-
Notifications
You must be signed in to change notification settings - Fork 18.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Internal network DNS fails to resolve #47822
Comments
I think this may be related to a security fix that fixed internal-only networks being able to access external DNS servers; GHSA-mq39-4gv4-mvpx In this case, "external" would be the dns service, which is part of the same network, but the internal resolver likely won't take that into account; @robmry any thoughts? |
Oh! Looks like a PR was opened that looks related; |
Ah, yes! Thank you for re-opening this as a moby issue. As @thaJeztah says, it's fallout from the security fix that went too far. The new PR should sort things out. |
While I absolutely see the point if this fix, how are we supposed to work around this issue? I'd use What's the correct solution and is there a way to restore the previous behavior? |
I can verify that the test I wrote in the issue above is fixed with the latest release of docker 26.1. Thanks for the comments, I forgot to loop back around and check this out! |
Thanks for confirming! |
Thank you! It seems to work for just about any container I use - except Jellyfin, but I suppose it's because of Traefik seeing two networks (I use a regular bridge network and a macvlan) and assigning weird IP addresses. The external access seems fixed though, at least from what I understand. |
@divStar Without more details it's hard to pinpoint what's going wrong in your environment. You could try to ask on our community Slack, on our forum, or in the Discussions tab here on GH. If your container is connected to multiple networks, it might be due to bad network precedence during DNS resolution or something along this line. If you're currently using an unqualified container name (eg. |
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version XX Resolved in moby/moby#47822 in version XX
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
…ronment. Due to a change in Docker's DNS resolver (moby/moby#47589) in version 25.0.5 (https://docs.docker.com/engine/release-notes/25.0/#2505), traffic to the mock resolver used in integration/batch tests is no longer forwarded. This is fixed in moby/moby#47822 in version 26.0.3 (https://docs.docker.com/engine/release-notes/26.0/#2603). - Temporary add upgrade commands to CI because 26.0.3 is not yet in the default CI image - Add checks to warn about incompatible versions - Add documentation to help developers get the right versions
Description
Moby version 25 and higher under Linux fail to correctly perform DNS resolution on internal networks using the bridge driver and DNS container option.
Reproduce
docker-compose.yaml
Corefile
docker compose up
curl: (6) Could not resolve host: webserver.internal.net
or using dind
Failing Test:
Passing Test
Expected behavior
Internal DNS resolution should function identically to version 24 of Moby.
docker version
Client: Cloud integration: v1.0.35+desktop.13 Version: 26.0.0 API version: 1.45 Go version: go1.21.8 Git commit: 2ae903e Built: Wed Mar 20 15:16:45 2024 OS/Arch: linux/amd64 Context: default Server: Docker Desktop Engine: Version: 26.0.0 API version: 1.45 (minimum version 1.24) Go version: go1.21.8 Git commit: 8b79278 Built: Wed Mar 20 15:18:01 2024 OS/Arch: linux/amd64 Experimental: false containerd: Version: 1.6.28 GitCommit: ae07eda36dd25f8a1b98dfbf587313b99c0190bb runc: Version: 1.1.12 GitCommit: v1.1.12-0-g51d5e94 docker-init: Version: 0.19.0 GitCommit: de40ad0
docker info
Additional Info
Independently verified in issue docker/for-win#14049
The text was updated successfully, but these errors were encountered: