Packer HCL2 Template Validation vs Runtime DNS Resolution in Multi-Network Builders

DNS Resolution Timing in Packer HCL2 Templates

When configuring Packer templates with multiple network interfaces or custom DNS settings, there is an unresolved question about when DNS resolution occurs relative to template validation and builder initialization. The HCL2 syntax allows defining custom DNS servers through builder configurations like dns_servers in the virtualbox-iso builder, but the timing of when these settings are applied versus when Packer's internal validation runs remains unclear.

Packer's built-in validators check template syntax before execution, but they may not validate network connectivity or DNS resolution against the specified servers. This creates uncertainty about whether a template that passes validation will successfully resolve hostnames during the build process, especially in environments with complex DNS topologies or isolated networks.

The core question centers on whether Packer performs DNS validation during the packer validate command when custom DNS servers are configured, or if this validation only occurs at runtime during the actual build execution.

Key Constraints

• Template validation occurs before any infrastructure provisioning
• DNS server configuration may not be validated without actual network access
• Different builders (VirtualBox, VMware, cloud providers) may handle DNS timing differently

Has Packer's validation phase been designed to test DNS resolution against custom-configured servers, or does it defer all network-dependent validation to runtime? If validation is deferred, what logging or debugging mechanisms exist to trace DNS resolution failures during build execution?