add boolean flag for stub resolved

Author: evgeniy-scherbina

app/app.go

@@ -15,14 +15,15 @@ import (
 
 // Config holds all configuration for the CLI
 type Config struct {
-	Config           serpent.YAMLConfigPath `yaml:"-"`
-	AllowListStrings serpent.StringArray    `yaml:"allowlist"` // From config file
-	AllowStrings     serpent.StringArray    `yaml:"-"`         // From CLI flags only
-	LogLevel         serpent.String         `yaml:"log_level"`
-	LogDir           serpent.String         `yaml:"log_dir"`
-	ProxyPort        serpent.Int64          `yaml:"proxy_port"`
-	PprofEnabled     serpent.Bool           `yaml:"pprof_enabled"`
-	PprofPort        serpent.Int64          `yaml:"pprof_port"`
+	Config                      serpent.YAMLConfigPath `yaml:"-"`
+	AllowListStrings            serpent.StringArray    `yaml:"allowlist"` // From config file
+	AllowStrings                serpent.StringArray    `yaml:"-"`         // From CLI flags only
+	LogLevel                    serpent.String         `yaml:"log_level"`
+	LogDir                      serpent.String         `yaml:"log_dir"`
+	ProxyPort                   serpent.Int64          `yaml:"proxy_port"`
+	PprofEnabled                serpent.Bool           `yaml:"pprof_enabled"`
+	PprofPort                   serpent.Int64          `yaml:"pprof_port"`
+	EnableLocalStubResolverDNS  serpent.Bool           `yaml:"enable_local_stub_resolver_dns"`
 }
 
 func isChild() bool {

app/parent.go

@@ -72,15 +72,15 @@ func RunParent(ctx context.Context, logger *slog.Logger, args []string, config C
 
 	// Create jailer with cert path from TLS setup
 	jailer, err := jail.NewLinuxJail(jail.Config{
-		Logger:                      logger,
-		HttpProxyPort:               int(config.ProxyPort.Value()),
-		Username:                    username,
-		Uid:                         uid,
-		Gid:                         gid,
-		HomeDir:                     homeDir,
-		ConfigDir:                   configDir,
-		CACertPath:                  caCertPath,
-		EnableLocalStubResolverDNS:  false, // Set to true if host uses systemd-resolved with localhost DNS
+		Logger:                     logger,
+		HttpProxyPort:              int(config.ProxyPort.Value()),
+		Username:                   username,
+		Uid:                        uid,
+		Gid:                        gid,
+		HomeDir:                    homeDir,
+		ConfigDir:                  configDir,
+		CACertPath:                 caCertPath,
+		EnableLocalStubResolverDNS: config.EnableLocalStubResolverDNS.Value(),
 	})
 	if err != nil {
 		return fmt.Errorf("failed to create jailer: %v", err)

cli/cli.go

@@ -108,6 +108,13 @@ func BaseCommand() *serpent.Command {
 				Value:       &config.PprofPort,
 				YAML:        "pprof_port",
 			},
+			{
+				Flag:        "enable-local-stub-resolver-dns",
+				Env:         "BOUNDARY_ENABLE_LOCAL_STUB_RESOLVER_DNS",
+				Description: "Enable DNS configuration for local stub resolver (e.g., systemd-resolved). Only needed when /etc/resolv.conf contains nameserver 127.0.0.53.",
+				Value:       &config.EnableLocalStubResolverDNS,
+				YAML:        "enable_local_stub_resolver_dns",
+			},
 		},
 		Handler: func(inv *serpent.Invocation) error {
 			args := inv.Args