fix: per-network static IP assignment for multi-network containers

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/Microsoft/hcsshim v0.14.0-rc.1
 	github.com/compose-spec/compose-go/v2 v2.10.1 //gomodjail:unconfined
 	github.com/containerd/accelerated-container-image v1.4.1
-	github.com/containerd/cgroups/v3 v3.1.2 //gomodjail:unconfined
+	github.com/containerd/cgroups/v3 v3.1.3 //gomodjail:unconfined
 	github.com/containerd/console v1.0.5 //gomodjail:unconfined
 	github.com/containerd/containerd/api v1.10.0
 	github.com/containerd/containerd/v2 v2.2.1 //gomodjail:unconfined

go.sum

@@ -25,8 +25,8 @@ github.com/compose-spec/compose-go/v2 v2.10.1 h1:mFbXobojGRFIVi1UknrvaDAZ+PkJfyj
 github.com/compose-spec/compose-go/v2 v2.10.1/go.mod h1:Ohac1SzhO/4fXXrzWIztIVB6ckmKBv1Nt5Z5mGVESUg=
 github.com/containerd/accelerated-container-image v1.4.1 h1:jeZYAaq5pMCeyRZ0I916OjJsEb2TGjAQmfAZyQLi3ec=
 github.com/containerd/accelerated-container-image v1.4.1/go.mod h1:rhqPgQ63sgkYHY56pAVl0NBN+lDJYgzgZW9m781nnWg=
-github.com/containerd/cgroups/v3 v3.1.2 h1:OSosXMtkhI6Qove637tg1XgK4q+DhR0mX8Wi8EhrHa4=
-github.com/containerd/cgroups/v3 v3.1.2/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
+github.com/containerd/cgroups/v3 v3.1.3 h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6dyLYXQ=
+github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
 github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc=
 github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.10.0 h1:5n0oHYVBwN4VhoX9fFykCV9dF1/BvAXeg2F8W6UYq1o=

hack/build-integration-canary.sh

@@ -162,15 +162,16 @@ latest::release(){
 
   while read -r line; do
     [ ! "$ignore" ] || ! grep -q "$ignore" <<<"$line" || continue
-    name="$(echo "$line"  | jq -rc .name)"
+    # Use tag_name as the canonical version identifier (name is an optional display label and may be empty)
+    name="$(echo "$line" | jq -rc 'if .name != "" then .name else .tag_name end')"
     if [ "$name" == "" ] || [ "$name" == null ] ; then
       log::debug " > bogus release name ($name) ignored"
       continue
     fi
     log::debug " > found release: $name"
-    if version::compare <(echo "$line" | jq -rc .name); then
+    if version::compare <(echo "$name"); then
       higher_data="$line"
-      higher_readable="$(echo "$line" | jq -rc .name | sed -E 's/(.*[ ])?(v?[0-9][0-9.a-z-]+).*/\2/')"
+      higher_readable="$(echo "$name" | sed -E 's/(.*[ ])?(v?[0-9][0-9.a-z-]+).*/\2/')"
     fi
   done < <(github::releases "$repo")
 

pkg/composer/serviceparser/serviceparser.go

@@ -19,6 +19,7 @@ package serviceparser
 import (
 	"bytes"
 	"encoding/csv"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -33,6 +34,7 @@ import (
 	"github.com/containerd/log"
 
 	"github.com/containerd/nerdctl/v2/pkg/identifiers"
+	"github.com/containerd/nerdctl/v2/pkg/labels"
 	"github.com/containerd/nerdctl/v2/pkg/reflectutil"
 )
 
@@ -595,20 +597,36 @@ func newContainer(project *types.Project, parsed *Service, i int) (*Container, e
 		return nil, err
 	}
 	netTypeContainer := false
+	// Collect per-network static IPs to determine if we need a per-network IP map.
+	networkIPMap := make(map[string]string)
 	for _, net := range networks {
 		if strings.HasPrefix(net.fullName, "container:") {
 			netTypeContainer = true
 		}
 		c.RunArgs = append(c.RunArgs, "--net="+net.fullName)
 		if value, ok := svc.Networks[net.shortNetworkName]; ok {
 			if value != nil && value.Ipv4Address != "" {
-				c.RunArgs = append(c.RunArgs, "--ip="+value.Ipv4Address)
+				networkIPMap[net.fullName] = value.Ipv4Address
 			}
 			if value != nil && value.MacAddress != "" {
 				c.RunArgs = append(c.RunArgs, "--mac-address="+value.MacAddress)
 			}
 		}
 	}
+	// When multiple networks have static IPs, pass a per-network IP map as an annotation
+	// so that each CNI plugin receives only the IP for its own network.
+	// For a single IP, use the legacy --ip= flag for backward compatibility.
+	if len(networkIPMap) > 1 {
+		ipMapJSON, err := json.Marshal(networkIPMap)
+		if err != nil {
+			return nil, fmt.Errorf("failed to marshal per-network IP map: %w", err)
+		}
+		c.RunArgs = append(c.RunArgs, fmt.Sprintf("--annotation=%s=%s", labels.IPAddressPerNetwork, string(ipMapJSON)))
+	} else if len(networkIPMap) == 1 {
+		for _, ip := range networkIPMap {
+			c.RunArgs = append(c.RunArgs, "--ip="+ip)
+		}
+	}
 
 	if netTypeContainer && svc.Hostname != "" {
 		return nil, fmt.Errorf("conflicting options: hostname and container network mode")

pkg/labels/labels.go

@@ -70,6 +70,10 @@ const (
 	// IP6Address is the static IP6 address of the container assigned by the user
 	IP6Address = Prefix + "ip6"
 
+	// IPAddressPerNetwork JSON-encoded map of network names to user-assigned static
+	// IPv4 addresses. Used for multi-network containers.
+	IPAddressPerNetwork = Prefix + "ip-per-network"
+
 	// LogURI is the log URI
 	LogURI = Prefix + "log-uri"