DNS issue inside container after reboot on Debian 13

Hello everyone,

after upgrading my Docker host to Debian 13, I encountered a weird issue with resolving URLs inside a container. I noticed that when my ping checks in Uptime Kuma failed, however, I didn’t know why and did some investigation.

I spun up two VMs (Debian 12 and 13) and did exactly the same to both of them (basic setup + Docker). I launched Uptime Kuma via CLI docker run -d --restart=always -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:2 and via docker compose

services:
  uptime-kuma:
    image: louislam/uptime-kuma:2
    container_name: uptime-kuma2
    restart: always
    volumes:
      - data:/app/data
    ports:
      - "3002:3001"
volumes:
  data:

In all instanced, I tracked google.com via ping. After starting the containers, the ping was ok. After rebooting the VM, only the pings from the CLI container were still ok, the compose containers failed. However, if I restart the container (or entire docker deamon), the ping is ok again until next reboot of the host VM.

The resolv.conf of my hosts are correct (pointing to my local DNS) and the host itself resolves fine after reboot. On Debian 12 this doesn’t occur, both approached behave the same way. I didn’t find any (current) bug with this description, only way older ones.

(Btw, this problem persists with all containers, this is definitely not a Uptime Kuma issue).

Strange that restarting container solves DNS resolution in that container. But let’s start with some basic questions to more about your environment. Hopefully that gives us more idea about what could go wrong. The below text is a template, so please, reply the parts that are not obvious from your original post.

We usually need the following information to understand the issue:

  1. What platform are you using? Windows, Linux or macOS? Which version of the operating systems? In case of Linux, which distribution?

  2. How did you install Docker? Sharing the platform almost answers it, but only almost. Direct links to the followed guide can be useful.

  3. On debian based Linux, the following commands can give us some idea and recognize incorrectly installed Docker:

    docker info
    docker version
    

    Review the output before sharing and remove confidential data if any appears (public IP for example)

    dpkg -l 'docker*' | grep '^ii'
    snap list docker
    

    When you share the outputs, always format your posts according to the following guide: How to format your forum posts

Sure, here’s the info:

  1. (for the sake of completeness) I’m using Debian 12 and 13, each in an x86_64 VM in Proxmox. (DHCP is done by my OpenWRT Router simultaneously hosting an Adguard DNS).
  2. On both VMs, I used the procedure described in Debian | Docker Docs (installing via the apt repository). Furthermore I added my non-root user to the docker group.
  3. docker info/docker version
docker info @ Debian 12
Client: Docker Engine - Community
 Version:    29.2.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.30.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.0.2
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 3
  Running: 2
  Paused: 0
  Stopped: 1
 Images: 2
 Server Version: 29.2.0
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc version: v1.3.4-0-gd6d73eb8
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.1.0-42-amd64
 Operating System: Debian GNU/Linux 12 (bookworm)
 OSType: linux
 Architecture: x86_64
 CPUs: 2
 Total Memory: 1.921GiB
 Name: debian12
 ID: a759dc3c-25a9-4467-800a-bf2ec3400e7a
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables

docker info @ Debian 13
Client: Docker Engine - Community
 Version:    29.2.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.30.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.0.2
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 3
  Running: 2
  Paused: 0
  Stopped: 1
 Images: 2
 Server Version: 29.2.0
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc version: v1.3.4-0-gd6d73eb8
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.12.63+deb13-amd64
 Operating System: Debian GNU/Linux 13 (trixie)
 OSType: linux
 Architecture: x86_64
 CPUs: 2
 Total Memory: 1.927GiB
 Name: debian13
 ID: e50a7f31-682d-44b6-afcf-f1b87fb31f38
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables

