feat(network): forward guest DNS to Docker's embedded resolver

On Docker user custom networks the DNS resolver (127.0.0.11) is
loopback only and unreachable by the unikernel guest. Detect this
case per container, expose the resolver via a virtual resolver IP
using tc redirects between the tap and lo + a PREROUTING DNAT,
and rewrite the guest's resolv.conf to point at that IP.

Signed-off-by: Ali Mohamed <amx746@gmail.com>

Author: alimx07

.github/contributors.yaml

@@ -107,3 +107,6 @@ users:
   Chennamma-Hotkar:
     name: Chennamma Hotkar
     email: channuhotkar@gmail.com
+  alimx07:
+    name: Ali Mohamed
+    email: amx746@gmail.com

Makefile

@@ -71,6 +71,7 @@ URUNC_SRC      += $(wildcard $(CURDIR)/pkg/unikontainers/unikernels/*.go)
 URUNC_SRC      += $(wildcard $(CURDIR)/pkg/unikontainers/types/*.go)
 URUNC_SRC      += $(wildcard $(CURDIR)/pkg/unikontainers/initrd/*.go)
 URUNC_SRC      += $(wildcard $(CURDIR)/pkg/network/*.go)
+URUNC_SRC      += $(wildcard $(CURDIR)/pkg/network/localhost/*.go)
 SHIM_SRC       := $(wildcard $(CURDIR)/cmd/containerd-shim-urunc-v2/*.go)
 SHIM_SRC       += $(wildcard $(CURDIR)/pkg/containerd-shim/*.go)
 SHIM_SRC       += $(wildcard $(CURDIR)/pkg/containerd-shim/containerd/*.go)

internal/constants/network_constants.go

@@ -18,6 +18,7 @@ const (
 	StaticNetworkTapIP       = "172.16.1.1"
 	StaticNetworkUnikernelIP = "172.16.1.2"
 	// TODO: Experiment with DynamicNetworkTapIP starting from 172.16.X.1
-	DynamicNetworkTapIP  = "172.16.X.2"
-	QueueProxyRedirectIP = "172.16.1.2"
+	DynamicNetworkTapIP    = "172.16.X.2"
+	QueueProxyRedirectIP   = "172.16.1.2"
+	LocalhostDNSResolverIP = "192.168.100.100"
 )

pkg/network/localhost/docker.go

@@ -0,0 +1,87 @@
+// Copyright (c) 2023-2026, Nubificus LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package localhost
+
+import (
+	"bytes"
+	"fmt"
+	"net"
+	"os/exec"
+	"regexp"
+	"strings"
+)
+
+// dockerCustomNetDNS is where Docker's embedded DNS resolver listens.
+const dockerCustomNetDNS = "127.0.0.11"
+
+var (
+	dockerDNSTCPRe = regexp.MustCompile(`-p\s+tcp.*to-destination\s+127\.0\.0\.11:(\d+)`)
+	dockerDNSUDPRe = regexp.MustCompile(`-p\s+udp.*to-destination\s+127\.0\.0\.11:(\d+)`)
+)
+
+func isDocker(resolvConf string) bool {
+	return strings.Contains(resolvConf, "docker")
+}
+
+func dockerRules(f *Forwarder) error {
+	ipt, err := exec.LookPath("iptables")
+	if err != nil {
+		return err
+	}
+
+	tcpPort, udpPort, err := dockerDNSPorts(ipt)
+	if err != nil {
+		return err
+	}
+	lhlog.Debugf("Docker DNS resolver: tcp/%s udp/%s", tcpPort, udpPort)
+
+	if err := dnat(ipt, f.VirtIP, "udp", net.JoinHostPort(dockerCustomNetDNS, udpPort)); err != nil {
+		return err
+	}
+	if err := dnat(ipt, f.VirtIP, "tcp", net.JoinHostPort(dockerCustomNetDNS, tcpPort)); err != nil {
+		return err
+	}
+	lhlog.Debug("Applied Docker DNAT rules")
+
+	return nil
+}
+
+func dockerDNSPorts(ipt string) (tcpPort, udpPort string, err error) {
+	var stdout, stderr bytes.Buffer
+	cmd := exec.Cmd{
+		Path:   ipt,
+		Args:   []string{ipt, "-t", "nat", "-S", "DOCKER_OUTPUT", "--wait", "1"},
+		Stdout: &stdout,
+		Stderr: &stderr,
+	}
+	if err := cmd.Run(); err != nil {
+		if _, ok := err.(*exec.ExitError); ok {
+			return "", "", fmt.Errorf("iptables command %s failed: %s", cmd.String(), stderr.String())
+		}
+		return "", "", err
+	}
+
+	out := stdout.String()
+	if m := dockerDNSTCPRe.FindStringSubmatch(out); m != nil {
+		tcpPort = m[1]
+	}
+	if m := dockerDNSUDPRe.FindStringSubmatch(out); m != nil {
+		udpPort = m[1]
+	}
+	if tcpPort == "" || udpPort == "" {
+		return "", "", fmt.Errorf("could not find Docker DNS ports in DOCKER_OUTPUT chain")
+	}
+	return tcpPort, udpPort, nil
+}