Summary

When VyOS runs as an OCI container (containerlab, Docker, Podman), features like WireGuard, bridge, bonding, and L2TPv3 depend on drivers in the host kernel. Inside the container, modprobe usually can't work: there's no host /lib/modules and no CAP_SYS_MODULE. If the host hasn't loaded the module, the commit fails in apply() with an unhelpful iproute2 or netlink error.

Proposal

• Add a helper that detects whether VyOS is running in a container (e.g. via systemd-detect-virt --container, /.dockerenv, or /run/.containerenv).
• Extend the existing runtime module loading (already used for WireGuard) to be container-aware:
  • Outside a container, load modules as today.
  • Inside a container, only check whether the feature is available, and raise a ConfigError in verify() if it is not, e.g.: "WireGuard unavailable: running in a container and host kernel lacks 'wireguard'. Run 'modprobe wireguard' on the host."
• Apply this to all config scripts that depend on kernel modules.

Open question

/proc/modules and /sys/module don't reliably show built-in drivers. A functional probe (creating and deleting a test link of the given type via netlink) may be more robust. Is that acceptable in verify()?