test: bind the fake resolv.conf at the RESOLVED path, not at a symlink

[vyskocilm]

CI red on main and every PR since 2026-09-17 19:21 UTC. Failure names neither DNS nor bwrap:

panic: integration: TestNoResolverHostFailsFastAndSaysSo has run for more than
twice its 10s time budget and is presumed hung.

Runs 35264394910 (main, f85489d), 35265056261, 35266080160 (#585). Three regions, one image, same test.

Cause is not ours

No snug change between last green main (1487aec, 14:41) and first red (f85489d, 19:21) touches integration code — that commit is a comment, two unit test files and a design doc. Delta is the RUNNER:

run	bubblewrap
35235235842 green	0.9.0-1ubuntu0.1
35264394910 red	0.9.0-1ubuntu0.2

0.9.0-1ubuntu0.2 is CVE-2026-87766. Second patch: "creates and resolves destinations without following symlinks, and rejects mount operations on symlink destinations".

/etc/resolv.conf on a systemd-resolved host — every GitHub runner — is a symlink to ../run/systemd/resolve/stub-resolv.conf. Measured under an outer bwrap holding such an /etc (bwrap 0.12.0 locally carries the same refusal):

$ bwrap --dev-bind / / --ro-bind $T /etc/resolv.conf -- true
bwrap: Can't mount on symlink destination /etc/resolv.conf
rc=1

singleFileResolvConfBind() answered false, every call took the fallback shape — copy the whole of /etc, ~19s each on a runner — and four such calls in one test blew a 10s budget() whose watchdog panics without flushing the test's log. Hence a hang naming nothing.

Fix

resolvConfDest() = EvalSymlinks("/etc/resolv.conf"), cached; probe and bind both use it. Fixture lands where the symlink points, hostNameservers()'s plain os.ReadFile follows the link and sees it. Literal path when the link dangles, probe answers for that.

Three things beside it:

• Fallback ANNOUNCES itself on stderr carrying bwrap's own message. ~19s per call against a 10s budget is the shape that costs the job, and a watchdog panic cannot print a t.Logf.
• fakeHostEtc caches per content under TestMain's dir (new integrationTmp): fallback costs one copy per process, not one per call.
• TestTheFakeResolvConfHarnessReallySubstitutes — the file's only POSITIVE use of the overlay. Fixture names 198.51.100.53 (TEST-NET-2); it must come back out of the sandbox's generated resolv.conf and off --dry-run's screen. Every other assertion here is a negative, and a negative passes just as well when the overlay silently does not apply.

No production code touched, no golden argv diff, no profile/mount/seccomp/host-integration surface.

Verification

• make gate green.
• SNUG_REQUIRE_SANDBOX=1 make integration-sandbox green, 310.223s, engine tests: 46 ran, floor 46 — podman version 6.0.2.
• Three DNS tests green under a wrapper reproducing the runner shape (an /etc whose resolv.conf is a symlink), where the probe fails with the message above. Dangling-symlink arm exercised too: warning prints, fallback still passes.

🤖 Generated with Claude Code