From c8b4fd73a1b1696a1c6533e4de85bdedfa8fc5fc Mon Sep 17 00:00:00 2001
From: Kathryn Baldauf <k_baldauf@apple.com>
Date: Thu, 11 Jun 2026 11:42:21 -0700
Subject: [PATCH] Always update default network with system configuration
 values (#1686)

Closes https://github.com/apple/container/issues/1677.
---
 Sources/APIServer/APIServer+Start.swift       | 19 +++----
 .../Server/Networks/NetworksService.swift     | 51 +++++--------------
 2 files changed, 23 insertions(+), 47 deletions(-)

diff --git a/Sources/APIServer/APIServer+Start.swift b/Sources/APIServer/APIServer+Start.swift
index 2ac2e77f..b6038b55 100644
--- a/Sources/APIServer/APIServer+Start.swift
+++ b/Sources/APIServer/APIServer+Start.swift
@@ -321,10 +321,19 @@ extension APIServer {
             log.info("initializing networks service")
 
             let resourceRoot = appRoot.appending(FilePath.Component("networks"))
+            let defaultNetworkConfig = try NetworkConfiguration(
+                name: NetworkClient.defaultNetworkName,
+                mode: .nat,
+                ipv4Subnet: containerSystemConfig.network.subnet,
+                ipv6Subnet: containerSystemConfig.network.subnetv6,
+                labels: try .init([ResourceLabelKeys.role: ResourceRoleValues.builtin]),
+                plugin: "container-network-vmnet"
+            )
             let service = try await NetworksService(
                 pluginLoader: pluginLoader,
                 resourceRoot: resourceRoot,
                 containersService: containersService,
+                defaultNetworkConfiguration: defaultNetworkConfig,
                 log: log,
                 debugHelpers: debug
             )
@@ -334,15 +343,7 @@ extension APIServer {
                 .first
             if defaultNetwork == nil {
                 // FIXME: default network should be configurable elsewhere
-                let config = try NetworkConfiguration(
-                    name: NetworkClient.defaultNetworkName,
-                    mode: .nat,
-                    ipv4Subnet: containerSystemConfig.network.subnet,
-                    ipv6Subnet: containerSystemConfig.network.subnetv6,
-                    labels: try .init([ResourceLabelKeys.role: ResourceRoleValues.builtin]),
-                    plugin: "container-network-vmnet"
-                )
-                _ = try await service.create(configuration: config)
+                _ = try await service.create(configuration: defaultNetworkConfig)
             }
 
             let harness = NetworksHarness(service: service, log: log)
diff --git a/Sources/Services/ContainerAPIService/Server/Networks/NetworksService.swift b/Sources/Services/ContainerAPIService/Server/Networks/NetworksService.swift
index ac21b524..6be54acb 100644
--- a/Sources/Services/ContainerAPIService/Server/Networks/NetworksService.swift
+++ b/Sources/Services/ContainerAPIService/Server/Networks/NetworksService.swift
@@ -51,6 +51,7 @@ public actor NetworksService {
         pluginLoader: PluginLoader,
         resourceRoot: FilePath,
         containersService: ContainersService,
+        defaultNetworkConfiguration: NetworkConfiguration,
         log: Logger,
         debugHelpers: Bool = false,
     ) async throws {
@@ -78,28 +79,14 @@ public actor NetworksService {
 
         let configurations = try await store.list()
         for configuration in configurations {
-            // Ensure the network with id "default" is marked as builtin.
-            var updatedLabels: [String: String]?
-            if configuration.id == NetworkClient.defaultNetworkName {
-                let role = configuration.labels[ResourceLabelKeys.role]
-                if role == nil || role != ResourceRoleValues.builtin {
-                    var labels = configuration.labels.dictionary
-                    labels[ResourceLabelKeys.role] = ResourceRoleValues.builtin
-                    updatedLabels = labels
-                }
-            }
+            var effectiveConfiguration = configuration
 
-            if let updatedLabels {
-                let updatedConfiguration = try NetworkConfiguration(
-                    name: configuration.name,
-                    mode: configuration.mode,
-                    ipv4Subnet: configuration.ipv4Subnet,
-                    ipv6Subnet: configuration.ipv6Subnet,
-                    labels: try .init(updatedLabels),
-                    plugin: configuration.plugin,
-                    options: configuration.options
-                )
-                try await store.update(updatedConfiguration)
+            // If there's a default network in the store, always update it with the
+            // computed default network configuration from the apiserver to ensure we
+            // have the correct default values configured.
+            if effectiveConfiguration.id == NetworkClient.defaultNetworkName {
+                effectiveConfiguration = defaultNetworkConfiguration
+                try await store.update(effectiveConfiguration)
             }
 
             // Start up the network.
@@ -108,23 +95,11 @@ public actor NetworksService {
             // 5 seconds or considerably more from the registration of this first
             // network service to its execution.
             do {
-                try await registerService(configuration: configuration)
-                let client = try Self.getClient(configuration: configuration)
+                try await registerService(configuration: effectiveConfiguration)
+                let client = try Self.getClient(configuration: effectiveConfiguration)
                 let networkStatus = try await client.status()
-                let finalConfiguration =
-                    updatedLabels.flatMap { labels in
-                        try? NetworkConfiguration(
-                            name: configuration.name,
-                            mode: configuration.mode,
-                            ipv4Subnet: configuration.ipv4Subnet,
-                            ipv6Subnet: configuration.ipv6Subnet,
-                            labels: (try? ResourceLabels(labels)) ?? configuration.labels,
-                            plugin: configuration.plugin,
-                            options: configuration.options
-                        )
-                    } ?? configuration
-                serviceStates[finalConfiguration.id] = NetworkEntry(
-                    configuration: finalConfiguration,
+                serviceStates[effectiveConfiguration.id] = NetworkEntry(
+                    configuration: effectiveConfiguration,
                     status: networkStatus,
                     client: client
                 )
@@ -132,7 +107,7 @@ public actor NetworksService {
                 log.error(
                     "failed to start network",
                     metadata: [
-                        "id": "\(configuration.id)",
+                        "id": "\(effectiveConfiguration.id)",
                         "error": "\(error)",
                     ])
             }