podman/SOURCES/1005-Rework-netavark-cni-choice-logic.patch

From 78af56f13c262b846ef28a760f012205e4bd0069 Mon Sep 17 00:00:00 2001
From: Alex Burmashev <alexander.burmashev@oracle.com>
Date: Fri, 29 May 2026 06:18:29 +0000
Subject: [PATCH] Rework netavark/cni choice logic

With the default podman logic on first podman command invocation
podman does:
- If there are CNI networks existing - choose CNI
- If there is no netavark binary - choose CNI
- If there are existing containers and container images - choose CNI
- Or choose netavark

On OL9 + podman 5+ netavark is the default network engine.
For vast majority of systems podman correctly chooses netavark on first
invocation, since there are no CNI networks, netavark binary exists and
there are no containers or images on the system.
However, if you pre-seed the system with container images or, for
example, remove /var/lib/containers/storage/defaultNetworkBackend file,
podman on next start will incorrectly choose CNI as a network engine,
when CNI is not even installed.

This patch reworks CNI/Netavark detection logic.
Now:
1) If there are CNI networks existing - choose CNI
2) If there is a CNI binary existing, we:
  - check if there are containers and container images existing, and if
    yes - choose CNI
// since CNI is not installed on OL by default, but optionally
available, we make an educated guess, that if someone has both CNI
specifically installed, and existing containers + container images,
likely that person could have relied on old CNI/Netavark detection logic and wants CNI to be default.
3) If netavark binary does not exist, we:
 -  check if there are containers and container images existing, and if
    yes - choose CNI ( also old logic )
4) Or choose netavark

This would allow systems, that were pre-populated with container images
to correctly choose netavark by default and will also allow people who
REALLY need it to use CNI. For people already using CNI for whatever
reason, nothing will change. For fresh system nothing changes.

JIRA: EVG-3769

Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com>
Reviewed-by: Laurence Rochfort <laurence.rochfort@oracle.com>
---
 .../common/libnetwork/network/interface.go    |  7 +-
 .../libnetwork/network/interface_cni.go       | 70 ++++++++++++-------
 2 files changed, 50 insertions(+), 27 deletions(-)

diff --git a/vendor/go.podman.io/common/libnetwork/network/interface.go b/vendor/go.podman.io/common/libnetwork/network/interface.go
index 51c1ae7..d4f77c4 100644
--- a/vendor/go.podman.io/common/libnetwork/network/interface.go
+++ b/vendor/go.podman.io/common/libnetwork/network/interface.go
@@ -31,8 +31,11 @@ const (
 // It returns either the CNI or netavark backend depending on what is set in the config.
 // If the backend is set to "" we will automatically assign the backend on the following conditions:
 //  1. read ${graphroot}/defaultNetworkBackend
-//  2. find netavark binary (if not installed use CNI)
-//  3. check containers, images and CNI networks and if there are some we have an existing install and should continue to use CNI
+//  2. check CNI networks and if there are some we have an existing install and should continue to use CNI
+//  3. find CNI binary and if it exists:
+//   3.1 check containers, images and if there are some we have an existing install and should continue to use CNI
+//  4. find netavark binary and if not installed:
+//   4.1 check containers, images and if there are some we use CNI
 //
 // revive does not like the name because the package is already called network
 //
diff --git a/vendor/go.podman.io/common/libnetwork/network/interface_cni.go b/vendor/go.podman.io/common/libnetwork/network/interface_cni.go
index 3de3a30..fbd50f4 100644
--- a/vendor/go.podman.io/common/libnetwork/network/interface_cni.go
+++ b/vendor/go.podman.io/common/libnetwork/network/interface_cni.go
@@ -55,31 +55,6 @@ func getDefaultCNIConfigDir() (string, error) {
 }
 
 func networkBackendFromStore(store storage.Store, conf *config.Config) (backend types.NetworkBackend, err error) {
-	_, err = conf.FindHelperBinary("netavark", false)
-	if err != nil {
-		// if we cannot find netavark use CNI
-		return types.CNI, nil
-	}
-
-	// If there are any containers then return CNI
-	cons, err := store.Containers()
-	if err != nil {
-		return "", err
-	}
-	if len(cons) != 0 {
-		return types.CNI, nil
-	}
-
-	// If there are any non ReadOnly images then return CNI
-	imgs, err := store.Images()
-	if err != nil {
-		return "", err
-	}
-	for _, i := range imgs {
-		if !i.ReadOnly {
-			return types.CNI, nil
-		}
-	}
 
 	// If there are CNI Networks then return CNI
 	cniInterface, err := getCniInterface(conf)
@@ -95,6 +70,51 @@ func networkBackendFromStore(store storage.Store, conf *config.Config) (backend
 			return types.CNI, nil
 		}
 	}
+	_, err = os.Stat("/usr/libexec/cni/vlan")
+	if err == nil {
+		// if we found CNI we check if we have containers and readonly images
+		// If there are any containers or readonly images then return CNI
+		cons, err := store.Containers()
+		if err != nil {
+			return "", err
+		}
+		if len(cons) != 0 {
+			return types.CNI, nil
+		}
+		// If there are any non ReadOnly images then return CNI
+		imgs, err := store.Images()
+		if err != nil {
+			return "", err
+			}
+		for _, i := range imgs {
+			if !i.ReadOnly {
+				return types.CNI, nil
+			}
+		}
+	}
+	
+	_, err = conf.FindHelperBinary("netavark", false)
+	if err != nil {
+		// if we cannot find netavark we check if we have containers and readonly images
+		// If there are any containers or readonly images then return CNI
+		cons, err := store.Containers()
+		if err != nil {
+			return "", err
+		}
+		if len(cons) != 0 {
+			return types.CNI, nil
+		}
+		// If there are any non ReadOnly images then return CNI
+		imgs, err := store.Images()
+		if err != nil {
+			return "", err
+		}
+		for _, i := range imgs {
+			if !i.ReadOnly {
+				return types.CNI, nil
+			}
+		}
+	}
 	return types.Netavark, nil
 }
 
-- 
2.47.3