Skip to content

fix: prevent static IP assignment matching subnet gateway#894

Open
kavirakesh14 wants to merge 1 commit into
podman-container-tools:mainfrom
kavirakesh14:fix/netavark-gateway-conflict
Open

fix: prevent static IP assignment matching subnet gateway#894
kavirakesh14 wants to merge 1 commit into
podman-container-tools:mainfrom
kavirakesh14:fix/netavark-gateway-conflict

Conversation

@kavirakesh14

@kavirakesh14 kavirakesh14 commented Jun 5, 2026

Copy link
Copy Markdown

What does this PR do?

This adds a validation step to the Netavark IPAM logic to immediately reject static IP requests that conflict with the subnet's gateway IP.

Previously, if a container was started with a static IP matching the gateway, Netavark would accept it. The container would start successfully but suffer from silent internal networking failures, specifically resulting in "connection refused" errors on internal sockets.

By failing fast inside allocIPs with an "address already in use" error, Podman's behavior now mirrors Docker's standard behavior and prevents this ghost networking state.

Fixes Issue

Fixes podman-container-tools/podman#28863

How was this tested?

  • Compiled containers/common locally and linked it to a fresh build of Podman.
  • Passed local go fmt, go vet, and go test.

@github-actions github-actions Bot added the common Related to "common" package label Jun 5, 2026
@kavirakesh14 kavirakesh14 force-pushed the fix/netavark-gateway-conflict branch from 52e8967 to 9b9daa7 Compare June 5, 2026 21:16

@Luap99 Luap99 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, code wise this seems fine but please add a test case https://github.com/podman-container-tools/container-libs/blob/main/common/libnetwork/netavark/ipam_test.go

Also from your commit message please drop "Committer: kavirakesh14 kavirakesh007@gmail.com" That is not a valid/normal trailer.

And for the sign off and git author is it generally expected to use the real name
https://github.com/podman-container-tools/container-libs/blob/main/CONTRIBUTING.md#sign-your-prs

Use a real name (sorry, no anonymous contributions). A real name does not require a legal name, nor a birth name, nor any name that appears on an official ID (e.g. a passport). Your real name is the name you convey to people in the community for them to use to identify you as you. The key concern is that your identification is sufficient enough to contact you if an issue were to arise in the future about your contribution.

Though that is not a strict requirement and I think using the github id is fine.

This adds validation in Netavark IPAM throwing an 'address already in use' error if a user requests a static IP that is already assigned to the subnet's gateway, preventing silent internal socket connection failures.

Signed-off-by: kavirakesh14 <kavirakesh007@gmail.com>
@kavirakesh14 kavirakesh14 force-pushed the fix/netavark-gateway-conflict branch from 9b9daa7 to f78dd0d Compare June 10, 2026 07:20
@kavirakesh14

Copy link
Copy Markdown
Author

Thanks for the review! @Luap99, I Added the test case and dropped the Committer: trailer.

@Luap99 Luap99 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

common Related to "common" package

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Socket communication with an IP *.*.*.1 fails

2 participants