`network=host` is not picking up entries in host's `/etc/hosts` in docker 23

Contributing guidelines

• I've read the contributing guidelines and wholeheartedly agree

I've found a bug and checked that ...

• ... the documentation does not mention anything about my problem
• ... there are no open or closed issues that are related to my problem

Description

Even when I enabled network=host, buildx is not picking up entries in host's /etc/hosts.
First I created a new builder with

docker buildx create --bootstrap --use --config ~/.config/buildkit/buildkitd.toml --name custom-builder --driver docker-container --driver-opt network=host

with the content of ~/.config/buildkit/buildkitd.toml as

debug = true
insecure-entitlements = [ "network.host", "security.insecure" ]

I also added 127.0.0.1 random.blah to host's /etc/hosts and tried to build the following dockerfile

FROM ubuntu:bionic

RUN apt update && apt install dnsutils -y
RUN --network=host nslookup random.blah &&  sleep 15

with the following command

docker buildx build --allow network.host --network=host --no-cache .

Expected behaviour

When I have DOCKER_BUILDKIT=0, the result is as follow

Step 3/3 : RUN nslookup random.blah &&  sleep 15
 ---> Running in 2af6847b213e
Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   random.blah
Address: 127.0.0.1

Actual behaviour

When buildkit is used, I get this result

[+] Building 18.3s (6/6) FINISHED
 => [internal] load .dockerignore                                                                                                              0.0s
 => => transferring context: 2B                                                                                                                0.0s
 => [internal] load build definition from Dockerfile                                                                                           0.0s
 => => transferring dockerfile: 139B                                                                                                           0.0s
 => [internal] load metadata for docker.io/library/ubuntu:bionic                                                                               1.5s
 => [1/3] FROM docker.io/library/ubuntu:bionic@sha256:8aa9c2798215f99544d1ce7439ea9c3a6dfd82de607da1cec3a8a2fae005931b                         1.5s
 => => resolve docker.io/library/ubuntu:bionic@sha256:8aa9c2798215f99544d1ce7439ea9c3a6dfd82de607da1cec3a8a2fae005931b                         0.0s
 => => sha256:0c5227665c11379f79e9da3d3e4f1724f9316b87d259ac0131628ca1b923a392 25.69MB / 25.69MB                                               0.6s
 => => extracting sha256:0c5227665c11379f79e9da3d3e4f1724f9316b87d259ac0131628ca1b923a392                                                      0.9s
 => [2/3] RUN apt update && apt install dnsutils -y                                                                                           15.0s
 => ERROR [3/3] RUN nslookup random.blah &&  sleep 15                                                                                          0.2s
------
 > [3/3] RUN nslookup random.blah &&  sleep 15:
#0 0.134 Server:                8.8.8.8
#0 0.134 Address:       8.8.8.8#53
#0 0.134
#0 0.134 ** server can't find random.blah: NXDOMAIN
#0 0.134
------
WARNING: buildx: failed to get git commit: fatal: ambiguous argument 'HEAD': unknown revision or path not in the working tree.
Use '--' to separate paths from revisions, like this:
'git <command> [<revision>...] -- [<file>...]'
Dockerfile:4
--------------------
   2 |
   3 |     RUN apt update && apt install dnsutils -y
   4 | >>> RUN nslookup random.blah &&  sleep 15
   5 |
   6 |
--------------------
ERROR: failed to solve: process "/bin/sh -c nslookup random.blah &&  sleep 15" did not complete successfully: exit code: 1

Buildx version

github.com/docker/buildx v0.10.2 00ed17d

Docker info

Client:
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.10.2
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.16.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose
  scan: Docker Scan (Docker Inc.)
    Version:  v0.23.0
    Path:     /usr/libexec/docker/cli-plugins/docker-scan

Server:
 Containers: 3
  Running: 1
  Paused: 0
  Stopped: 2
 Images: 3
 Server Version: 23.0.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 2456e983eb9e37e47538f59ea18f2043c9a73640
 runc version: v1.1.4-0-g5fd4c4d
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
 Kernel Version: 5.4.0-144-generic
 Operating System: Ubuntu 20.04.6 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 6
 Total Memory: 62.85GiB
 Name: quan-work-ubuntu
 ID: DPTV:QXJW:TN6C:CVLT:2DU7:DGNV:7IRF:UGNG:AOPX:T3VE:JS3X:6KIP
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Experimental: false
 Insecure Registries:
  localhost:32000
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No swap limit support

Builders list

NAME/NODE           DRIVER/ENDPOINT             STATUS  BUILDKIT PLATFORMS
custom-builder *  docker-container
  custom-builder0 unix:///var/run/docker.sock running v0.11.4  linux/amd64, linux/amd64/v2, linux/386
default             docker
  default           default                     running 23.0.1   linux/amd64, linux/amd64/v2, linux/386

Configuration

FROM ubuntu:bionic

RUN apt update && apt install dnsutils -y
RUN --network=host nslookup random.blah &&  sleep 15

Logs

WARNING: No output specified with docker-container driver. Build result will only remain in the build cache. To push result image into registry use --push or to load image into docker use --load
[+] Building 18.6s (6/6) FINISHED
 => [internal] load build definition from Dockerfile                                                                                           0.0s
 => => transferring dockerfile: 154B                                                                                                           0.0s
 => [internal] load .dockerignore                                                                                                              0.0s
 => => transferring context: 2B                                                                                                                0.0s
 => [internal] load metadata for docker.io/library/ubuntu:bionic                                                                               2.0s
 => CACHED [1/3] FROM docker.io/library/ubuntu:bionic@sha256:8aa9c2798215f99544d1ce7439ea9c3a6dfd82de607da1cec3a8a2fae005931b                  0.0s
 => => resolve docker.io/library/ubuntu:bionic@sha256:8aa9c2798215f99544d1ce7439ea9c3a6dfd82de607da1cec3a8a2fae005931b                         0.0s
 => [2/3] RUN apt update && apt install dnsutils -y                                                                                           16.4s
 => ERROR [3/3] RUN --network=host nslookup random.blah &&  sleep 15                                                                           0.1s
------
 > [3/3] RUN --network=host nslookup random.blah &&  sleep 15:
#0 0.111 Server:                8.8.8.8
#0 0.111 Address:       8.8.8.8#53
#0 0.111
#0 0.111 ** server can't find random.blah: NXDOMAIN
#0 0.111
------
WARNING: buildx: failed to get git commit: fatal: ambiguous argument 'HEAD': unknown revision or path not in the working tree.
Use '--' to separate paths from revisions, like this:
'git <command> [<revision>...] -- [<file>...]'
Dockerfile:4
--------------------
   2 |
   3 |     RUN apt update && apt install dnsutils -y
   4 | >>> RUN --network=host nslookup random.blah &&  sleep 15
   5 |
   6 |
--------------------
ERROR: failed to solve: process "/bin/sh -c nslookup random.blah &&  sleep 15" did not complete successfully: exit code: 1

Additional info

No response

Reproduce the report using the shown Dockerfile, buildx commands, and buildkitd.toml, with random.blah in the host's /etc/hosts. Compare network=host resolution with legacy Docker behavior and trace the buildx/BuildKit networking path. Done means the host entry resolves during the reported build configuration, with a regression test covering it.