Repository: moby/moby
File: daemon/libnetwork/sandbox_dns_unix.go (Go)

Code before:
	// Proceed with rc, which might be zero-valued if path does not exist.

	rc.SetHeader(`# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.`)
	if len(sb.config.dnsList) > 0 {
		rc.OverrideNameServers(sb.config.dnsList)
	}
	if len(sb.config.dnsSearchList) > 0 {
		rc.OverrideSearch(sb.config.dnsSearchList)
	}
	if len(sb.config.dnsOptionsList) > 0 {
		rc.OverrideOptions(sb.config.dnsOptionsList)
	}
	return &rc, nil
}

// For a new sandbox, write an initial version of the container's resolv.conf. It'll
// be a copy of the host's file, with overrides for nameservers, options and search
// domains applied.
func (sb *Sandbox) setupDNS() error {
	sb.restoreResolvConfPath()

	// Fixes https://github.com/moby/moby/issues/51490
	// non-host network sandbox should check resolvconf.UserModified
	if sb.createdByRestart && !sb.config.useDefaultSandBox {
		if mod, err := resolvconf.UserModified(sb.config.resolvConfPath, sb.config.resolvConfHashFile); err != nil || mod {
			return err
		}
	}

	// Make sure the directory exists.
	dir, _ := filepath.Split(sb.config.resolvConfPath)
	if err := createBasePath(dir); err != nil {
		return err
	}

	rc, err := sb.loadResolvConf(sb.config.getOriginResolvConfPath())
	if err != nil {
		return err
	}
	return rc.WriteFile(sb.config.resolvConfPath, sb.config.resolvConfHashFile, filePerm)
}

// Called when an endpoint has joined the sandbox.
func (sb *Sandbox) updateDNS(ipv6Enabled bool) error {
	if mod, err := resolvconf.UserModified(sb.config.resolvConfPath, sb.config.resolvConfHashFile); err != nil || mod {
		return err
	}

	// Load the host's resolv.conf as a starting point.

Review comment (refactor):
On first run, `sb.config.resolvConfPath` is already set when `sb.setupDNS()` is called, but both `resolv.conf` and `resolv.conf.hash` have not been written to disk yet. In that case, `UserModified` returns false:

https://github.com/moby/moby/blob/6e52828ec38b2f53f695b97ffb0b4ba94fa255e4/daemon/libnetwork/internal/resolvconf/resolvconf.go#L429-L433

So, you can remove this check on `sb.createdByRestart` (and the sandbox option, as described in my previous comments).

```suggestion
	if !sb.config.useDefaultSandBox {
```

Code after:
	// Proceed with rc, which might be zero-valued if path does not exist.

	rc.SetHeader(`# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.`)
	if len(sb.config.dnsList) > 0 {
		rc.OverrideNameServers(sb.config.dnsList)
	}
	if len(sb.config.dnsSearchList) > 0 {
		rc.OverrideSearch(sb.config.dnsSearchList)
	}
	if len(sb.config.dnsOptionsList) > 0 {
		rc.OverrideOptions(sb.config.dnsOptionsList)
	}
	return &rc, nil
}

// For a new sandbox, write an initial version of the container's resolv.conf. It'll
// be a copy of the host's file, with overrides for nameservers, options and search
// domains applied.
func (sb *Sandbox) setupDNS() error {
	sb.restoreResolvConfPath()

	// When the container is restarted, a new Sandbox is created but the same resolv.conf is re-used. If it was
	// user-modified, do not attempt to overwrite it.
	if !sb.config.useDefaultSandBox {
		if mod, err := resolvconf.UserModified(sb.config.resolvConfPath, sb.config.resolvConfHashFile); err != nil || mod {
			return err
		}
	}

	// Make sure the directory exists.
	dir, _ := filepath.Split(sb.config.resolvConfPath)
	if err := createBasePath(dir); err != nil {
		return err
	}

	rc, err := sb.loadResolvConf(sb.config.getOriginResolvConfPath())
	if err != nil {
		return err
	}
	return rc.WriteFile(sb.config.resolvConfPath, sb.config.resolvConfHashFile, filePerm)
}

// Called when an endpoint has joined the sandbox.
func (sb *Sandbox) updateDNS(ipv6Enabled bool) error {
	if mod, err := resolvconf.UserModified(sb.config.resolvConfPath, sb.config.resolvConfHashFile); err != nil || mod {
		return err
	}

	// Load the host's resolv.conf as a starting point.