Can't access other containers by their names (internal Docker DNS)

[melyux]

Is there a pinned issue for this?

• I have read the pinned issues and could not find my issue

Is there an existing or similar issue/discussion for this?

• I have searched the existing issues
• I have searched the existing discussions

Is there any comment in the documentation for this?

• I have read the documentation, especially the FAQ and Troubleshooting parts

Is this related to a provider?

• I have checked the provider repo for issues
• My issue is NOT related to a provider

Are you using the latest release?

• I am using the latest release

Have you tried using the dev branch latest?

• I have tried using dev branch

Docker run config used

  transmission:
    image: haugene/transmission-openvpn
    container_name: transmission
    cap_add:
      - NET_ADMIN
    environment:
      - LOCAL_NETWORK=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      ...
    volumes:
      ...
# ports:
## None

Current Behavior

Can't ping/access other containers by their names (Docker DNS/service discovery). I can still ping them using their internal Docker IPs though. Global DNS works (i.e. google.com).

Expected Behavior

Should still be able to access local Docker DNS

Why? When I route other containers through this container to be behind the same VPN, they also lose DNS access to other containers.

How have you tried to solve the problem?

• execd into this container and tried pinging other containers by name (fail)
• execd into other containers and tried pinging other containers by name (success)
• Tried setting ENABLE_UFW to true, and also just leaving it blank, to no effect

Log output

root@b07160d60f78:/# ping radarr
ping: radarr: Name or service not known

HW/SW Environment

- OS: Debian
- Docker: Docker version 24.0.4, build 3713ee1

Anything else?

No response

[edgd1er]

No log, very little conf, quite difficult to guess what could be the problem.
My guess, dns is set to a new value not going through docker's dns. Some provider push dns setting through their openvpn file.
https://openvpn.net/community-resources/how-to/ : Pushing DHCP options to clients
The OpenVPN server can push DHCP options such as DNS and WINS server addresses to clients
push "dhcp-option DNS 10.66.0.4"
As your provider is not mentioned, the guess need confirmation.

what is the content of /etc/resolv.conf ?

[melyux]

/etc/resolv.conf has this:

# Generated by openvpn for interface tun0
nameserver 10.8.0.1

[edgd1er]

default docker dns is 127.0.0.11.
seems like your dns is pushed through openvpn config, there is a setting for openvpn to ignore pushed dns.
you may check in the downloaded file if the options to push dns is present.

the solution may be leave the dns as it is and create a second network and attach your container through the second network.
or try what is suggested in the documentation: https://haugene.github.io/docker-transmission-openvpn/tips-tricks/

[melyux]

The ignore config setting says "To use your host DNS rather than what is provided by OpenVPN, set PEER_DNS=false. This allows for potential DNS leakage." That's probably not what I want, right? I wonder if there's a way for the container to always preserve the Docker DNS and overlay it on top of whatever's below so that it always works

[pkishino]

That would kind of break the openvpn tunnel..

[pkishino]

yeah, as above..your provider has pushed a diff dns which overwrites yours.. search for dns in the documentation linked above.. as by default, the dns is pinned, it will use the dns and only the dns set in resolve.conf.. if your provider pushes one then it will use that (all of this you can of course change..)
but this is not a container issue but a user setup, so I'll move this to Q&A

[melyux]

From the docs, it seems like doing

  dns:
    - 8.8.8.8
    - 8.8.4.4

is how you keep both local Docker lookup and use the VPN's DNS. But I don't want to use Google, but go through the VPN for DNS. Is there a way to do that?

[pkishino]

You could put in your vpn provider dns servers and test if it leaks or not

[pkishino]

Specifying dns like that would a) make the initial, pre openvpn lookups go to whatever is specified.. then once the tunnel is established it will go to the specified dns through the tunnel.
But you would need to host your own dns and specify this and then setup your own dns that can route the docker dns.. might work