Skip to content

Conversation

thaJeztah
Copy link
Member

@thaJeztah thaJeztah commented Jul 15, 2025

executor/oci: add fork of moby resolvconf (does not compile)

Add a fork of github.com/docker/docker/daemon/libnetwork/internal/resolvconf,
taken at commit 254f64ded64027db0d2d1531a8ef9015de68e2f2. I did not
preserve git history for this one (just a copy), but history can be found
in the Moby repository if needed.

executor/oci: use fork of libnetwork/resolvconf

Rewrite the resolvconf code to use libnetwork's internal packege, which
allows us to skip some of the moby-specific handling (writing to a file,
creating a hash of the file to detect changes made by the user (not
supported by BuildKit, which always mounts read-only).

This rewrite also allows us to skip GetNameservers, GetSearchDomains, GetOptions,
and FilterResolvDNS, which repeatedly would parse the resolvconf file for
each of them.

The new code parses the original resolvconf once, after which mutations
(overrides) are done in memory, after which we generate the resolv.conf to
write to disk.

@github-actions github-actions bot added area/dependencies Pull requests that update a dependency file area/executor labels Jul 15, 2025
@thaJeztah
Copy link
Member Author

thaJeztah commented Jul 15, 2025

Just a quick draft, because I was curious what it would look like /cc @robmry

Also curious if this could help with this issue that was reported;

edit: wrong link on my clipboard 😂

@thaJeztah

This comment was marked as resolved.

Comment on lines 423 to 461
// systemError implements [github.com/docker/docker/errdefs.ErrSystem].
//
// We don't use the errdefs helpers here, because the resolvconf package
// is imported in BuildKit, and this is the only location that used the
// errdefs package outside of the client.
type errSystem struct{ error }
type systemError struct{ error }
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could probably use containerd/errdefs now

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have our own Internal() classifier for such wrapping (integrated with the same System interface).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, that's the errdefs one? I can replace it for that.

This PR was a quick write up; still needs some cleaning up.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated to use buildkit's errdefs

"path/filepath"

"github.com/docker/docker/libnetwork/resolvconf"
"github.com/moby/buildkit/executor/oci/internal/resolvconf"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure why we need this resolvconf package? Can we not just put content of this package directly here and make functions private?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if that would help much; generally in go, the package name is part of the name; separate package makes it nice an isolated (resolvconf.Parse) the alternative would be resolveconfParse etc.

I also tried to keep it as it's in moby for now; also discussing with @robmry if we possibly should consider moving the internal/ package in moby to a separate module, because it's quite generic, with some small parts that were written for legacy bits.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We usually try to avoid internal as enforced visibility in BuildKit but we can look at this as follow-up.

Copy link
Member

@tonistiigi tonistiigi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@crazy-max If we are going to go ahead with this (when outside of draft) then carry to remove internal, and in later follow-up should try to remove dependency of text/template as that pkg should be considered harmful, and don't want new dependencies to it.

@thaJeztah
Copy link
Member Author

Ah, yes there's some template in this one; I haven't looked yet if it's easy to replace, but I don't think anyone would object against already doing so in moby/moby (I think it's a fixed template, so nothing customizable, so I'd be 👍 to replace it)

@thaJeztah
Copy link
Member Author

thaJeztah commented Jul 16, 2025

@tonistiigi gave it a go, for fun;

Before/After:

BenchmarkGenerate-10       42550     27439 ns/op    18083 B/op    394 allocs/op
BenchmarkGenerate-10     3148328       373 ns/op      712 B/op      7 allocs/op

@thaJeztah thaJeztah force-pushed the fork_resolvconf branch 2 times, most recently from 0ef1546 to 2a0a71d Compare July 17, 2025 11:14
@thaJeztah thaJeztah force-pushed the fork_resolvconf branch 4 times, most recently from 9f27461 to 3f7d11f Compare July 17, 2025 12:55
@thaJeztah thaJeztah marked this pull request as ready for review July 17, 2025 13:23
@thaJeztah
Copy link
Member Author

@tonistiigi @crazy-max I think this is ready for review PTAL

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't use github.com/containerd/log but github.com/moby/buildkit/util/bklog:

log.G(context.TODO()).Infof("detected 127.0.0.53 nameserver, assuming systemd-resolved, so using resolv.conf: %s", alternatePath)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated 👍

"path/filepath"

"github.com/docker/docker/libnetwork/resolvconf"
"github.com/moby/buildkit/executor/oci/internal/resolvconf"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We usually try to avoid internal as enforced visibility in BuildKit but we can look at this as follow-up.

Add a fork of github.com/docker/docker/daemon/libnetwork/internal/resolvconf,
taken at commit [254f64ded64027db0d2d1531a8ef9015de68e2f2]. I did not
preserve git history for this one (just a copy), but history can be found
in the Moby repository if needed.

[254f64ded64027db0d2d1531a8ef9015de68e2f2]: moby/moby@254f64d

Signed-off-by: Sebastiaan van Stijn <[email protected]>
Rewrite the resolvconf code to use libnetwork's internal packege, which
allows us to skip some of the moby-specific handling (writing to a file,
creating a hash of the file to detect changes made by the user (not
supported by BuildKit, which always mounts read-only).

This rewrite also allows us to skip GetNameservers, GetSearchDomains, GetOptions,
and FilterResolvDNS, which repeatedly would parse the resolvconf file for
each of them.

The new code parses the original resolvconf once, after which mutations
(overrides) are done in memory, after which we generate the resolv.conf to
write to disk.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah
Copy link
Member Author

We usually try to avoid internal as enforced visibility in BuildKit but we can look at this as follow-up.

Mostly wanted to keep our options open here, in case things get moved.

@tonistiigi tonistiigi merged commit 3d43066 into moby:master Jul 22, 2025
168 of 169 checks passed
@thaJeztah thaJeztah deleted the fork_resolvconf branch July 22, 2025 08:29
@crazy-max crazy-max added this to the v0.24.0 milestone Aug 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/dependencies Pull requests that update a dependency file area/executor area/testing
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants