With Network=host, Podman snapshots /etc/resolv.conf at container creation
and bind-mounts the copy, so a later DNS change (DHCP renewal, renumbering,
router replacement) never reaches running containers: they keep querying the
old, now-dead resolvers until recreated, silently.
Add a host-level mechanism in the base cookbook:
- a systemd.path unit watching /etc/resolv.conf (catches any writer, including
atomic rename-into-place);
- a oneshot service running a dedicated script that rewrites each Network=host
container's snapshot in place (same inode, so the bind-mount stays valid).
Rewriting the content in place is picked up at runtime with no restart by both
glibc (reloads on mtime change) and musl (stateless, re-reads every lookup),
verified empirically. Scoped to NetworkMode=host only: bridged containers
legitimately point at aardvark-dns and must not be touched.
Fixes#1
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
