fix(network): set portMappings and dns capabilities on default bridge - #5210
Open
AruneshDwivedi wants to merge 1 commit into
Open
AruneshDwivedi wants to merge 1 commit into
AruneshDwivedi wants to merge 1 commit into
Conversation
The default bridge plugin generated by nerdctl was missing the capabilities object entirely. Without "portMappings": true and "dns": true in the CNI conflist, the Windows CNI plugin ignores runtime port mapping requests (e.g. nerdctl run -p 5093:5093). Add these capabilities to the default bridge configuration so that port forwarding works out of the box on all platforms including Windows Server with WSL2. Fixes containerd#5157 Signed-off-by: AruneshDwivedi <arunesh.devops@gmail.com>
Member
It has been working fine, at least on the Linux platform, no? |
AkihiroSuda
reviewed
Sep 17, 2026
Member
There was a problem hiding this comment.
This is especially impactful on Windows where port mapping is the primary way to access container services from the host.
This *_unix.go file doesn't seem relevant to Windows?
How did you test your PR?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The default bridge network plugin generated by nerdctl was missing the
capabilitiesobject entirely. According to the CNI spec, the portmap plugin requirescapabilities.portMappings=trueto be declared in the parent network configuration for it to process port mapping requests at runtime.Without these capabilities,
nerdctl run -p NNNN:MMMM ...silently fails on all platforms -- no port is forwarded and no error is returned to the user. This is especially impactful on Windows where port mapping is the primary way to access container services from the host.Issue #5157 reports this specifically for Windows Server with containerd 2.3.3 and nerdctl 2.3.4.
Fix
Add
portMappings: trueanddns: trueto the default bridge plugin capabilities. These are standard CNI capabilities that the portmap and dns plugins declare support for. The fix mirrors what existing pre-created network configs already include (see the test template innetutil_test.goline 53-56).Fixes #5157