Container.networkMode always marked as change

[cowwoc]

Describe what happened

1. Run pulumi up --diff. Container is started.
2. Run pulumi up --diff again. Diff shows - networkMode: "bridge" even though it did not change.

Sample program

import * as docker from "@pulumi/docker";
import path from "path";

const cloudflareApiToken = "redacted";
const certificateEmailAddress = "redacted";
const acmeServer = "redacted";
const domains = ["redacted"];
const serverPath = path.resolve(".");
const cwd = path.resolve(".");

const certbotImage = new docker.RemoteImage("certbot", {name: "certbot/dns-cloudflare:v3.0.0"})
const certbot = new docker.Container("certbot", {
	name: "certbot",
	image: certbotImage.imageId,
	envs: [`CLOUDFLARE_API_TOKEN=${cloudflareApiToken}`,
	       `DOMAINS=${domains.join(",")}`,
	       `EMAIL_ADDRESS=${certificateEmailAddress}`],
	volumes: [{
		hostPath: `${serverPath}/keystore/certbot`,
		containerPath: "/etc/letsencrypt/live"
	}, {
		hostPath: `${serverPath}/keystore/locks`,
		containerPath: "/var/lib/letsencrypt"
	}, {
		hostPath: `${serverPath}/keystore/logs`,
		containerPath: "/var/log/letsencrypt"
	}, {
		hostPath: `${cwd}/entrypoint.sh`,
		containerPath: "/entrypoint.sh"
	}]
});

Log output

    +-docker:index/container:Container: (replace)
        [id=b6b70443f6ad49493d8676b2832f99f6d505974ef69fd1db4c358cf1fba33a67]
        [urn=urn:pulumi:local::licensed::docker:index/container:Container::certbot]
        [provider=urn:pulumi:local::licensed::pulumi:providers:docker::default_4_5_7::e63561a4-ba77-4924-b13f-eafe5bf09903]
      - networkMode: "bridge"
Resources:
    +-1 replaced
    2 unchanged

Affected Resource(s)

Container

Output of pulumi about

CLI
Version      3.138.0
Go Version   go1.23.2
Go Compiler  gc

Plugins
KIND      NAME                     VERSION
resource  docker                   4.5.7
resource  kubernetes               4.18.2
resource  kubernetes-cert-manager  0.0.7
language  nodejs                   unknown

Host
OS       Microsoft Windows 10 Pro
Version  10.0.19045 Build 19045
Arch     x86_64

This project is written in nodejs: executable='C:\Users\Gili\scoop\apps\nodejs\current\node.exe' version='v23.1.0'

Current Stack: licensed/licensed/local

TYPE                                  URN
pulumi:pulumi:Stack                   urn:pulumi:local::licensed::pulumi:pulumi:Stack::licensed-local
pulumi:providers:docker               urn:pulumi:local::licensed::pulumi:providers:docker::default_4_5_7
docker:index/remoteImage:RemoteImage  urn:pulumi:local::licensed::docker:index/remoteImage:RemoteImage::certbot
docker:index/container:Container      urn:pulumi:local::licensed::docker:index/container:Container::certbot


Found no pending operations associated with local

Backend
Name           pulumi.com
URL            https://app.pulumi.com/cowwoc
User           cowwoc
Organizations  cowwoc, licensed
Token type     personal

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[blampe]

This appears to be an issue with the upstream provider kreuzwerker/terraform-provider-docker#603.

You should be able to work around this by specifying ignoreChanges: ["networkMode"] (docs).

[cowwoc]

@blampe I ended up explicitly setting the value (networkMode: "bridge"). I guess I will keep this issue open until the underlying bug is fixed.