backport of commit ffebeab

client/allocrunner/networking_cni.go

@@ -127,19 +127,27 @@ func (c *cniNetworkConfigurator) Setup(ctx context.Context, alloc *structs.Alloc
 // cniToAllocNet converts a CNIResult to an AllocNetworkStatus or returns an
 // error. The first interface and IP with a sandbox and address set are
 // preferred. Failing that the first interface with an IP is selected.
-//
-// Unfortunately the go-cni library returns interfaces in an unordered map so
-// the results may be nondeterministic depending on CNI plugin output.
 func (c *cniNetworkConfigurator) cniToAllocNet(res *cni.CNIResult) (*structs.AllocNetworkStatus, error) {
 	netStatus := new(structs.AllocNetworkStatus)
 
 	// Use the first sandbox interface with an IP address
 	if len(res.Interfaces) > 0 {
-		for name, iface := range res.Interfaces {
+		// Unfortunately the go-cni library returns interfaces in an unordered map so
+		// the results may be nondeterministic depending on CNI plugin output so make
+		// sure we sort them by interface name.
+		names := make([]string, 0, len(res.Interfaces))
+		for k := range res.Interfaces {
+			names = append(names, k)
+		}
+		sort.Strings(names)
+
+		for _, name := range names {
+			iface := res.Interfaces[name]
 			if iface == nil {
 				// this should never happen but this value is coming from external
 				// plugins so we should guard against it
 				delete(res.Interfaces, name)
+				continue
 			}
 
 			if iface.Sandbox != "" && len(iface.IPConfigs) > 0 {