fix: allow localhost DNS servers when using host network

[zhangyoufu]

(This change is vibed by Claude Haiku 4.5, reviewed by human.)

This commit addresses the issue where nerdctl was unconditionally stripping localhost DNS servers from /etc/resolv.conf when containers used --network=host.

Changes made:

1. Added resolvconf.FilterResolvDNSWithLocalhostOption(), like resolvconf.FilterResolvDNS() but allows controlling whether localhost nameservers are preserved.
2. Added allowLocalhostDNS parameter to fetchDNSResolverConfig()
3. Updated hostNetworkManager to use allowLocalhostDNS=true to preserve host DNS
4. Added comprehensive test coverage for the new functionality

The fix ensures:

• Host network mode respects host's /etc/resolv.conf including localhost resolvers
• Isolated networks (bridge, CNI) continue to have fallback Google DNS
• Backward compatible - all existing behavior unchanged
• Docker-compatible behavior

Fixes: #4651

[AkihiroSuda]

Can we have some integration tests too?

nerdctl/cmd/nerdctl/container/container_run_network_linux_test.go

Lines 935 to 978 in 20a3eeb

	func TestHostNetworkHostName(t *testing.T) {
	nerdtest.Setup()
	testCase := &test.Case{
	Require: require.Not(require.Windows),
	Setup: func(data test.Data, helpers test.Helpers) {
	helpers.Custom("cat", "/etc/hostname").Run(&test.Expected{
	Output: func(stdout string, t tig.T) {
	data.Labels().Set("hostHostname", stdout)
	},
	})
	},
	Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
	return helpers.Command("run", "--rm",
	"--network", "host",
	testutil.AlpineImage, "cat", "/etc/hostname")
	},
	Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
	return &test.Expected{
	Output: expect.Equals(data.Labels().Get("hostHostname")),
	}
	},
	}
	testCase.Run(t)
	}
	func TestNoneNetworkDnsConfigs(t *testing.T) {
	nerdtest.Setup()
	testCase := &test.Case{
	Require: require.Not(require.Windows),
	Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
	return helpers.Command("run", "--rm",
	"--network", "none",
	"--dns", "0.1.2.3", "--dns-search", "example.com", "--dns-option", "timeout:3", "--dns-option", "attempts:5",
	testutil.CommonImage, "cat", "/etc/resolv.conf")
	},
	Expected: test.Expects(0, nil, expect.Contains(
	"0.1.2.3",
	"example.com",
	"attempts:5",
	"timeout:3",
	)),
	}
	testCase.Run(t)
	}

[zhangyoufu]

I have implemented some simple integration tests. I don't think we should modify host /etc/resolv.conf content on-the-fly.

[zhangyoufu]

I'm investigating CI failure in rootless setup.

[zhangyoufu]

Previous CI failure due to:

1. Some rootless CI job make use of slirp, which provides a different DNS server than the host. The test case is modified to handle this.
2. pkg/resolvconf has special handling to retrieve the real DNS servers behind systemd-resolved when it sees 127.0.0.53 (systemd-resolved stub). When using host network, this special handling is unwanted. IMHO, this special handling is problematic. systemd-resolved can freely choose DNS servers from other links when netif comes and goes. We really should not stick on the "current" state of which DNS servers are choosen by systemd-resolved.

[ChengyuZhu6]

LGTM

[ChengyuZhu6]

Let's wait for @AkihiroSuda's review to see if he has any comments on the latest changes.

[AkihiroSuda]

Thanks