Since 357a70b we tried to properly recreate the /etc/resolv.conf setups upon container startup, to match the state in which ipa-server-install left it. In 707f9dd we changed the logic to set nameserver to 127.0.0.1, to use FreeIPA's internal DNS server for resolution, and in 33822d3 we covered the creation of the resolv.conf.ipa (which indicates that the mechanism should be triggered) with

if systemctl is-active -q named-pkcs11 || [ -f /run/ipa/ipa-server-ip ] ; then

Once we achieved correct behaviour with read-only root, we documented in 9f49a2f that folks should really be using --dns=127.0.0.1 when starting the container, as the container itself will not be able to update the /etc/resolv.conf itself.

In #642, a setup with DNS external to the FreeIPA container, together with the use of IPA_SERVER_IP environment varialbe (which propagates to /run/ipa/ipa-server-ip) uncovered that the logic that we use is likely not correct -- if there is no DNS server in the container, we do no want to set the namesrever 127.0.0.1. We rely on the proper authentication working against the external DNS server, and with #640 we are able to disable the IP address update, for situation when they are handled completely outside of the logic on the FreeIPA container.

We might want to reconsider the logic around out handling of resolv.conf, to fix use cases like #642, but possibly to make the setup more predictable in general.