From 6d35f067d6da0a0ce270b9eb883469e0559c7c0e Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 25 Jul 2026 12:47:04 +0200 Subject: container: T7736: give container veths a deterministic host_interface_name Podman's default "vethN" auto-naming for a container's host-side veth can collide with VyOS's own "virtual-ethernet vethN" interfaces. Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name" network connect option) and use it to name every non-macvlan container network attachment "veth-" instead, eliminating the collision by construction. Container names too long to fit are shortened to a recognizable prefix plus a short hash of the full name; verify() rejects the rare case where two containers still generate the same interface name. Add "show container interface" to display the resulting name-to-container mapping. --- python/vyos/container.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'python') diff --git a/python/vyos/container.py b/python/vyos/container.py index 475d796f2..b2dd306c4 100644 --- a/python/vyos/container.py +++ b/python/vyos/container.py @@ -12,11 +12,27 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . +from hashlib import sha256 + from vyos.config import Config from vyos.ifconfig import Interface from vyos.utils.dict import dict_search from vyos.utils.network import interface_exists +def get_container_host_ifname(name: str) -> str: + """ + Deterministic host-side veth interface name for a container's network + attachment (verify() only allows one network per container). Kept within + IFNAMSIZ and - thanks to the leading "veth-" (a hyphen can never appear in + a VyOS "vethN" interface name) - guaranteed to never collide with the + "virtual-ethernet" naming scheme.. + """ + prefix = f'veth-{name}' + if len(prefix) <= 15: + return prefix + digest = sha256(name.encode()).hexdigest()[:4] + return f'veth-{name[:5]}-{digest}' + def restart_network(config: Config) -> None: """ Start network and assign it to given VRF if requested. -- cgit v1.2.3