nixos/containers: fix default gateway with privateNetwork (#523016)

nixos/modules/virtualisation/nixos-containers.nix

@@ -524,6 +524,19 @@ let
     tmpfs = null;
   };
 
+  # Parses an IPv4 address with an optional prefix
+  ipv4FromString =
+    str:
+    let
+      segments = lib.splitString "/" str;
+      prefix = lib.elemAt segments 1;
+      hasPrefix = builtins.length segments == 2;
+    in
+    {
+      address = lib.head segments;
+      prefixLength = if hasPrefix then builtins.fromJSON prefix else 32;
+    };
+
 in
 
 {
@@ -594,6 +607,14 @@ in
                                 boot.isNspawnContainer = true;
                                 networking.hostName = mkDefault name;
                                 networking.useDHCP = false;
+                                networking.interfaces = lib.mkIf config.privateNetwork {
+                                  eth0.ipv4.addresses = lib.optional (config.localAddress != null) (
+                                    ipv4FromString config.localAddress
+                                  );
+                                  eth0.ipv6.addresses = lib.optional (config.localAddress6 != null) (
+                                    lib.network.ipv6.fromString config.localAddress6
+                                  );
+                                };
                                 assertions = [
                                   {
                                     assertion =

nixos/tests/all-tests.nix

@@ -386,6 +386,7 @@ in
   containers-custom-pkgs = runTest ./containers-custom-pkgs.nix;
   containers-ephemeral = runTest ./containers-ephemeral.nix;
   containers-extra_veth = runTest ./containers-extra_veth.nix;
+  containers-gateway = runTest ./containers-gateway.nix;
   containers-hosts = runTest ./containers-hosts.nix;
   containers-imperative = runTest ./containers-imperative.nix;
   containers-ip = runTest ./containers-ip.nix;

nixos/tests/containers-gateway.nix

@@ -0,0 +1,67 @@
+let
+  hostIp4 = "192.168.0.1";
+  containerIp4 = "192.168.0.100/24";
+  hostIp6 = "fc00::1";
+  containerIp6 = "fc00::2/7";
+in
+
+{ lib, ... }:
+{
+  name = "containers-gateway";
+  meta = {
+    maintainers = with lib.maintainers; [
+      rnhmjoj
+    ];
+  };
+
+  nodes.machine = {
+    networking.bridges = {
+      br0.interfaces = [ ];
+    };
+    networking.interfaces = {
+      br0.ipv4.addresses = [
+        {
+          address = hostIp4;
+          prefixLength = 24;
+        }
+      ];
+      br0.ipv6.addresses = [
+        {
+          address = hostIp6;
+          prefixLength = 7;
+        }
+      ];
+    };
+
+    containers.test = {
+      autoStart = true;
+      privateNetwork = true;
+      hostBridge = "br0";
+      localAddress = containerIp4;
+      localAddress6 = containerIp6;
+      config.networking = {
+        defaultGateway.address = hostIp4;
+        defaultGateway6.address = hostIp6;
+      };
+    };
+  };
+
+  testScript = ''
+    def container_succeed(command: str):
+        machine.succeed(f"nixos-container run test -- {command}")
+
+    machine.wait_for_unit("default.target")
+    assert "test" in machine.succeed("nixos-container list")
+
+    with subtest("Container has started"):
+        assert "up" in machine.succeed("nixos-container status test")
+
+    with subtest("Container can ping the host"):
+        container_succeed("ping -n -c 1 ${hostIp4}")
+        container_succeed("ping -n -c 1 ${hostIp6}")
+
+    with subtest("Container default gateways are set"):
+        container_succeed("ip -4 route show default | grep 'via ${hostIp4}'")
+        container_succeed("ip -6 route show default | grep 'via ${hostIp6}'")
+  '';
+}