SONiC containerlab: name the link endpoints ethN so docker-sonic-vs maps its ports

[roc-ops]

docker-sonic-vs builds its front-panel port map from the ethN netdevs present when the container boots, and syncd then creates a TAP named after each port it maps a veth to (eth1 to Ethernet0, eth2 to Ethernet4, and so on). The veth keeps its name; both netdevs exist. The sonic device declared no clab.interface.name, so containerlab named the link endpoint Ethernet0 itself: the lane map came out empty, syncd could not create a single TAP, and SONiC's port objects had no relationship to the links -- show interfaces status reported a port down while it carried a Full OSPF adjacency, and config interface shutdown did nothing.

This PR declares clab.interface.name: eth{ifindex + 1}, the same thing eos and srlinux do. With the port a real TAP again, CONFIG_DB reaches the kernel: the initial template goes back to config interface mtu and drops the loop that mirrored CONFIG_DB routed-port addresses onto the netdev by hand. The vlan, lag and vxlan datapaths are out of scope here: those features are off on this device and were not re-measured.

What changed since the first version of this PR

@jbemmel was right that having netlab orchestrate arp_ignore on the wire veth was the wrong design. The wire belongs to containerlab, which creates it, and silencing it is now srl-labs/containerlab#3390 -- it does what SONiC's own virtual-switch harness does (sonic-swss tests/conftest.py, VirtualServer: "disable arp, so no neigh on physical interfaces") and marks each ethN ARP-off and IPv6-off. That is merged. This PR is cut down to netlab's part: the endpoint naming, the removal of the workarounds the naming unblocks, the transformation test, and a caveat.

Version requirement

The caveat names the containerlab requirement; the global minimum in netsim/providers/clab.yml (0.75.0) is left alone. On an older containerlab the lab still comes up and forwards -- the wire simply answers ARP alongside the port, so a neighbour can cache the wire's MAC for the port's address. If you would rather have the minimum bumped, say so and I will add it once the containerlab release carrying #3390 is out; the release number is not known yet, which is why the caveat links the PR instead of a version.

Verified

On this branch rebased on current dev, with containerlab built from main at a958ab466 (the commit that carries #3390):

• Two-node SONiC lab under netlab: lanemap.ini = eth1:25,26,27,28, show interfaces status shows Ethernet0 oper up / admin up at the netlab MTU, and both IPv4 and IPv6 ping across the link at 0% loss.
• The wire is quiet, and netlab is not what quiets it: eth1 is NOARP with disable_ipv6=1 while net.ipv4.conf.eth1.arp_ignore is 0, and no arp_ignore appears anywhere in the configuration netlab pushes.
• Every neighbour entry for the far port -- ARP, IPv6 ND, and zebra's 169.254.0.1 -- resolves to the port's MAC 2e:9e:9f:74:85:f9, not the wire's aa:c1:ab:d8:af:2e. arping for the port's address: 4 sent, 4 received, 0 extra replies.
• New transformation test sonic-clab-ifnames; the transformation suite passes 303 (1 skipped) on this branch against 302 on clean dev.

From the first round, on template paths this rework does not touch: MTU agrees across netdev, CONFIG_DB, APPL_DB and show interfaces status on a 9000-byte link with an 8972-byte DF ping crossing; cutting the far end of a link makes SONiC report that port oper down and restoring it brings it back; and tests/integration/device-module-test -d sonic -p clab initial passed every case that deploys a SONiC node (the rest abort in netlab create on the device's own declared feature gaps, and 04-mtu needs a cEOS image I do not have). Happy to re-run that integration pass on request.

One pre-existing issue is left alone on purpose: initial/01-interfaces warns that a shutdown: True interface still pings on SONiC, because the vtysh block renders a bare no shutdown for every interface. config interface shutdown works now, so that is a separate one-line follow-up.

🤖 Generated with Claude Code

[jbemmel]

This seems convoluted - having to manually orchestrate ARP ignores such that neighbors cache the correct MAC is hideous

I don’t think this is the right solution (it’s additional problems and complexity that comes from AI not understanding design intent)

[roc-ops]

Agreed, and thanks for the pushback. The arp_ignore block was the wrong place for this. The wire veth (ethN) is meant to be silent: SONiC's own virtual-switch harness turns ARP and IPv6 off on it when it attaches links (sonic-swss tests/conftest.py, VirtualServer: "disable arp, so no neigh on physical interfaces"), and real SONiC ships arp_ignore=2 host-wide, which the docker-sonic-vs container never applies. That belongs to whoever creates the veth, so it is now srl-labs/containerlab#3390, doing exactly what the swss harness does in the sonic-vs kind's post-deploy.

Once that lands I will cut this PR down to netlab's part only: the clab.interface.name declaration so docker-sonic-vs maps its ports, removal of the initial-template workarounds that only existed because it did not, the transformation test, and a caveat naming the containerlab version it needs. Leaving this open until then; happy to close and reopen if you prefer.

[ipspace]

Looks like we're waiting for a containerlab PR. @roc-ops please let me know when this is ready to merge.

[roc-ops]

@ipspace this is reworked and ready for your review.

srl-labs/containerlab#3390 is merged, so the arp_ignore orchestration @jbemmel objected to is gone from here: silencing the wire veth belongs to containerlab, which creates it. What is left is netlab's part -- clab.interface.name: eth{ifindex + 1}, the removal of the template workarounds that only existed because the port layer was being bypassed, the transformation test, and a caveat. I also rebased on current dev.

Two things to flag before you merge:

1. It needs a containerlab release that carries [BUG] Provider templates do not use topology directory #3390, and there is not one yet -- the latest tag is v0.79.0 and the fix is only on main so far. I verified this branch against a main build (a958ab466). From netlab's side it is mergeable whenever you like; a user on today's released containerlab gets the pre-[BUG] Provider templates do not use topology directory #3390 behaviour, where the lab still comes up and forwards and the wire simply answers ARP alongside the port.
2. I named the requirement in the SONiC caveat and left the global containerlab minimum in netsim/providers/clab.yml at 0.75.0. If you would rather have the minimum bumped, I will do it as soon as the release carrying [BUG] Provider templates do not use topology directory #3390 ships.

One smaller thing: I dropped the release-note bullet. It was in docs/release/26.08.md, which shipped three releases ago -- tell me if you want one in the next release doc instead and I will add it there.

[ipspace]

@ipspace this is reworked and ready for your review.

Thank you.

1. It needs a containerlab release that carries [BUG] Provider templates do not use topology directory #3390, and there is not one yet

No worries, I'll change the minimum containerlab release once the new one is out, and then merge this one.

One smaller thing: I dropped the release-note bullet. It was in docs/release/26.08.md, which shipped three releases ago -- tell me if you want one in the next release doc instead and I will add it there.

The release notes (at least in a short format) are auto-generated before the release is shipped, so you don't have to worry about that, unless you want to have something special in the release notes, in which case you should always work on the file for the next release.