netavark

Netavark is a Rust-based network stack designed for configuring networking for Linux containers. While primarily designed to work with Podman, it is applicable to other OCI container management applications.

Key capabilities include:

• Configuring container networks via JSON configuration files.
• Managing network interfaces (including MACVLAN).
• Automating firewall configuration for NAT and port forwarding (supporting firewalld and nftables).
• Supporting rootless containers.
• Supporting both IPv4 and IPv6.
• Providing container DNS resolution via the aardvark-dns project.

A netavark plugin is an external binary that must implement a specific set of subcommands used by Podman and netavark to manage container networking. The required subcommands are:

• create: Creates a new network configuration.
• setup: Sets up the network configuration for a container (called when a container starts or connects to a network).
• teardown: Reverts the actions performed by the setup command.
• info: Provides metadata about the plugin, including its version and the supported API version.

The netavark create command requires a JSON configuration object divided into three primary sections:

1. network: Defines the specific configuration for the new network being created.
2. used: Provides context about existing resources (interfaces, names, subnets) to prevent conflicts.
3. options: Contains global creation settings, such as subnet allocation pools and conflict checking behavior.

In firewalld version 2.3.0 and later, the StrictForwardPorts setting in /etc/firewalld/firewalld.conf controls how port forwarding behaves with root Podman.

• When StrictForwardPorts=no (default): Port forwarding with Podman works normally.
• When StrictForwardPorts=yes: Port forwarding with root Podman will fail when using -p or -P options. Rootless Podman is unaffected and continues to function normally.

If StrictForwardPorts is enabled, you must manually manage port forwarding using firewall-cmd instead of relying on Podman's automatic forwarding.

To generate code coverage reports for netavark, you must use the nightly Rust toolchain and install specific helper tools (rustfilt and grcov).

# Enable nightly Rust
rustup override set nightly

# Build the demangler
cargo install rustfilt

# Install Grcov
cargo install grcov

Once the report is generated, you can view it by opening the index.html file in a web browser. After the report is successfully created, you can safely delete the default_*.profraw files to clean up the raw profiling data.

# View the report
firefox target/coverage/index.html

# Cleanup raw profiling data
rm default_*.profraw

Before running the integration tests in test-dhcp/, ensure the following tools are installed in your environment:

• bats (Bash Automated Testing System)
• jq (JSON processor)
• dnsmasq (Lightweight DHCP/DNS server)

To build and publish the Rust image used for verifying the Minimum Supported Rust Version (MSRV) in CI, ensure you have valid quay.io/libpod credentials configured. Use the provided shell script to automate the build and push process.

If you need to update the MSRV, update the version in the Dockerfile.Rust FROM line before running the build script.

./build_and_publish_rust_image.sh

When packaging Netavark, you can use the upstream vendored source tarball (available at https://github.com/containers/netavark/releases/download/v{version}/netavark-v{version}-vendor.tar.gz).

After extracting the tarball, create a .cargo/config file to point Cargo to the vendor directory:

tar xvf %{SOURCE}
mkdir -p .cargo
cat >.cargo/config << EOF
[source.crates-io]
replace-with = "vendored-sources"

[source.vendored-sources]
directory = "vendor"
EOF