fix(network/dns): default-config peer-name DNS resolves (CHAOS-1478)

[chrisgeo]

Summary

• nslookup probe-pg from a sibling container now resolves in the default configuration (no dns.domain set, no sudo, no container system dns create) — previously returned NXDOMAIN.
• The fix is two cooperating layers:
  • Source fix (4 commits, 23ef3d0 → 11d7948): register peer hostnames in their bare form and strip the configured dns.domain suffix at the embedded handler so bare and FQDN queries map to the same allocator key.
  • Routing fix (50f4a43): automate the /etc/resolver/ install at .pkg postinstall time and inject the matching search directive into containers, so VM queries actually traverse the chain to 127.0.0.1:2053.
• AttachmentAllocator gains a normalize helper that strips trailing root-label dots, making bare and FQDN-form keys equivalent at the storage boundary.
• Utility.getAttachmentConfigurations drops the dns.domain-gated FQDN path and always registers the bare containerId; the dnsDomain parameter is removed.
• ContainerDNSHandler receives dns.domain via init and strips both the trailing dot and the configured domain suffix from question.name before calling networkService.lookup, so both nslookup foo and nslookup foo.<dns.domain> resolve correctly.
• DNSConfig.domain defaults to "test" (centralised in defaultDomain); container searchDomains auto-injects [domain] when empty; the .pkg postinstall writes /etc/resolver/containerization.test so the macOS resolver chain forwards *.test queries from vmnet's DNS proxy to the embedded handler.

Why

Today's behavior. Utility.getAttachmentConfigurations gates hostname registration on whether dns.domain is configured. When dns.domain is absent (the default), it stores the bare containerId (e.g., "probe-pg") in AttachmentOptions.hostname. When dns.domain is set, it stores the FQDN form ("probe-pg.containers.local"). Meanwhile, ContainerDNSHandler passes question.name — which the DNS wire format always delivers in canonical FQDN form with a trailing root-label dot ("probe-pg.") — directly to networkService.lookup, which in turn calls AttachmentAllocator.lookup as an exact-string dictionary read. The stored key "probe-pg" never matches the queried key "probe-pg.".

The user-facing failure. Running nslookup probe-pg from a sibling container on the same network returns NXDOMAIN. The container is reachable by IP; the allocation exists in the table. The failure is purely a key-form mismatch. This is the repro documented in CHAOS-1478: two containers on the default network, no dns.domain in ~/.config/container/config.json, bare peer-name lookup fails every time.

Why default-config should just work. Docker's libnetwork registers bare names by default on user-defined networks; nslookup peer resolves without any domain configuration. apple/container has all the architectural pieces — AttachmentAllocator, ContainerDNSHandler, NetworksService.lookup — to do the same. The FQDN gate made the default flow inert: it registered the right key but the handler queried the wrong one. Removing the gate and normalizing at the allocator boundary closes the gap without touching multi-alias plumbing.

Why the source fix alone wasn't enough. Live testing on macOS 26 after the source fix landed showed bare-name resolution still failed. Diagnosis: dig @127.0.0.1 -p 2053 probe-pg. succeeded (the embedded handler did register and answer correctly), but nslookup probe-pg from inside a container still returned NXDOMAIN. Containers send their queries to 192.168.x.1:53 (the vmnet bridge gateway), and vmnet's built-in DNS proxy on :53 forwards unmatched queries to upstream DNS rather than to the embedded handler — so peer names never reached 127.0.0.1:2053 to begin with.

Three architectural options for routing. All evaluated, two ruled out empirically.

	Idea	Verdict
A	Bind embedded handler on 192.168.x.1:53 directly	Infeasible. bind('192.168.x.1', 53) from uid 501 returns EACCES. Privileged port, and com.apple.security.virtualization does not grant :53 binding.
B	UDP forwarder inside container-network-vmnet plugin	Same problem. Plugin runs as the same uid (verified).
C	Auto-install /etc/resolver/<domain> at install time	Works. .pkg postinstall already runs as root; no new runtime sudo prompt; reuses the existing HostDNSResolver-style file format so system dns create / delete tooling composes cleanly.

(macOS 26 does expose vmnet_network_configuration_disable_dns_proxy() (vmnet.h L1244), which would let us silence vmnet's proxy — but that still leaves the handler unable to claim :53, so it does not unblock A or B.)

The routing chain at runtime, after this PR:

VM glibc/musl     appends ".test" via `search` directive
vmnet :53 proxy   forwards `probe-pg.test` to macOS system resolver
macOS resolver    matches /etc/resolver/containerization.test
                  forwards to 127.0.0.1 port 2053
apiserver :2053   strips ".test" (DNSRegistrationKey), looks up bare
                  "probe-pg" in AttachmentAllocator -> 192.168.x.y

Changes

Source fix (already on this branch)

• Sources/Services/ContainerNetworkService/Server/AttachmentAllocator.swift — adds private static func normalize(_ hostname: String) -> String that strips a single trailing root-label dot. All three mutating/reading entry points — allocate, deallocate, lookup — route through it.
• Sources/Services/ContainerAPIService/Client/Utility.swift — removes the dnsDomain parameter from getAttachmentConfigurations. Replaces the two-arm offset == 0 guard (identical output in both arms after allocator normalization) with a single registrationHostname binding that strips any accidental trailing dot from containerId.
• Sources/APIServer/ContainerDNSHandler.swift — adds dnsDomain: String? stored property and corresponding init parameter. answerHost and answerHost6 compute the lookup key by delegating to DNSRegistrationKey.registrationKey(for:dnsDomain:).
• Sources/APIServerCore/RegistrationKey.swift — new library target. container-apiserver is @main and cannot be @testable-imported, so the pure-logic translation from a DNS question name to the bare allocator key lives here. Named APIServerCore (not APIServer) to avoid colliding with struct APIServer: AsyncParsableCommand.
• Sources/APIServer/APIServer+Start.swift — threads containerSystemConfig.dns.domain into ContainerDNSHandler.init. One line.
• Sources/Services/ContainerAPIService/Server/Networks/NetworksService.swift — doc comment update on lookup(hostname:) to document the new contract.

