add MAC, IPv4, IPv6 addresses to nework inspect by coderbirju · Pull Request #4680 · containerd/nerdctl

coderbirju · 2026-01-07T03:43:59Z

Current network inspect respone provides only container names
This PR adds other fields in the EndpointResource Struct

Testing:

CIDR Notation:

$ sudo nerdctl network create test-net --subnet 10.88.0.0/16
$ sudo nerdctl run -d --name test-container --network test-net nginx:alpine
$ sudo nerdctl network inspect test-net | jq -r '.[].Containers'

Result

{
  "70aaec372b1f...": {
    "Name": "test-container",
    "MacAddress": "fe:5d:85:64:d2:96",
    "IPv4Address": "10.88.0.2/16", 
    "IPv6Address": ""
  }
}

Multi-Network Container:

$ sudo nerdctl network create hoge --subnet 10.91.0.0/16
$ sudo nerdctl network create fuga --subnet 10.92.0.0/16
$ sudo nerdctl run -d --name test2 --network hoge --network fuga nginx:alpine

-hoge

$ sudo nerdctl network inspect hoge | jq -r '.[].Containers'

{
  "0d7e17a42d25...": {
    "Name": "test2",
    "MacAddress": "ca:ad:6d:42:7a:03",  ← Unique to hoge
    "IPv4Address": "10.91.0.3/16",      ← From hoge subnet
    "IPv6Address": ""
  }
}

-fuga

$ sudo nerdctl network inspect fuga | jq -r '.[].Containers'


{
  "0d7e17a42d25...": {
    "Name": "test2",
    "MacAddress": "ca:f2:87:2c:4e:df",  ← Different MAC
    "IPv4Address": "10.92.0.2/16",      ← Different IP from fuga subnet
    "IPv6Address": ""
  }
}

cmd/nerdctl/network/network_inspect_test.go

pkg/inspecttypes/dockercompat/dockercompat.go

coderbirju · 2026-01-21T23:05:54Z

Apologies for the late reply, you're right we can skip the assert statements as the field existence is already validated through struct unmarshaling.

@haytok

haytok · 2026-01-31T11:35:44Z

cmd/nerdctl/network/network_inspect_test.go

+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("network", "inspect", data.Identifier("test-network"))
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {


There are no tests for the items added in this PR's changes. Should add assertions for IPv4Address, MacAddress, and IPv6Address.

pkg/inspecttypes/dockercompat/dockercompat.go

Signed-off-by: Arjun Raja Yogidas <arjunry@amazon.com>

coderbirju · 2026-02-17T19:34:58Z

Failures seem to be unrelated to the changes
PTAL
@haytok @Shubhranshu153

haytok · 2026-02-18T15:23:37Z

Thanks for fixes. I'll reply within this week 🙏

haytok

I've added some comments but, can we add a test for when a container belongs to two networks?

(There were a few points I wasn’t able to comment on in my previous review. I apologize for the inconvenience 🙏)

haytok · 2026-02-19T14:44:15Z

pkg/inspecttypes/dockercompat/dockercompat.go

+			continue
+		}
+
+		if len(subnets) > 0 {


What situations can lead to an empty subnets list?

haytok · 2026-02-19T15:12:40Z

cmd/nerdctl/network/network_inspect_test.go

+
+						// Test IPv4Address has CIDR notation (not empty and contains '/')
+						assert.Assert(t, container.IPv4Address != "", "IPv4Address should not be empty")
+						assert.Assert(t, strings.Contains(container.IPv4Address, "/"), "IPv4Address should contain CIDR notation with /")


IMO, it would be better to verify that the container IP is within the subnet, in addition to checking that container.IPv4Address contains /.

Example:

_, subnet, _ := net.ParseCIDR(dc[0].IPAM.Config[0].Subnet) containerIP, _, _ := net.ParseCIDR(container.IPv4Address) assert.Assert(t, subnet.Contains(containerIP), "IPv4Address should be within the network's subnet")

haytok · 2026-02-21T12:19:45Z

cmd/nerdctl/network/network_inspect_test.go

+						assert.Assert(t, strings.Contains(container.IPv4Address, "/"), "IPv4Address should contain CIDR notation with /")
+
+						// Test MacAddress is present and has valid format
+						assert.Assert(t, container.MacAddress != "", "MacAddress should not be empty")
+
+						// Test IPv6Address is empty for IPv4-only network
+						assert.Equal(t, "", container.IPv6Address, "IPv6Address should be empty for IPv4-only network")


When checking CI logs, there are below messages:

network_inspect_test.go:446: assertion failed: container.IPv4Address is "": IPv4Address should not be empty