docker version @ Debian 12
Client: Docker Engine - Community
 Version:           29.2.0
 API version:       1.53
 Go version:        go1.25.6
 Git commit:        0b9d198
 Built:             Mon Jan 26 19:26:07 2026
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          29.2.0
  API version:      1.53 (minimum version 1.44)
  Go version:       go1.25.6
  Git commit:       9c62384
  Built:            Mon Jan 26 19:26:07 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v2.2.1
  GitCommit:        dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc:
  Version:          1.3.4
  GitCommit:        v1.3.4-0-gd6d73eb8
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
docker version @ Debian 13
Client: Docker Engine - Community
 Version:           29.2.0
 API version:       1.53
 Go version:        go1.25.6
 Git commit:        0b9d198
 Built:             Mon Jan 26 19:26:42 2026
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          29.2.0
  API version:      1.53 (minimum version 1.44)
  Go version:       go1.25.6
  Git commit:       9c62384
  Built:            Mon Jan 26 19:26:42 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v2.2.1
  GitCommit:        dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc:
  Version:          1.3.4
  GitCommit:        v1.3.4-0-gd6d73eb8
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
  1. dpkg (snap not used)
dpkg @ Debian 12
ii  docker-buildx-plugin      0.30.1-1~debian.12~bookworm   amd64        Docker Buildx plugin extends build capabilities with BuildKit.
ii  docker-ce                 5:29.2.0-1~debian.12~bookworm amd64        Docker: the open-source application container engine
ii  docker-ce-cli             5:29.2.0-1~debian.12~bookworm amd64        Docker CLI: the open-source application container engine
ii  docker-ce-rootless-extras 5:29.2.0-1~debian.12~bookworm amd64        Rootless support for Docker.
ii  docker-compose-plugin     5.0.2-1~debian.12~bookworm    amd64        Docker Compose (V2) plugin for the Docker CLI.
dpkg @ Debian 13
ii  docker-buildx-plugin      0.30.1-1~debian.13~trixie   amd64        Docker Buildx plugin extends build capabilities with BuildKit.
ii  docker-ce                 5:29.2.0-1~debian.13~trixie amd64        Docker: the open-source application container engine
ii  docker-ce-cli             5:29.2.0-1~debian.13~trixie amd64        Docker CLI: the open-source application container engine
ii  docker-ce-rootless-extras 5:29.2.0-1~debian.13~trixie amd64        Rootless support for Docker.
ii  docker-compose-plugin     5.0.2-1~debian.13~trixie    amd64        Docker Compose (V2) plugin for the Docker CLI.

Maybe some additional info: journald shows nearly the same logs after rebooting for docker, except that on Debian 13, warning msg="DNS resolver has no external nameservers" cid=... appears (which did not exactly help me finding any solution).

What’s the output of resolvectl status?

Just an idea: Docker containers are using the dns resolver configured on your host. Depending on how you run the container, it can copy the original resolv.conf or use a built-in resolver that forwards requests to the host’s resolver for external domains. If your network configurations are set too slowly during boot and containers are already started automaically, it is possible that the external DNS resolver is still not configured and there is no DNS server in it. I don’t think a simple restart would fix it, but it would explain why it breaks after rebooting.

There are multiple types of resolv.conf configuration. /etc/resolv.conf could either be a symbolic link or a file. If it is a symbolic link, it could point to the stub resolver which is available on a loopback interface or the other resolver generated by resolved I think. At least something from systemd. You could try checking your resolv conf like this:

ls -l /etc/resolv.conf

And if it points to another file, you could unlink /etc/resolv.conf (just remember the original target) and create a new file with this content:

nameserver 8.8.8.8

Or use your local DNS server if you know the IP address. Then try to reboot. If this was the problem, the static file is already there when your containers are started.

Simply command not found. :grinning_face_with_smiling_eyes:

That seems to be the right direction. After hard coding the nameserver it works better. But: Directly after booting, the nameserver is still unreachable (failed ping) but the next ping in Uptime Kuma is fine.

I looked into service docker status. Directly after reboot, it throws several errors level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable" (only for Debian 13, not for 12). After restarting the service, they are gone. Looking into DHCP related logs, I can see that the VM gets an IP two seconds after the docker service started (one second on Debian 12), so as you said, probably a timing issue.

service docker status @ Debian 12
● docker.service - Docker Application Container Engine
     Loaded: loaded (/lib/systemd/system/docker.service; enabled; preset: enabled)
     Active: active (running) since Fri 2026-01-30 20:27:48 CET; 8min ago
TriggeredBy: ● docker.socket
       Docs: https://docs.docker.com
   Main PID: 460 (dockerd)
      Tasks: 45
     Memory: 155.5M
        CPU: 1.478s
     CGroup: /system.slice/docker.service
             ├─460 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
             ├─810 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3001 -container-ip 172.17.0.2 -container-port 3001 -use-listen-fd
             ├─815 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 3001 -container-ip 172.17.0.2 -container-port 3001 -use-listen-fd
             ├─833 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3002 -container-ip 172.18.0.2 -container-port 3001 -use-listen-fd
             └─839 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 3002 -container-ip 172.18.0.2 -container-port 3001 -use-listen-fd

Jan 30 20:27:47 debian12 dockerd[460]: time="2026-01-30T20:27:47.694065941+01:00" level=info msg="Deleting nftables IPv6 rules" error="exit status 1"
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.707527531+01:00" level=info msg="sbJoin: gwep4 ''->'068aa24eaf4c', gwep6 ''->''" eid=068aa24eaf4c ep=uptime-kuma net=bridge nid=6e902107b52f
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.732300034+01:00" level=info msg="sbJoin: gwep4 ''->'5e60d2069499', gwep6 ''->''" eid=5e60d2069499 ep=uptime-kuma2 net=uptime_default nid=cf70e471f221
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.840121101+01:00" level=info msg="Loading containers: done."
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.866702427+01:00" level=info msg="Docker daemon" commit=9c62384 containerd-snapshotter=true storage-driver=overlayfs version=29.2.0
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.867366598+01:00" level=info msg="Initializing buildkit"
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.898926389+01:00" level=info msg="Completed buildkit initialization"
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.914921505+01:00" level=info msg="Daemon has completed initialization"
Jan 30 20:27:48 debian12 systemd[1]: Started docker.service - Docker Application Container Engine.
Jan 30 20:27:48 debian12 dockerd[460]: time="2026-01-30T20:27:48.915320051+01:00" level=info msg="API listen on /run/docker.sock"