Routing fix (50f4a43)

• Sources/ContainerPersistence/ContainerSystemConfig.swift — DNSConfig.defaultDomain = "test" constant. Both the no-arg initialiser and the TOML decode path fall back to it when domain is absent. Explicit nil and explicit "" from user TOML are still preserved (opt-out path).
• Sources/Services/ContainerAPIService/Client/Utility.swift — when constructing a container's DNSConfiguration and the user has not specified any search domains, inject [domain] so bare-name queries pick up the suffix and traverse the resolver chain. Honours user overrides; explicit empty arrays remain empty.
• scripts/pkg-scripts/postinstall — new .pkg postinstall script. Writes /etc/resolver/containerization.test (filename / contents matching HostDNSResolver so existing system dns create | delete tooling composes cleanly) and refreshes mDNSResponder. The installer already runs as root; no new sudo prompt.
• Makefile — pass --scripts scripts/pkg-scripts to pkgbuild so the postinstall is bundled into the installer.
• scripts/uninstall-container.sh — best-effort removal of the resolver entry on uninstall, keeping /etc/resolver/ state symmetric with install.

Verification

Build

Build complete!

No new warnings introduced. Clean build on Apple silicon, macOS 26, Xcode 26.

Unit tests — 40 / 40 across 4 suites, all passing in 0.002s wall

• AttachmentAllocatorTest (19 tests) — normalization symmetry across allocate / lookup / deallocate, idempotent re-allocation in canonical form, single-dot scope.
• ContainerDNSHandlerRegistrationKeyTest (8 tests) — trailing-dot stripping, configured-domain suffix stripping, label-boundary matching, and dnsDomain == nil / empty-string passthrough.
• UtilityRegistrationTests (5 tests) — bare-form registration for plain, trailing-dot, and dot-internal containerIds; consistent hostname across multiple network attachments.
• ContainerSystemConfigDNSDefaultTests (8 tests, new in this commit) — DNSConfig default value, explicit overrides, the empty-string opt-out, and the TOML decode paths (missing section, empty section, explicit override).

Live repro on macOS 26 (debug build, this branch)

$ container system stop
$ sudo make all install BUILD_CONFIGURATION=debug
$ container system start --debug

$ container run --rm -d --name probe-pg -e POSTGRES_PASSWORD=test postgres:alpine
probe-pg

$ container list
ID        IMAGE                              OS     ARCH   STATE    ADDR
probe-pg  docker.io/library/postgres:alpine  linux  arm64  running  192.168.65.8/24

$ container run --rm busybox nslookup probe-pg          # the goal
Server:    192.168.65.1
Address:   192.168.65.1:53
Name:      probe-pg.test
Address:   192.168.65.8

$ container run --rm busybox nslookup probe-pg.test     # FQDN form
Name:      probe-pg.test
Address:   192.168.65.8

$ container run --rm alpine nslookup probe-pg           # musl resolver
Name:      probe-pg.test
Address:   192.168.65.8

$ dig @127.0.0.1 -p 2053 probe-pg. +short               # key-form fix intact
192.168.65.8
$ dig @127.0.0.1 -p 2053 probe-pg.test. +short          # suffix-strip works
192.168.65.8

$ dscacheutil -q host -a name probe-pg.test             # /etc/resolver host path
ip_address: 192.168.65.8

$ cat /etc/resolver/containerization.test               # installed by postinstall
domain test
search test
nameserver 127.0.0.1
port 2053

Wire compatibility

No Codable schema change to AttachmentConfiguration, AttachmentOptions, DNSConfig, or any persisted type. DNSConfig.domain remains String? and existing TOMLs decode unchanged — the change is the default fallback when the key is absent. The dropped dnsDomain parameter on Utility.getAttachmentConfigurations is internal to the API server process; it is not part of any public API, XPC message type, or on-disk format. The new APIServerCore library target is purely additive. Existing containers and networks running mid-upgrade are unaffected: AttachmentAllocator.normalize accepts both "foo" and "foo." as equivalent keys, so any entry stored in either form before the upgrade remains findable after it.

Out of scope

• Multi-alias registration (compose-style aliases, additional names per container) is tracked separately as CHAOS-1476 and is intentionally not in this PR.
• Upstream apple/container submission is a separate step after validating the prototype on full-chaos/container.
• No changes to LocalhostDNSHandler — that handler serves the macOS realhost resolver and follows a different code path.
• macOS 15 backport. The fix targets macOS 26 (container-network-vmnet's reserved-mode variant).

References

• Linear: CHAOS-1478
• Sibling work: CHAOS-1470 (Phase 11 resolver workaround), CHAOS-1476 (multi-alias feature)
• Upstream anchors (apple/container @ 3b724ae):
  • Utility.swift#L286-L323 — the FQDN gate
  • AttachmentAllocator.swift#L60-L62 — the exact-match lookup
  • ContainerDNSHandler.swift#L78-L88 — the canonical-form caller
• vmnet API references (macOS 26 SDK):
  • vmnet.h L1009-L1027 — vmnet_network_configuration_create, default DNS proxy enabled
  • vmnet.h L1244 — vmnet_network_configuration_disable_dns_proxy (added macOS 26)

[linear]

CHAOS-1478