improve docs

Author: evgeniy-scherbina

jail/networking_ns.go

@@ -39,6 +39,11 @@ func SetupChildNetworking(vethNetJail string) error {
 	return nil
 }
 
+// ConfigureDNSForLocalStubResolver configures DNS redirection from the network namespace
+// to the host's local stub resolver. This function should only be called when the host
+// runs a local stub resolver such as systemd-resolved, and /etc/resolv.conf contains
+// "nameserver 127.0.0.53" (listening on localhost). It redirects DNS requests from
+// the namespace to the host by setting up iptables NAT rules.
 func ConfigureDNSForLocalStubResolver() error {
 	runner := newCommandRunner([]*command{
 		// Redirect all DNS queries inside the namespace to the host DNS listener.