journalctl | grep -Ei "dhcp" @ Debian 12
Jan 30 20:27:31 debian12 dhclient[1898]: Internet Systems Consortium DHCP Client 4.4.3-P1
Jan 30 20:27:31 debian12 ifdown[1898]: Internet Systems Consortium DHCP Client 4.4.3-P1
Jan 30 20:27:31 debian12 ifdown[1898]: For info, please visit https://www.isc.org/software/dhcp/
Jan 30 20:27:31 debian12 dhclient[1898]: For info, please visit https://www.isc.org/software/dhcp/
Jan 30 20:27:31 debian12 dhclient[1898]: DHCPRELEASE of 192.168.2.122 on ens18 to 192.168.2.1 port 67
Jan 30 20:27:31 debian12 ifdown[1898]: DHCPRELEASE of 192.168.2.122 on ens18 to 192.168.2.1 port 67
Jan 30 20:27:45 debian12 audit[282]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=282 comm="apparmor_parser"
Jan 30 20:27:45 debian12 audit[282]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-helper" pid=282 comm="apparmor_parser"
Jan 30 20:27:45 debian12 kernel: audit: type=1400 audit(1769801265.632:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=282 comm="apparmor_parser"
Jan 30 20:27:45 debian12 kernel: audit: type=1400 audit(1769801265.632:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-helper" pid=282 comm="apparmor_parser"
Jan 30 20:27:45 debian12 dhclient[321]: Internet Systems Consortium DHCP Client 4.4.3-P1
Jan 30 20:27:45 debian12 sh[321]: Internet Systems Consortium DHCP Client 4.4.3-P1
Jan 30 20:27:45 debian12 sh[321]: For info, please visit https://www.isc.org/software/dhcp/
Jan 30 20:27:45 debian12 dhclient[321]: For info, please visit https://www.isc.org/software/dhcp/
Jan 30 20:27:46 debian12 dhclient[321]: DHCPDISCOVER on ens18 to 255.255.255.255 port 67 interval 8
Jan 30 20:27:46 debian12 sh[321]: DHCPDISCOVER on ens18 to 255.255.255.255 port 67 interval 8
Jan 30 20:27:49 debian12 dhclient[321]: DHCPOFFER of 192.168.2.122 from 192.168.2.1
Jan 30 20:27:49 debian12 sh[321]: DHCPOFFER of 192.168.2.122 from 192.168.2.1
Jan 30 20:27:49 debian12 sh[321]: DHCPREQUEST for 192.168.2.122 on ens18 to 255.255.255.255 port 67
Jan 30 20:27:49 debian12 dhclient[321]: DHCPREQUEST for 192.168.2.122 on ens18 to 255.255.255.255 port 67
Jan 30 20:27:49 debian12 dhclient[321]: DHCPACK of 192.168.2.122 from 192.168.2.1
Jan 30 20:27:49 debian12 sh[321]: DHCPACK of 192.168.2.122 from 192.168.2.1
service docker status @ Debian 12
● docker.service - Docker Application Container Engine
     Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; preset: enabled)
     Active: active (running) since Fri 2026-01-30 20:27:54 CET; 9min ago
 Invocation: 191de38e843c465eb969b813cb8b5a1e
TriggeredBy: ● docker.socket
       Docs: https://docs.docker.com
   Main PID: 666 (dockerd)
      Tasks: 45
     Memory: 137.4M (peak: 139.6M)
        CPU: 1.381s
     CGroup: /system.slice/docker.service
             ├─ 666 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
             ├─1020 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3001 -container-ip 172.17.0.2 -container-port 3001 -use-listen-fd
             ├─1025 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 3001 -container-ip 172.17.0.2 -container-port 3001 -use-listen-fd
             ├─1043 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3002 -container-ip 172.18.0.2 -container-port 3001 -use-listen-fd
             └─1050 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 3002 -container-ip 172.18.0.2 -container-port 3001 -use-listen-fd

