From 6404f2a1096942fcd04bada6856a87de7e788198 Mon Sep 17 00:00:00 2001 From: Steve Date: Sat, 15 Aug 2026 09:55:52 +0100 Subject: [PATCH] fix(dns): avoid global resolver search domains Keep scoped /etc/resolver entries limited to their configured domain. Omitting the search directive prevents unrelated bare hostnames from being expanded through a stopped container DNS service. Fixes #1917 --- .../Services/ContainerAPIService/Client/HostDNSResolver.swift | 1 - Tests/ContainerAPIClientTests/HostDNSResolverTest.swift | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/Sources/Services/ContainerAPIService/Client/HostDNSResolver.swift b/Sources/Services/ContainerAPIService/Client/HostDNSResolver.swift index a72b04dc6..590997181 100644 --- a/Sources/Services/ContainerAPIService/Client/HostDNSResolver.swift +++ b/Sources/Services/ContainerAPIService/Client/HostDNSResolver.swift @@ -66,7 +66,6 @@ public struct HostDNSResolver { } ?? "" let resolverText = """ domain \(name) - search \(name) nameserver 127.0.0.1 port \(dnsPort) \(options) diff --git a/Tests/ContainerAPIClientTests/HostDNSResolverTest.swift b/Tests/ContainerAPIClientTests/HostDNSResolverTest.swift index 4f955172a..3fa057a85 100644 --- a/Tests/ContainerAPIClientTests/HostDNSResolverTest.swift +++ b/Tests/ContainerAPIClientTests/HostDNSResolverTest.swift @@ -42,13 +42,13 @@ struct HostDNSResolverTest { let actualText = try String(contentsOfFile: resolverConfigPath.string, encoding: .utf8) let expectedText = """ domain foo.bar - search foo.bar nameserver 127.0.0.1 port 2053 """ #expect(actualText == expectedText) + #expect(!actualText.split(separator: "\n").contains { $0.hasPrefix("search ") }) try resolver.createDomain(name: try! DNSName("bar.foo")) let domains = resolver.listDomains()