes-containers/podman/podman_git.bb b/recipes-containers/podman/podman_git.bb index 75e2fae3..36c80c0e 100644 --- a/recipes-containers/podman/podman_git.bb +++ b/recipes-containers/podman/podman_git.bb @@ -36,13 +36,10 @@ PACKAGES =+ "${PN}-contrib" PODMAN_PKG = "github.com/containers/podman" -# Include the cni build tag unless the distro explicitly selects netavark-only. -# The runtime backend is selected via containers.conf (network_backend), -# but podman must be compiled with the cni tag to support it at all. -# Previously this was gated on VIRTUAL-RUNTIME_container_networking == "cni", -# which excluded cni in vruntime builds where that variable is intentionally -# blank (vpdmn-rootfs-image installs cni packages directly in IMAGE_INSTALL). -BUILDTAGS_EXTRA ?= "${@'' if d.getVar('VIRTUAL-RUNTIME_container_networking') == 'netavark' else 'cni'}" +# Podman's vendored containers/common library removed CNI support entirely +# (commit 8d1f636e40, March 2026). The network backend is now unconditionally +# netavark — the cni build tag is a no-op. +BUILDTAGS_EXTRA ?= "" BUILDTAGS ?= "seccomp varlink \ ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', '', d)} \ exclude_graphdriver_btrfs exclude_graphdriver_devicemapper ${BUILDTAGS_EXTRA}" @@ -137,7 +134,6 @@ FILES:${PN} += " \ ${systemd_user_unitdir}/* \ ${nonarch_libdir}/tmpfiles.d/* \ ${datadir}/user-tmpfiles.d/* \ - ${sysconfdir}/cni \ " SYSTEMD_SERVICE:${PN} = "podman.service podman.socket" @@ -148,9 +144,13 @@ VIRTUAL-RUNTIME_base-utils-nsenter ?= "util-linux-nsenter" COMPATIBLE_HOST = "^(?!mips).*" +# netavark is the only supported network backend since podman 6.0 +VIRTUAL-RUNTIME_container_networking = "netavark" +VIRTUAL-RUNTIME_container_dns = "aardvark-dns" + RDEPENDS:${PN} += "\ catatonit conmon ${VIRTUAL-RUNTIME_container_runtime} gpgme iptables libdevmapper \ - ${VIRTUAL-RUNTIME_container_dns} ${VIRTUAL-RUNTIME_container_networking} ${VIRTUAL-RUNTIME_base-utils-nsenter} \ + ${VIRTUAL-RUNTIME_container_networking} ${VIRTUAL-RUNTIME_container_dns} ${VIRTUAL-RUNTIME_base-utils-nsenter} \ " RRECOMMENDS:${PN} += "slirp4netns \ kernel-module-xt-masquerade \ diff --git a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb index f061ce08..cca9191f 100644 --- a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb +++ b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb @@ -50,7 +50,8 @@ IMAGE_INSTALL = " \ crun \ skopeo \ conmon \ - cni \ + netavark \ + aardvark-dns \ busybox \ iproute2 \ iptables \ @@ -121,13 +122,9 @@ additionalimagestores = [] EOF # Create containers.conf for podman engine settings - # Use CNI instead of netavark — netavark's dependency chain - # (nmap → libpcap → bluez5 → python3-pygobject → cairo) is too - # heavy for the vruntime BBMASK environment. cat > ${IMAGE_ROOTFS}/etc/containers/containers.conf << 'EOF' [network] -network_backend = "cni" -cni_plugin_dirs = ["/opt/cni/bin", "/usr/libexec/cni"] +network_backend = "netavark" EOF # Prevent libnss_systemd segfaults — systemd is not running in the -- cgit v1.2.3-54-g00ecf