nerdctl compose up requires CNI plugins to be installed (for network_mode: host)

[josv-openai]

Good morning. I want to use nerdctl compose up with network_mode: host on a node that does not have the CNI plugins (like bridge and portmap) installed. Here is an example compose file:

services:
  alpine:
    image: alpine
    network_mode: host
    stdin_open: true
    tty: true

When I run nerdctl compose up I get the following error:

FATA[0000] failed to create default network: needs CNI plugin "bridge" to be installed in CNI_PATH ("/opt/cni/bin"), see https://github.com/containernetworking/plugins/releases: exec: "/opt/cni/bin/bridge": stat /opt/cni/bin/bridge: no such file or directory

The CNI plugins are not installed (and we don't want to install them). This error tracks back to https://github.com/containerd/nerdctl/blob/main/pkg/cmd/compose/compose.go#L68:

	cniEnv, err := netutil.NewCNIEnv(globalOptions.CNIPath, globalOptions.CNINetConfPath, netutil.WithNamespace(globalOptions.Namespace), netutil.WithDefaultNetwork(globalOptions.BridgeIP))

The inclusion of netutil.WithDefaultNetwork(globalOptions.BridgeIP) here checks if there is either a default network configured (through name or label), and if there is not, it creates a bridge network. Note that all of this is done before reading the compose file, so before realizing that network_mode might be set to none or host.

If I build my own nerdctl without the offending stanza, it all works swimmingly, but if you then want to compose up a container that requires a network configuration, you get a slightly more confusing error later in the process.

Any thoughts about this? I might be able to hack around this, but it might be worthwhile to change the flow somewhat and allow for this use case.

[vosdev]

Running everything with network_mode: host myself as well. Have explicitly configured docker daemon with { "bridge": "none", "iptables": false }. Are there any similar options for nerdctl ?

I've created an issue: #4461