[Bubblewrap / CI]: Pin the name-service chain the loopback-resolver DNS test resolves through

[Elliot (theelliotm)]

📖 Description

The Bubblewrap loopback-resolver DNS suite publishes a resolver file inside a private mount namespace and expects both its host-side control and the sandbox to read it. That only holds for lookups that reach glibc's nss_dns. On Debian 13 the chain starts with systemd-resolved, which answers from a daemon outside the namespace — it never sees the published stub, and it declines a reserved TLD without querying anyone. The control failed instantly with the stub peer untouched (~120 ms, not the 10 s timeout), so the suite aborted before the sandbox was ever launched. The fix binds a minimal nsswitch.conf over the host's inside the namespace, pinning the chain to files dns. Since bwrap binds /etc, the sandbox resolves through the same chain, which matters because the in-sandbox assertion was headed for the same short-circuit.

This is a test-fixture fix only — no product code changes. The resolver-pin behavior from #1453 was never reached on Debian 13, so it was untested there rather than broken. Note that the probe name stays .invalid: it is the right marker once the lookup genuinely reaches the stub, and renaming it would not have helped, since nss-resolve ignores resolv.conf for every name.

🔗 References

Resolves #1481. Fixes the suite added in #1453.

🔍 Validation

Scheduled Validation Tests (nightly) on this branch: run 38463281609 — all green, including debian-13, x64, bubblewrap, which had failed on every nightly since #1453 merged. That run was temporarily scoped to the four Bubblewrap legs (ubuntu-26.04, ubuntu-24.04, rhel-10, debian-13); the scoping commit was dropped before this PR, so the branch contains only the test change.

Debian 13 now runs the suite to completion instead of aborting at the control:

=== Bubblewrap Loopback Resolver DNS ===
PASS: the sandbox reads slirp's forwarder instead of the host's loopback stub.
PASS: the pinned resolver keeps the host's other directives.
PASS: a hostname resolves inside the sandbox through slirp's forwarder.

Also reproduced the failure mode locally (WSL, Ubuntu 26.04) with a harness mirroring the fixture, which confirms the lookup never reaches the resolver file and that the pin is load-bearing:

NSS chain	Control	Elapsed	Peer queries
files dns (unmodified host)	PASS	0.112s	3
files (short-circuited)	FAIL	0.115s	0
files dns (pinned by this change)	PASS	0.113s	3

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

The focused test-only change correctly addresses the Debian 13 failure and is validated across supported Bubblewrap environments.

0 open findings

What changed in this PR

Updates the Bubblewrap DNS test fixture so lookups reliably reach the namespace-local stub resolver on systems using nss-resolve.

Changes:

• Bind-mounts a minimal nsswitch.conf using files dns.
• Fails clearly if the resolver-chain override cannot be mounted.

File	Description
tests/​scripts/​run_bwrap_dns_test.sh	Pins NSS host resolution inside the test namespace.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.