libpod: fix netavark DNS for rootful Podman in LXC

[vfreex]

Fixes #18783

Dependency support: podman-container-tools/container-libs#932

Summary

When Podman runs as UID 0 inside a delegated container environment such as Incus/LXC, it should use rootful networking semantics, like it does in a VM. If the environment does not delegate the networking capability needed for rootful bridge setup, Podman should fail clearly before calling netavark instead of producing a container with broken aardvark DNS.

The reported failure mode is especially confusing for netavark/aardvark DNS: Podman can create network status that causes the container resolv.conf to point at aardvark, while aardvark was started through rootless behavior and failed with systemd-run --user. The result is a container that appears to start successfully but has broken DNS.

Behavior change

• UID 0 rootful bridge networking now checks effective CAP_NET_ADMIN before calling netavark.
• Non-root/rootless Podman remains on the existing rootless setup path.
• Existing UID 0 startup/runtime behavior is otherwise preserved.

This makes the networking boundary explicit:

• Non-root Podman: rootless networking behavior
• UID 0 with delegated networking capability: rootful bridge networking behavior
• UID 0 without CAP_NET_ADMIN: clear error before netavark setup

Rationale

Incus/LXC containers are guest environments. UID 0 inside the guest should be treated like UID 0 inside a VM for Podman's networking mode selection when the required capability is delegated. If CAP_NET_ADMIN is not delegated, silently continuing into netavark can produce partial network/DNS state.

Rootful aardvark startup does not use systemd-run --user; that flag is only added by netavark when it is in rootless mode. The dependency PR keeps UID 0 in nested user namespaces on rootful network paths by using the original caller UID for network path selection.

This PR currently has a local CAP_NET_ADMIN helper. Once the container-libs dependency PR is merged and vendored, this should be replaced with unshare.HasCapNetAdmin().

Tests

• gofmt
• git diff --check
• GOCACHE=/private/tmp/podman-go-cache go test ./libpod ./pkg/domain/infra/abi

Note: libpod Linux-only tests are not executed on this macOS workspace; the package reports no test files here.

[Luap99]

This does not fix anything though it just creates an error if we do not have CAP_NET_ADMIN which should only happen if we run with CAP_SYS_ADMIN but without CAP_NET_ADMIN which is not something I have ever seen as such I do not see the need to add additional checks for it.

[Luap99]

also note https://github.com/podman-container-tools/podman/blob/main/LLM_POLICY.md