Request for enhancement

As an admin I'd like to be able to create FreeIPA master (and eventually replica) in container using images from the https://github.com/freeipa/freeipa-container project, with --dns-over-tls options.

Issue

When the container is run as --read-only, the ipa-server-install ... --dns-over-tls --dot-forwarder='1.1.1.1#one.one.one.one' in the container fails with

  File "/usr/lib/python3.12/site-packages/ipaserver/install/server/__init__.py", line 654, in main
    master_install(self)
  File "/usr/lib/python3.12/site-packages/ipaserver/install/server/install.py", line 278, in decorated
    func(installer)
  File "/usr/lib/python3.12/site-packages/ipaserver/install/server/install.py", line 1020, in install
    dns.install(False, False, options)
  File "/usr/lib/python3.12/site-packages/ipaserver/install/dns.py", line 465, in install
    _setup_dns_over_tls(options)
  File "/usr/lib/python3.12/site-packages/ipaserver/install/dns.py", line 176, in _setup_dns_over_tls
    with open(paths.RESOLV_CONF, 'w') as f:
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2025-06-23T07:05:06Z DEBUG The ipa-server-install command failed, exception: OSError: [Errno 30] Read-only file system: '/etc/resolv.conf'
2025-06-23T07:05:06Z ERROR [Errno 30] Read-only file system: '/etc/resolv.conf'

It seems to be caused by https://github.com/freeipa/freeipa/blob/master/ipaserver/install/dns.py#L168-L178 which insists on rewriting /etc/resolv.conf even if it already contains nameserver 127.0.0.1 (we use docker/podman run option --dns=127.0.0.1).

Steps to Reproduce

1. Run a test workflow for FreeIPA in container, similar to https://github.com/adelton/freeipa-container/actions/runs/15817377869/job/44578869936.

Actual behavior

2025-06-23T07:05:06Z DEBUG The ipa-server-install command failed, exception: OSError: [Errno 30] Read-only file system: '/etc/resolv.conf'

Expected behavior

The installer does not try to modify /etc/resolv.conf when nameserver 127.0.0.1 is already there.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

Various OSes, this is with Freeipa 4.14.2 on Fedora 42+ and CentOS 10 Stream.

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting