3 files changed, 36 insertions, 7 deletions

diff --git a/libpod/container.go b/libpod/container.go
index b6155a809..b5346e581 100644
--- a/libpod/container.go
+++ b/libpod/container.go
@@ -1001,13 +1001,28 @@ func (c *Container) IsReadOnly() bool {
 }
 
 // NetworkDisabled returns whether the container is running with a disabled network
-func (c *Container) NetworkDisabled() bool {
+func (c *Container) NetworkDisabled() (bool, error) {
+	if c.config.NetNsCtr != "" {
+		container, err := c.runtime.LookupContainer(c.config.NetNsCtr)
+		if err != nil {
+			return false, err
+		}
+		return networkDisabled(container)
+	}
+	return networkDisabled(c)
+
+}
+
+func networkDisabled(c *Container) (bool, error) {
+	if c.config.CreateNetNS {
+		return false, nil
+	}
 	if !c.config.PostConfigureNetNS {
 		for _, ns := range c.config.Spec.Linux.Namespaces {
 			if ns.Type == spec.NetworkNamespace {
-				return ns.Path == ""
+				return ns.Path == "", nil
 			}
 		}
 	}
-	return false
+	return false, nil
 }
diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index 934ad7a22..0148e3e7c 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -601,7 +601,11 @@ func (c *Container) checkDependenciesRunningLocked(depCtrs map[string]*Container
 }
 
 func (c *Container) completeNetworkSetup() error {
-	if !c.config.PostConfigureNetNS || c.NetworkDisabled() {
+	netDisabled, err := c.NetworkDisabled()
+	if err != nil {
+		return err
+	}
+	if !c.config.PostConfigureNetNS || netDisabled {
 		return nil
 	}
 	if err := c.syncContainer(); err != nil {
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index b540bbeb8..f9b0592f9 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -136,7 +136,14 @@ func (c *Container) prepare() (err error) {
 
 // cleanupNetwork unmounts and cleans up the container's network
 func (c *Container) cleanupNetwork() error {
-	if c.NetworkDisabled() {
+	if c.config.NetNsCtr != "" {
+		return nil
+	}
+	netDisabled, err := c.NetworkDisabled()
+	if err != nil {
+		return err
+	}
+	if netDisabled {
 		return nil
 	}
 	if c.state.NetNS == nil {
@@ -180,7 +187,6 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
 	if err := c.makeBindMounts(); err != nil {
 		return nil, err
 	}
-
 	// Check if the spec file mounts contain the label Relabel flags z or Z.
 	// If they do, relabel the source directory and then remove the option.
 	for _, m := range g.Mounts() {
@@ -633,8 +639,12 @@ func (c *Container) makeBindMounts() error {
 	if c.state.BindMounts == nil {
 		c.state.BindMounts = make(map[string]string)
 	}
+	netDisabled, err := c.NetworkDisabled()
+	if err != nil {
+		return err
+	}
 
-	if !c.NetworkDisabled() {
+	if !netDisabled {
 		// Make /etc/resolv.conf
 		if _, ok := c.state.BindMounts["/etc/resolv.conf"]; ok {
 			// If it already exists, delete so we can recreate