Jan 30 20:27:54 debian13 dockerd[666]: time="2026-01-30T20:27:54.528077130+01:00" level=info msg="Completed buildkit initialization"
Jan 30 20:27:54 debian13 dockerd[666]: time="2026-01-30T20:27:54.545827414+01:00" level=info msg="Daemon has completed initialization"
Jan 30 20:27:54 debian13 systemd[1]: Started docker.service - Docker Application Container Engine.
Jan 30 20:27:54 debian13 dockerd[666]: time="2026-01-30T20:27:54.546476844+01:00" level=info msg="API listen on /run/docker.sock"
Jan 30 20:27:58 debian13 dockerd[666]: time="2026-01-30T20:27:58.924185994+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
Jan 30 20:27:58 debian13 dockerd[666]: time="2026-01-30T20:27:58.924379265+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
Jan 30 20:27:58 debian13 dockerd[666]: time="2026-01-30T20:27:58.924524617+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
Jan 30 20:27:58 debian13 dockerd[666]: time="2026-01-30T20:27:58.924611303+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
Jan 30 20:27:59 debian13 dockerd[666]: time="2026-01-30T20:27:59.857217836+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
Jan 30 20:27:59 debian13 dockerd[666]: time="2026-01-30T20:27:59.857612334+01:00" level=warning msg="[resolver] connect failed" error="dial udp 9.9.9.9:53: connect: network is unreachable"
journalctl | grep -Ei "dhcp" @ Debian 13
Jan 30 20:27:36 debian13 dhcpcd[1743]: sending signal ALRM to pid 616
Jan 30 20:27:36 debian13 dhcpcd[1743]: waiting for pid 616 to exit
Jan 30 20:27:36 debian13 dhcpcd[618]: received SIGALRM, releasing
Jan 30 20:27:36 debian13 dhcpcd[618]: ens18: removing interface
Jan 30 20:27:36 debian13 dhcpcd[618]: ens18: deleting address fe80::d1bb:459e:50fb:61e3
Jan 30 20:27:36 debian13 dhcpcd[618]: ens18: releasing lease of 192.168.2.120
Jan 30 20:27:36 debian13 dhcpcd[618]: ens18: deleting route to 192.168.2.0/24
Jan 30 20:27:36 debian13 dhcpcd[618]: ens18: deleting default route via 192.168.2.1
Jan 30 20:27:51 debian13 ifup[598]: dhcpcd-10.1.0 starting
Jan 30 20:27:51 debian13 dhcpcd[598]: dhcpcd-10.1.0 starting
Jan 30 20:27:51 debian13 dhcpcd[611]: DUID 00:01:00:01:31:0d:34:ae:bc:24:11:51:2e:82
Jan 30 20:27:51 debian13 dhcpcd[611]: ens18: waiting for carrier
Jan 30 20:27:51 debian13 dhcpcd[611]: ens18: carrier acquired
Jan 30 20:27:51 debian13 dhcpcd[611]: ens18: IAID 11:51:2e:82
Jan 30 20:27:51 debian13 dhcpcd[611]: ens18: adding address fe80::d1bb:459e:50fb:61e3
Jan 30 20:27:53 debian13 ifup[611]: ens18: soliciting a DHCP lease
Jan 30 20:27:53 debian13 dhcpcd[611]: ens18: soliciting a DHCP lease
Jan 30 20:27:53 debian13 dhcpcd[611]: ens18: soliciting an IPv6 router
Jan 30 20:27:56 debian13 dhcpcd[611]: ens18: offered 192.168.2.120 from 192.168.2.1
Jan 30 20:27:56 debian13 dhcpcd[611]: ens18: probing address 192.168.2.120/24
Jan 30 20:28:02 debian13 dhcpcd[611]: ens18: leased 192.168.2.120 for 43200 seconds
Jan 30 20:28:02 debian13 dhcpcd[611]: ens18: adding route to 192.168.2.0/24
Jan 30 20:28:02 debian13 dhcpcd[611]: ens18: adding default route via 192.168.2.1
Jan 30 20:28:05 debian13 dhcpcd[611]: ens18: no IPv6 Routers available

Debian 12 also seems to deal differently with resolv.conf. Both VMs don’t get the nameserver via DHCP anymore, but on Debian 12 the old nameserver is still remembered. Here are the resolv.conf without hard coded nameserver:

resolv.conf @ Debian 12
domain lan
search lan
nameserver 9.9.9.9
resolv.conf @ Debian 13
# Generated by dhcpcd from ens18.dhcp
nameserver 9.9.9.9
domain lan
# /etc/resolv.conf.tail can replace this line

So it seems some dependency handling would be needed. You could try to figure out how it is done with Systemd and we had topics about that earlier for not exactly the same but similar issues, but you could also open a ticket in the docker ce packaging repository:

This topic can continue, since we don’t know how quickly it would be improved.

There is this for example: https://stackoverflow.com/a/54300998

I don’t remember if it is already in the systemd service and I just noticed I deleted my virtual machine so I can’t test right now.. It was Ubuntu anyway

1 Like

Great tip, systemd-networkd-wait-online.service did the trick. Thank you!

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.