Skip to content

Fixed clashing embedded DNS with systemd-resolved#43705

Closed
excitoon wants to merge 2 commits intomoby:masterfrom
excitoon-favorites:master
Closed

Fixed clashing embedded DNS with systemd-resolved#43705
excitoon wants to merge 2 commits intomoby:masterfrom
excitoon-favorites:master

Conversation

@excitoon
Copy link
Copy Markdown

@excitoon excitoon commented Jun 7, 2022 •
edited
Loading

This fixes a bug with DNS resolving in some Linux environments given we specified some DNS options.

systemd-resolved has DNS with IP: 127.0.0.53:

$ cat /etc/resolv.conf 
# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search local

Docker fails to redirect DNS queries to that address given we touched some other DNS options and /etc/resolv.conf file was rebuilt.

Fixes docker/for-linux#1404

@excitoon
Fixed clashing embedded DNS with systemd-resolved.
e49e86d 
Signed-off-by: Vladimir Chebotarev <vladimir.chebotarev@gmail.com>
thaJeztah
thaJeztah reviewed Jun 7, 2022
View reviewed changes
libnetwork/sandbox_dns_unix.go

func isSystemdResolvedIPv4Loopback(ipAddress string) bool {
if ip := net.ParseIP(ipAddress); ip != nil {
if ip4 := ip.To4(); ip4 != nil {
Copy link
Copy Markdown
Member

@thaJeztah thaJeztah Jun 7, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm curious, as the isIPv4Loopback() function already returns true for any IP address in the 127.x.x.x range; was this not detected?

Copy link
Copy Markdown
Author

@excitoon excitoon Jun 7, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, I bypass checkLoopback there (which is false when Docker generates /etc/resolv.conf from settings): https://github.com/moby/moby/blob/master/libnetwork/sandbox_dns_unix.go#L268 .

@excitoon
More universal solution.
c75d696 
Signed-off-by: Vladimir Chebotarev <vladimir.chebotarev@gmail.com>
@excitoon excitoon mentioned this pull request Jun 10, 2022
Closed
@excitoon
Copy link
Copy Markdown
Author

excitoon commented Sep 2, 2022

Hi @thaJeztah. Any progress on that?

corhere
corhere requested changes Feb 10, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@corhere corhere left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Special-casing the IP addresses 127.0.0.53 and .54 to always be external will break existing behaviour of the --dns flag.

moby/libnetwork/sandbox_dns_unix.go

Lines 258 to 261 in 3ba527d

// After building the resolv.conf from the user config save the
// external resolvers in the sandbox. Note that --dns 127.0.0.x
// config refers to the loopback in the container namespace
sb.setExternalResolvers(newRC.Content, resolvconf.IPv4, false)

@corhere corhere mentioned this pull request Feb 10, 2023
Merged
@corhere corhere mentioned this pull request Feb 14, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thaJeztah thaJeztah thaJeztah left review comments

@corhere corhere corhere requested changes

Assignees

No one assigned

Labels

area/networking Networking status/2-code-review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

--dns-opt breaks resolving of external names by internal DNS server

3 participants

@excitoon @corhere @thaJeztah