fix(installer): reserve core IPs outside Docker automatic allocation

.github/workflows/test.yml

@@ -17,6 +17,8 @@ jobs:
       - name: Setup Test Environment
         run: |
           sudo /bin/bash ./test/environment_setup.sh
+      - name: Test network pool bootstrap
+        run: bash test/network_pool.sh
       - name: Install Prerequisites
         run: |
           sudo /bin/bash ./scripts/dappnode_install_pre.sh UPDATE

scripts/dappnode_install.sh

@@ -48,6 +48,21 @@ die() {
     exit 1
 }
 
+# Keep the bootstrap pool aligned with DNP_DAPPMANAGER's dockerNetworkPolicy.json.
+# Existing bridges require the manager's journaled migration, never replacement here.
+ensure_dncore_network() {
+    local pool
+    if docker network inspect dncore_network >/dev/null 2>&1; then
+        pool=$(docker network inspect --format '{{range .IPAM.Config}}{{.IPRange}}{{end}}' dncore_network)
+        if [[ "$pool" != "172.33.128.0/17" ]]; then
+            warn "Existing dncore_network does not reserve core IPs. Run Dappmanager's scripts/migrate-docker-networks.sh plan after upgrading."
+        fi
+    else
+        docker network create --driver bridge --subnet 172.33.0.0/16 \
+            --gateway 172.33.0.1 --ip-range 172.33.128.0/17 dncore_network 2>&1 | tee -a "$LOGFILE"
+    fi
+}
+
 ##############################
 # Script Guards               #
 ##############################
@@ -1183,7 +1198,7 @@ main() {
 
     # --- Common steps (Linux and macOS) ---
     log "Creating dncore_network if needed..."
-    docker network create --driver bridge --subnet 172.33.0.0/16 dncore_network 2>&1 | tee -a "$LOGFILE" || true
+    ensure_dncore_network
 
     log "Building DAppNode Core if needed..."
     dappnode_core_build

test/network_pool.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+set -Eeuo pipefail
+cd "$(dirname "$0")/.."
+# Load only this function; sourcing the installer itself is deliberately forbidden.
+eval "$(awk '/^ensure_dncore_network\(\)/,/^}/' scripts/dappnode_install.sh)"
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+LOGFILE="$test_dir/log"
+calls="$test_dir/calls"
+log() { printf '%s\n' "$*"; }
+warn() { printf '%s\n' "$*" >> "$test_dir/warnings"; }
+docker() {
+    printf '%s\n' "$*" >> "$calls"
+    if [[ "$*" == "network inspect dncore_network" ]]; then [[ "$mode" != fresh ]];
+    elif [[ "$*" == "network inspect --format"* ]]; then printf '%s\n' "$mock_pool";
+    elif [[ "$*" == "network create"* ]]; then return "${create_exit:-0}";
+    else return 2; fi
+}
+mode=fresh
+ensure_dncore_network
+grep -q -- '--gateway 172.33.0.1 --ip-range 172.33.128.0/17 dncore_network' "$calls"
+mode=existing; mock_pool=172.33.128.0/17
+: > "$calls"
+ensure_dncore_network
+! grep -q 'network create' "$calls"
+[[ ! -f "$test_dir/warnings" ]]
+mock_pool=
+ensure_dncore_network
+grep -q 'journal\|migrate-docker-networks.sh plan' "$test_dir/warnings"
+! grep -q 'network create\|network rm\|network disconnect' "$calls"
+mode=fresh; create_exit=1
+if ensure_dncore_network; then echo 'Creation failures must propagate' >&2; exit 1; fi
+echo 'PASS: fresh pool, existing pool, non-disruptive legacy notice, creation failure'