7 files changed, 29 insertions, 13 deletions
diff --git a/libpod/container.go b/libpod/container.go
index d5d5ef1a5..80fd35c09 100644
--- a/libpod/container.go
+++ b/libpod/container.go
@@ -240,7 +240,7 @@ type ContainerImageVolume struct {
 type ContainerSecret struct {
 	// Secret is the secret
 	*secrets.Secret
-	// UID is tbe UID of the secret file
+	// UID is the UID of the secret file
 	UID uint32
 	// GID is the GID of the secret file
 	GID uint32
diff --git a/libpod/container_config.go b/libpod/container_config.go
index 72a969fe6..e15030c15 100644
--- a/libpod/container_config.go
+++ b/libpod/container_config.go
@@ -376,6 +376,6 @@ type ContainerMiscConfig struct {
 	// EnvSecrets are secrets that are set as environment variables
 	EnvSecrets map[string]*secrets.Secret `json:"secret_env,omitempty"`
 	// InitContainerType specifies if the container is an initcontainer
-	// and if so, what type: always or oneshot are possible non-nil entries
+	// and if so, what type: always or once are possible non-nil entries
 	InitContainerType string `json:"init_container_type,omitempty"`
 }
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index 6d2f7bddc..f21aebb09 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -1782,7 +1782,7 @@ func (c *Container) generateResolvConf() (string, error) {
 	cniResponse := c.state.NetworkStatus
 	for _, i := range cniResponse {
 		for _, ip := range i.IPs {
-			// Note: only using To16() does not work since it also returns a vaild ip for ipv4
+			// Note: only using To16() does not work since it also returns a valid ip for ipv4
 			if ip.Address.IP.To4() == nil && ip.Address.IP.To16() != nil {
 				ipv6 = true
 			}
diff --git a/libpod/container_log_linux.go b/libpod/container_log_linux.go
index d4afaa52a..11f1be7f9 100644
--- a/libpod/container_log_linux.go
+++ b/libpod/container_log_linux.go
@@ -79,7 +79,7 @@ func (c *Container) readFromJournal(ctx context.Context, options *logs.LogOption
 		break
 	}
 	if cursorError != nil {
-		return errors.Wrap(cursorError, "inital journal cursor")
+		return errors.Wrap(cursorError, "initial journal cursor")
 	}
 
 	// We need the container's events in the same journal to guarantee
diff --git a/libpod/define/container.go b/libpod/define/container.go
index f0aca92aa..bb44a6a4a 100644
--- a/libpod/define/container.go
+++ b/libpod/define/container.go
@@ -34,5 +34,5 @@ const (
 	AlwaysInitContainer = "always"
 	// OneShotInitContainer is a container that only runs as init once
 	// and is then deleted.
-	OneShotInitContainer = "oneshot"
+	OneShotInitContainer = "once"
 )
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go
index 8e9b5997c..2ed2bb01b 100644
--- a/libpod/networking_linux.go
+++ b/libpod/networking_linux.go
@@ -173,11 +173,27 @@ func (r *RootlessCNI) Do(toRun func() error) error {
 		// the link target will be available in the mount ns.
 		// see: https://github.com/containers/podman/issues/10855
 		resolvePath := "/etc/resolv.conf"
-		resolvePath, err = filepath.EvalSymlinks(resolvePath)
-		if err != nil {
-			return err
+		for i := 0; i < 255; i++ {
+			// Do not use filepath.EvalSymlinks, we only want the first symlink under /run.
+			// If /etc/resolv.conf has more than one symlink under /run, e.g.
+			// -> /run/systemd/resolve/stub-resolv.conf -> /run/systemd/resolve/resolv.conf
+			// we would put the netns resolv.conf file to the last path. However this will
+			// break dns because the second link does not exists in the mount ns.
+			// see https://github.com/containers/podman/issues/11222
+			link, err := os.Readlink(resolvePath)
+			if err != nil {
+				// if there is no symlink exit
+				break
+			}
+			resolvePath = filepath.Join(filepath.Dir(resolvePath), link)
+			if strings.HasPrefix(resolvePath, "/run/") {
+				break
+			}
+			if i == 254 {
+				return errors.New("too many symlinks while resolving /etc/resolv.conf")
+			}
 		}
-		logrus.Debugf("The actual path of /etc/resolv.conf on the host is %q", resolvePath)
+		logrus.Debugf("The path of /etc/resolv.conf in the mount ns is %q", resolvePath)
 		// When /etc/resolv.conf on the host is a symlink to /run/systemd/resolve/stub-resolv.conf,
 		// we have to mount an empty filesystem on /run/systemd/resolve in the child namespace,
 		// so as to isolate the directory from the host mount namespace.
@@ -1219,7 +1235,7 @@ func (c *Container) NetworkDisconnect(nameOrID, netName string, force bool) erro
 		return err
 	}
 
-	// OCICNI will set the loopback adpter down on teardown so we should set it up again
+	// OCICNI will set the loopback adapter down on teardown so we should set it up again
 	err = c.state.NetNS.Do(func(_ ns.NetNS) error {
 		link, err := netlink.LinkByName("lo")
 		if err != nil {
@@ -1229,7 +1245,7 @@ func (c *Container) NetworkDisconnect(nameOrID, netName string, force bool) erro
 		return err
 	})
 	if err != nil {
-		logrus.Warnf("failed to set loopback adpter up in the container: %v", err)
+		logrus.Warnf("failed to set loopback adapter up in the container: %v", err)
 	}
 	// Reload ports when there are still connected networks, maybe we removed the network interface with the child ip.
 	// Reloading without connected networks does not make sense, so we can skip this step.
diff --git a/libpod/pod_api.go b/libpod/pod_api.go
index 6fea2dfd8..716eb2e5b 100644
--- a/libpod/pod_api.go
+++ b/libpod/pod_api.go
@@ -32,14 +32,14 @@ func (p *Pod) startInitContainers(ctx context.Context) error {
 		if rc != 0 {
 			return errors.Errorf("init container %s exited with code %d", initCon.ID(), rc)
 		}
-		// If the container is an oneshot init container, we need to remove it
+		// If the container is a once init container, we need to remove it
 		// after it runs
 		if initCon.Config().InitContainerType == define.OneShotInitContainer {
 			icLock := initCon.lock
 			icLock.Lock()
 			if err := p.runtime.removeContainer(ctx, initCon, false, false, true); err != nil {
 				icLock.Unlock()
-				return errors.Wrapf(err, "failed to remove oneshot init container %s", initCon.ID())
+				return errors.Wrapf(err, "failed to remove once init container %s", initCon.ID())
 			}
 			// Removing a container this way requires an explicit call to clean up the db
 			if err := p.runtime.state.RemoveContainerFromPod(p, initCon); err != nil {