This is because nerdctl network inspect on windows environments does not return NetNS information.

nerdctl/pkg/containerinspector/containerinspector_windows.go

Lines 25 to 29 in deec874

func InspectNetNS(ctx context.Context, pid int) (*native.NetNS, error) {

r := &native.NetNS{}

return r, nil

}

haytok · 2026-02-21T12:57:20Z

pkg/inspecttypes/dockercompat/dockercompat.go

+			if subnet.Contains(ip) {
+				endpoint.MacAddress = iface.HardwareAddr
+				setIPAddresses(endpoint, addr)
+				return true


In the current implementation, when a container belongs to a dual-stack network with both IPv4 and IPv6, only one IP address is displayed. Both IPv4 and IPv6 addresses should be displayed.

sudo nerdctl network create --ipv6 --subnet 10.1.0.0/24 --subnet fd00::/64 test-dual-stack sudo nerdctl run -d --name test-container --network test-dual-stack alpine sleep infinity sudo nerdctl network inspect test-dual-stack | jq -r '.[].Containers'

+1 here we are returning true but we are parsing a range of subnets.

Shubhranshu153 · 2026-02-22T03:08:37Z

pkg/inspecttypes/dockercompat/dockercompat.go

+	return subnets
+}
+
+// isUsableInterface checks if a network interface is usable (not loopback and up)


nit: and interface is up.

Shubhranshu153 · 2026-02-22T03:11:57Z

pkg/inspecttypes/dockercompat/dockercompat.go

+func matchInterfaceToSubnets(endpoint *EndpointResource, iface *native.NetInterface, subnets []*net.IPNet) bool {
+	for _, addr := range iface.Addrs {
+		ip, _, err := net.ParseCIDR(addr)
+		if err != nil || ip.IsLoopback() || ip.IsLinkLocalUnicast() {


nit: handle error and other conditional separately. Not important but the purpose is different.

Shubhranshu153 · 2026-02-22T03:33:49Z

pkg/inspecttypes/dockercompat/dockercompat.go

-	// IPv4Address string `json:"IPv4Address"`
-	// IPv6Address string `json:"IPv6Address"`
+	MacAddress  string `json:"MacAddress"`
+	IPv4Address string `json:"IPv4Address"`


we are parsing a range of subnets but we are supposed take the first IPV4 and one IPV6 address i think for docker compatibility, how that is decided?

Shubhranshu153 · 2026-02-22T03:37:34Z

pkg/inspecttypes/dockercompat/dockercompat.go

-	// IPv6Address string `json:"IPv6Address"`
+	MacAddress  string `json:"MacAddress"`
+	IPv4Address string `json:"IPv4Address"`
+	IPv6Address string `json:"IPv6Address"`


nit: GlobalIPV6Address
compatible with convention in https://docs.docker.com/reference/api/engine/version/v1.44/#tag/Container/operation/ContainerInspect

coderbirju closed this Jan 7, 2026

coderbirju reopened this Jan 7, 2026

coderbirju force-pushed the add-details-network-inspect branch from 2385db1 to eb356cf Compare January 9, 2026 00:27

haytok reviewed Jan 10, 2026

View reviewed changes

cmd/nerdctl/network/network_inspect_test.go Outdated Show resolved Hide resolved

pkg/inspecttypes/dockercompat/dockercompat.go Outdated Show resolved Hide resolved

coderbirju force-pushed the add-details-network-inspect branch from eb356cf to 365205b Compare January 21, 2026 22:35

coderbirju closed this Jan 29, 2026

coderbirju reopened this Jan 29, 2026

haytok reviewed Feb 1, 2026

View reviewed changes

AkihiroSuda added this to the v2.3.0 milestone Feb 4, 2026

add MAC, IPv4, IPv6 addresses to nework inspect

0756765

Signed-off-by: Arjun Raja Yogidas <arjunry@amazon.com>

coderbirju force-pushed the add-details-network-inspect branch from 365205b to 0756765 Compare February 9, 2026 23:01

coderbirju requested a review from haytok February 10, 2026 20:06

haytok reviewed Feb 21, 2026

View reviewed changes

Shubhranshu153 reviewed Feb 22, 2026

View reviewed changes

	func InspectNetNS(ctx context.Context, pid int) (*native.NetNS, error) {
	r := &native.NetNS{}

	return r, nil
	}

Comments

Conversation

coderbirju commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderbirju commented Jan 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

coderbirju commented Feb 17, 2026

Uh oh!

haytok commented Feb 18, 2026

Uh oh!

haytok left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coderbirju commented Jan 7, 2026 •

edited

Loading

haytok left a comment •

edited

Loading