Mask dhcpcd in molecule images to fix DNS resolution failures

dhcpcd is installed (and enabled by its package's default preset) in the
raspberrypi/debian/ubuntu/proxmox molecule images to mimic each distro's
default boot environment. Inside podman's virtual network there's no
real DHCP server for it to negotiate with, so it only ever gets a
link-local address and overwrites /etc/resolv.conf with an empty file
(just dhcpcd's template comments, no nameserver line). This happens
within the first minute or two of container boot — fast enough to break
DNS resolution for apt-get tasks later in the same converge run.

Reproduced and confirmed on all four affected scenarios (raspberrypi,
debian, ubuntu, proxmox — each installs dhcpcd the same way): apt-get
tasks failed with repeated "Temporary failure resolving" errors at
varying points in the play depending on timing. archlinux/archlinux-gnome
and git (Alpine) don't install dhcpcd and are unaffected.

The network role already intends to remove dhcpcd/avahi-daemon entirely
(replacing them with NetworkManager/systemd-resolved), but that removal
task runs after earlier package-install steps — so the very service
being phased out was sabotaging tasks that ran before it got purged.

Masking dhcpcd.service at image-build time prevents it from ever running
in these test containers, closing the race without touching any role's
actual task order or logic (which reflects real hardware, where dhcpcd
does get a valid lease from an actual router).

Co-Authored-By: Claude.ai

3 files changed, 18 insertions, 0 deletions

diff --git a/molecule/debian/Dockerfile.j2 b/molecule/debian/Dockerfile.j2
index 2e047439..dd5b1778 100644
--- a/molecule/debian/Dockerfile.j2
+++ b/molecule/debian/Dockerfile.j2
@@ -20,6 +20,12 @@ RUN rm -f /lib/systemd/system/multi-user.target.wants/getty.target
 RUN systemctl enable avahi-daemon \
     && touch /etc/locale.gen
 
+# dhcpcd never gets a real lease on podman's virtual network (no DHCP
+# server to answer it) and clobbers /etc/resolv.conf with an empty file,
+# breaking DNS for later apt-get tasks. Mask it here; the network role
+# still purges the dhcpcd package itself later as part of its real logic.
+RUN systemctl mask dhcpcd.service
+
 VOLUME ["/sys/fs/cgroup", "/tmp", "/run", "/opt"]
 
 CMD ["/lib/systemd/systemd"]
diff --git a/molecule/proxmox/Dockerfile.j2 b/molecule/proxmox/Dockerfile.j2
index 39de5170..4c3cc008 100644
--- a/molecule/proxmox/Dockerfile.j2
+++ b/molecule/proxmox/Dockerfile.j2
@@ -24,6 +24,12 @@ RUN rm -f /lib/systemd/system/multi-user.target.wants/getty.target
 RUN systemctl enable avahi-daemon \
     && touch /etc/locale.gen
 
+# dhcpcd never gets a real lease on podman's virtual network (no DHCP
+# server to answer it) and clobbers /etc/resolv.conf with an empty file,
+# breaking DNS for later apt-get tasks. Mask it here; the network role
+# still purges the dhcpcd package itself later as part of its real logic.
+RUN systemctl mask dhcpcd.service
+
 VOLUME ["/sys/fs/cgroup", "/tmp", "/run", "/opt"]
 
 CMD ["/lib/systemd/systemd"]
diff --git a/molecule/ubuntu/Dockerfile.j2 b/molecule/ubuntu/Dockerfile.j2
index 64070d4d..1d2eadd1 100644
--- a/molecule/ubuntu/Dockerfile.j2
+++ b/molecule/ubuntu/Dockerfile.j2
@@ -25,6 +25,12 @@ RUN rm -f /lib/systemd/system/getty.target
 # Mimic Ubuntu OS default boot (for testing)
 RUN systemctl enable avahi-daemon
 
+# dhcpcd never gets a real lease on podman's virtual network (no DHCP
+# server to answer it) and clobbers /etc/resolv.conf with an empty file,
+# breaking DNS for later apt-get tasks. Mask it here; the network role
+# still purges the dhcpcd package itself later as part of its real logic.
+RUN systemctl mask dhcpcd.service
+
 VOLUME ["/sys/fs/cgroup", "/tmp", "/run", "/opt"]
 
 CMD ["/lib/systemd/systemd"]