container: T7736: give container veths a deterministic host_interface_name

Podman's default "vethN" auto-naming for a container's host-side veth can
collide with VyOS's own "virtual-ethernet vethN" interfaces.

Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name"
network connect option) and use it to name every non-macvlan container network
attachment "veth-<container name>" instead, eliminating the collision by
construction. Container names too long to fit are shortened to a recognizable
prefix plus a short hash of the full name; verify() rejects the rare case
where two containers still generate the same interface name.

Add "show container interface" to display the resulting name-to-container
mapping.

1 files changed, 16 insertions, 0 deletions

diff --git a/python/vyos/container.py b/python/vyos/container.py
index 475d796f2..b2dd306c4 100644
--- a/python/vyos/container.py
+++ b/python/vyos/container.py
@@ -12,11 +12,27 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+from hashlib import sha256
+
 from vyos.config import Config
 from vyos.ifconfig import Interface
 from vyos.utils.dict import dict_search
 from vyos.utils.network import interface_exists
 
+def get_container_host_ifname(name: str) -> str:
+    """
+    Deterministic host-side veth interface name for a container's network
+    attachment (verify() only allows one network per container). Kept within
+    IFNAMSIZ and - thanks to the leading "veth-" (a hyphen can never appear in
+    a VyOS "vethN" interface name) - guaranteed to never collide with the
+    "virtual-ethernet" naming scheme..
+    """
+    prefix = f'veth-{name}'
+    if len(prefix) <= 15:
+        return prefix
+    digest = sha256(name.encode()).hexdigest()[:4]
+    return f'veth-{name[:5]}-{digest}'
+
 def restart_network(config: Config) -> None:
     """
     Start network and assign it to given VRF if requested.