From 518d6d60010f7c0a9ebf9640e3a3938df9bc9848 Mon Sep 17 00:00:00 2001
From: Sem <931684+sembrestels@users.noreply.github.com>
Date: Fri, 30 Oct 2026 23:58:15 +0100
Subject: [PATCH] fix(installer): keep core IPs outside dynamic Docker
 allocation

---
 .github/workflows/test.yml  |  2 ++
 scripts/dappnode_install.sh | 17 ++++++++++++++++-
 test/network_pool.sh        | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 test/network_pool.sh

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 45a09ec..3c9b726 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,6 +17,8 @@ jobs:
       - name: Setup Test Environment
         run: |
           sudo /bin/bash ./test/environment_setup.sh
+      - name: Test network pool bootstrap
+        run: bash test/network_pool.sh
       - name: Install Prerequisites
         run: |
           sudo /bin/bash ./scripts/dappnode_install_pre.sh UPDATE
diff --git a/scripts/dappnode_install.sh b/scripts/dappnode_install.sh
index 95bc745..bb7b73f 100755
--- a/scripts/dappnode_install.sh
+++ b/scripts/dappnode_install.sh
@@ -48,6 +48,21 @@ die() {
     exit 1
 }
 
+# Keep the bootstrap pool aligned with DNP_DAPPMANAGER's dockerNetworkPolicy.json.
+# Existing bridges require the manager's journaled migration, never replacement here.
+ensure_dncore_network() {
+    local pool
+    if docker network inspect dncore_network >/dev/null 2>&1; then
+        pool=$(docker network inspect --format '{{range .IPAM.Config}}{{.IPRange}}{{end}}' dncore_network)
+        if [[ "$pool" != "172.33.128.0/17" ]]; then
+            warn "Existing dncore_network does not reserve core IPs. Run Dappmanager's scripts/migrate-docker-networks.sh plan after upgrading."
+        fi
+    else
+        docker network create --driver bridge --subnet 172.33.0.0/16 \
+            --gateway 172.33.0.1 --ip-range 172.33.128.0/17 dncore_network 2>&1 | tee -a "$LOGFILE"
+    fi
+}
+
 ##############################
 # Script Guards               #
 ##############################
@@ -1183,7 +1198,7 @@ main() {
 
     # --- Common steps (Linux and macOS) ---
     log "Creating dncore_network if needed..."
-    docker network create --driver bridge --subnet 172.33.0.0/16 dncore_network 2>&1 | tee -a "$LOGFILE" || true
+    ensure_dncore_network
 
     log "Building DAppNode Core if needed..."
     dappnode_core_build
diff --git a/test/network_pool.sh b/test/network_pool.sh
new file mode 100644
index 0000000..33db6f3
--- /dev/null
+++ b/test/network_pool.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+set -Eeuo pipefail
+cd "$(dirname "$0")/.."
+# Load only this function; sourcing the installer itself is deliberately forbidden.
+eval "$(awk '/^ensure_dncore_network\(\)/,/^}/' scripts/dappnode_install.sh)"
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+LOGFILE="$test_dir/log"
+calls="$test_dir/calls"
+log() { printf '%s\n' "$*"; }
+warn() { printf '%s\n' "$*" >> "$test_dir/warnings"; }
+docker() {
+    printf '%s\n' "$*" >> "$calls"
+    if [[ "$*" == "network inspect dncore_network" ]]; then [[ "$mode" != fresh ]];
+    elif [[ "$*" == "network inspect --format"* ]]; then printf '%s\n' "$mock_pool";
+    elif [[ "$*" == "network create"* ]]; then return "${create_exit:-0}";
+    else return 2; fi
+}
+mode=fresh
+ensure_dncore_network
+grep -q -- '--gateway 172.33.0.1 --ip-range 172.33.128.0/17 dncore_network' "$calls"
+mode=existing; mock_pool=172.33.128.0/17
+: > "$calls"
+ensure_dncore_network
+! grep -q 'network create' "$calls"
+[[ ! -f "$test_dir/warnings" ]]
+mock_pool=
+ensure_dncore_network
+grep -q 'journal\|migrate-docker-networks.sh plan' "$test_dir/warnings"
+! grep -q 'network create\|network rm\|network disconnect' "$calls"
+mode=fresh; create_exit=1
+if ensure_dncore_network; then echo 'Creation failures must propagate' >&2; exit 1; fi
+echo 'PASS: fresh pool, existing pool, non-disruptive legacy notice, creation failure'