Combining `--internal`&`--disable-dns` creates network without gateway

[0xF4CED]

Issue Description

When creating a network with both --internal&--disable-dns podman creates it without assigning a gateway address.
This is not an immediate problem but can become one down the line, for example, regarding docker compatibility. (see below)

Steps to reproduce the issue

Steps to reproduce the issue

1. podman network create testgw --internal --disable-dns
2. podman network inspect testgw | jq -r '.[].subnets'
3. podman container run -d --rm --net testgw alpine sleep 600
4. curl -s --unix-socket /var/run/user/$UID/podman/podman.sock http://localhost/containers/json | jq -r '.[-1].NetworkSettings.Networks.testgw.Gateway'

Describe the results you received

The testgw network does not have a gateway address field in the created network config.
When querying the api for the gateway address of a container that is part of the testgw network, a value of <nil> is returned.

Describe the results you expected

With docker/moby it is not possible to create a network that does not have a gateway address.
This causes an incompatibility with docker or applications that are expecting dockers behavior, like the moby client for the Docker Engine API because this module does not handle the <nil> value returned by podman. (see below)

podman info output

host:
  arch: amd64
  buildahVersion: 1.43.1
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.2.1-2.fc44.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.2.1, commit: '
  cpuUtilization:
    idlePercent: 91.8
    systemPercent: 2.52
    userPercent: 5.69
  cpus: 4
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: iot
    version: "44"
  eventLogger: journald
  freeLocks: 1984
  hostname: podmore
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 6553600
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 6553600
  kernel: 6.19.14-300.fc44.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 188235776
  memTotal: 8218030080
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    defaultNetwork: podman
    dns:
      package: aardvark-dns-1.17.1-1.fc44.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.17.1
    package: netavark-1.17.2-1.fc44.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.17.2
  ociRuntime:
    name: crun
    package: crun-1.27.1-1.fc44.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.27.1
      commit: 3ec076b3b6714ec2f1a10533cf18d5605a6de637
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20260120.g386b5f5-1.fc44.x86_64
    version: |
      pasta 0^20260120.g386b5f5-1.fc44.x86_64
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.3.1-4.fc44.x86_64
    version: |-
      slirp4netns version 1.3.1
      commit: e5e368c4f5db6ae75c2fce786e31eef9da6bf236
      libslirp: 4.9.1
      SLIRP_CONFIG_VERSION_MAX: 6
      libseccomp: 2.6.0
  swapFree: 7479259136
  swapTotal: 8217686016
  uptime: 2h 4m 58.00s (Approximately 0.08 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
store:
  configFile: /var/home/podm/.config/containers/storage.conf
  containerStore:
    number: 40
    paused: 0
    running: 40
    stopped: 0
  graphDriverName: btrfs
  graphOptions: {}
  graphRoot: /var/home/podm/.local/share/containers/storage
  graphRootAllocated: 498403901440
  graphRootUsed: 151056179200
  graphStatus:
    Build Version: Btrfs v6.19.1
    Library Version: "105"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 61
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /var/home/podm/.local/share/containers/storage/volumes
version:
  APIVersion: 5.8.2
  BuildOrigin: Fedora Project
  Built: 1776124800
  BuiltTime: Tue Apr 14 02:00:00 2026
  GitCommit: 5b263b5f5b48004a87caac44e67349a8266d9ef4
  GoVersion: go1.26.1-X:nodwarf5
  Os: linux
  OsArch: linux/amd64
  Version: 5.8.2

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Additional environment details

No response

Additional information

An example where this becomes problematic is traefik:v3.6.16+ migrating to github.com/moby/moby modules.
When using autodiscovery through the podman.sock, the API returns "Gateway": "<nil>" which can't be parsed, resulting in total failure of the traefik service.
As long as any container exists that is connected to a network without a gateway address, this scenario fails.

podman network create testgw --internal --disable-dns

podman run -it --rm --network testgw --userns host --security-opt label=disable -v /run/user/$UID/podman/podman.sock:/var/run/docker.sock docker.io/library/traefik:3.6.16 --providers.docker=true --log.level=TRACE

DBG github.com/traefik/traefik/v3/pkg/provider/docker/pdocker.go:79 > Provider connection established with docker 5.8.2 (API 1.44) providerName=docker
ERR github.com/traefik/traefik/v3/pkg/provider/docker/pdocker.go:83 > Failed to list containers for docker error="ParseAddr(\"<nil>\"): unable to parse IP" providerName=docker
ERR github.com/traefik/traefik/v3/pkg/provider/docker/pdocker.go:142 > Provider error, retrying in 3.603386284s error="ParseAddr(\"<nil>\"): unable to parse IP" providerName=docker

[Luap99]

so creating a network without a gateway seems valid and a bit more secure in the sense that there will be nothing which could be used as gateway address.

Looking at the parsing error is the issue here just the <nil> string? It seems like we should never put that as string, if anything the gateway string must be empty. Would an empty string work parsing wise?

Looking at main we moved to the moby module as well and now the error happens already on the podman endpoint side.

[0xF4CED]

Looking at the parsing error is the issue here just the string? It seems like we should never put that as string, if anything the gateway string must be empty.

That was my first thought as well.

Would an empty string work parsing wise?

Unfortunately no: invalid IP ParseAddr(""): unable to parse IP (net/netip)

[Luap99]

Would an empty string work parsing wise?

Unfortunately no: invalid IP ParseAddr(""): unable to parse IP (net/netip)

The parse function no, but the empty string is never passed into it when parsing the json:

https://github.com/golang/go/blob/7601c4bf422b92ceb77bfd99c83aa9d392906858/src/net/netip/netip.go#L1001-L1014

As long as traefik or whatever else does not try to access the zero Addr and expect it to be valid I see no problem.

[0xF4CED]

Okay, yes that will work, the address is never actually accessed. Thank you!