container: T7736: disable IPv6 DAD for netavark bridges to fix aardvark-dns race

netavark assigns the IPv6 gateway address to a container "pod-*" bridge
and immediately invokes aardvark-dns to bind its DNS listener to it. While
the address is "tentative" during Duplicate Address Detection, that bind()
fails with EADDRNOTAVAIL and container startup fails for any IPv6-enabled
network.

The kernel only skips DAD for an address if both "all" and the specific
interface's own accept_dad are disabled at the moment the interface is
created. A per-interface override is always either too late for a network's
first-ever container - as the network can only be created in-time and not
explicitly before starting the first container.

1 files changed, 6 insertions, 2 deletions

diff --git a/smoketest/scripts/cli/test_system_ipv6.py b/smoketest/scripts/cli/test_system_ipv6.py
index d7282c4c8..a501c6862 100755
--- a/smoketest/scripts/cli/test_system_ipv6.py
+++ b/smoketest/scripts/cli/test_system_ipv6.py
@@ -56,8 +56,12 @@ class TestSystemIPv6(VyOSUnitTestSHIM.TestCase):
         self.assertNotIn('no ipv6 forwarding', frrconfig)
 
     def test_system_ipv6_strict_dad(self):
-        # This defaults to 1
-        self.assertEqual(sysctl_read(['net', 'ipv6', 'conf', 'all', 'accept_dad']), '1')
+        # T7736: "all" defaults to 0 (see 32-vyos-podman.conf) so that
+        # newly created interfaces outside VyOS's interface model (e.g.
+        # netavark's container bridges) skip DAD; VyOS-managed interface
+        # types always write their own explicit accept_dad on commit
+        # (XML defaultValue 1), so this does not affect them.
+        self.assertEqual(sysctl_read(['net', 'ipv6', 'conf', 'all', 'accept_dad']), '0')
 
         # Do not assign any IPv6 address on interfaces, this requires a reboot
         # which cannot be tested, but we can read the config file :)