From: Daniel Golle <redacted>
Date: Wed, 2 Sep 2026 13:24:53 +0000 (+0100)
Subject: podman: wire the podman bridges into dnsmasq and fw4
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=34f7cb606695cf162e52c1ab8d695193968a6087;p=openwrt-packages.git

podman: wire the podman bridges into dnsmasq and fw4

Ship a uci-defaults script that excepts the podman bridges from dnsmasq so
aardvark-dns can own the gateway :53, adds an fw4 zone forwarding the podman
subnets to wan, and reloads both so it also applies on a running system.

Signed-off-by: Daniel Golle <redacted>
---

diff --git a/utils/podman/Makefile b/utils/podman/Makefile
index fdb23ef2e..78e60243c 100644
--- a/utils/podman/Makefile
+++ b/utils/podman/Makefile
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=podman
 PKG_VERSION:=5.8.4
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/podman-container-tools/podman/archive/v$(PKG_VERSION)
@@ -108,6 +108,8 @@ define Package/podman/install
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/vendor/go.podman.io/common/pkg/seccomp/seccomp.json $(1)/usr/share/containers/
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_BIN) ./files/podman.init $(1)/etc/init.d/podman
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/podman.defaults $(1)/etc/uci-defaults/90-podman
 	$(SED) 's/driver = \"\"/driver = \"overlay\"/g' $(1)/etc/containers/storage.conf
 endef
 
diff --git a/utils/podman/files/podman.defaults b/utils/podman/files/podman.defaults
new file mode 100755
index 000000000..95058f392
--- /dev/null
+++ b/utils/podman/files/podman.defaults
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+changed=0
+
+if uci -q get dhcp.@dnsmasq[0] >/dev/null; then
+	case " $(uci -q get dhcp.@dnsmasq[0].notinterface) " in
+	*" podman* "*) ;;
+	*)
+		uci add_list dhcp.@dnsmasq[0].notinterface='podman*'
+		uci commit dhcp
+		changed=1
+		;;
+	esac
+fi
+
+if ! uci -q get firewall.podman >/dev/null; then
+	uci -q batch <<-UCI
+		set firewall.podman=zone
+		set firewall.podman.name='podman'
+		add_list firewall.podman.device='podman+'
+		set firewall.podman.input='REJECT'
+		set firewall.podman.output='ACCEPT'
+		set firewall.podman.forward='REJECT'
+		set firewall.podman_wan=forwarding
+		set firewall.podman_wan.src='podman'
+		set firewall.podman_wan.dest='wan'
+		set firewall.podman_dns=rule
+		set firewall.podman_dns.name='Allow-DNS-podman'
+		set firewall.podman_dns.src='podman'
+		set firewall.podman_dns.proto='tcp udp'
+		set firewall.podman_dns.dest_port='53'
+		set firewall.podman_dns.target='ACCEPT'
+		commit firewall
+	UCI
+	changed=1
+fi
+
+[ "$changed" = 1 ] && reload_config
+
+exit 0