simple run command with --sysctl for network interface fails after upgrade about moby HOT 4 CLOSED

i pinned docker-ce to 25.0.5, my container works as before.

so i guess it's caused by the recent 26 release.

from moby.

Hi @jwfang - thank you for narrowing down the issue and raising the clear report.

It's fallout from #47062 - in 0046b16 we moved some of the network configuration from a pre-start hook in the runtime to after the container task has been created.

As you suggest, that means the network interface renaming (moving one end of a veth device into the container namespace in Sandbox.populateNetworkResources, sb.osSbox.AddInterface) happens after sysctls are applied by the runtime.

cc @corhere - I think we'll need to go back to using the pre-start hook.

from moby.

Given how brittle it is to use --sysctl for per-iface config, having to predict the interface name and messing with the configuration of a libnetwork-managed interface, maybe this isn't something we should try to support going forward. What if instead we provided some affordance such as an endpoint option to set interface sysctls without having to predict the interface name? That way libnetwork could apply the sysctls itself after it has created and renamed the interfaces, and it could refuse to apply sysctls that would be incompatible with particular network drivers.

from moby.

@corhere have you been peeking into our internal slack? 😂 we were discussing exactly that, and for the same reason (my choice of words ("network connection") was a bit poor, but same intent);

from moby.