The 127.0.0.11 docker custom dns should be able to resolve entries to the docker-hosts /etc/hosts file.
Assume the following scenario: a docker host and an external service are in the same network.
The docker container needs to reach that service, but if it resolves its ip it gets an external address, which obviously is not reachable form inside the network.
So the host gets an entry to /etc/hosts to override the ip. The container however ignores it, since its /etc/hosts file is docker managed and does not get the entries and uses 127.0.0.11, which then relays to an external nameserver like google.
->You cannot use -v /etc/hosts:/etc/hosts since /etc/hosts in the container is managed by docker (works in some scenarios)
->You cannot use the host network, because oftentimes it is not an option to break that isolation
2 Likes
behzadost
(Behzad Ousat)
September 7, 2021, 1:37pm
2
Try upgrading docker.
The issue you refer to is fixed on docker version 20.10.
moby:master
← thaJeztah:smarter_resolv
opened 04:17PM - 25 May 20 UTC
- fixes / addresses https://github.com/moby/moby/issues/38243 18.09 breaks conta… iners name resolution for non default networks on systems with systemd-resolved
- fixes / addresses https://github.com/moby/moby/issues/39978 Wrong resolv.conf used on Ubuntu 19 (systemd-resolved enabled)
- fixes / addresses https://github.com/docker/for-linux/issues/889 Container /etc/resolv.conf does not update when /run/systemd/resolve/resolv.conf changes
- fixes / addresses https://github.com/docker/for-linux/issues/979 dockerd should use 127.0.0.53 when requested
- relates to https://github.com/moby/libnetwork/pull/2385#issuecomment-498326101
- relates to https://github.com/kubernetes-sigs/kind/issues/1594#issuecomment-629483100
Commit e353e7e3f0ce8eceeff657393cba2876375403fa (https://github.com/moby/moby/pull/37485) updated selection of the `resolv.conf` file to use in situations where systemd-resolvd is used as a resolver.
If a host uses `systemd-resolvd`, the system's `/etc/resolv.conf` file is
updated to set `127.0.0.53` as DNS, which is the local IP address for
systemd-resolvd. The DNS servers that are configured by the user will now
be stored in `/run/systemd/resolve/resolv.conf`, and systemd-resolvd acts
as a forwarding DNS for those.
Originally, Docker copied the DNS servers as configured in `/etc/resolv.conf`
as default DNS servers in containers, which failed to work if systemd-resolvd
is used (as `127.0.0.53` is not available inside the container's networking
namespace). To resolve this, e353e7e3f0ce8eceeff657393cba2876375403fa instead
detected if systemd-resolvd is in use, and in that case copied the "upstream"
DNS servers from the `/run/systemd/resolve/resolv.conf` configuration.
While this worked for most situations, it had some downsides, among which:
- we're skipping systemd-resolvd altogether, which means that we cannot take
advantage of addition functionality provided by it (such as per-interface
DNS servers)
- when updating DNS servers in the system's configuration, those changes were
not reflected in the container configuration, which could be problematic in
"developer" scenarios, when switching between networks.
This patch changes the way we select which resolv.conf to use as template
for the container's resolv.conf;
- in situations where a custom network is attached to the container, and the
embedded DNS is available, we use `/etc/resolv.conf` unconditionally. If
systemd-resolvd is used, the embedded DNS forwards external DNS lookups to
systemd-resolvd, which in turn is responsible for forwarding requests to
the external DNS servers configured by the user.
- if the container is running in "host mode" networking, we also use the
DNS server that's configured in `/etc/resolv.conf`. In this situation, no
embedded DNS server is available, but the container runs in the host's
networking namespace, and can use the same DNS servers as the host (which
could be systemd-resolvd or DNSMasq
- if the container uses the default (bridge) network, no embedded DNS is
available, and the container has its own networking namespace. In this
situation we check if systemd-resolvd is used, in which case we skip
systemd-resolvd, and configure the upstream DNS servers as DNS for the
container. This situation is the same as is used currently, which means
that dynamically switching DNS servers won't be supported for these
containers.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
<!--
Please make sure you've read and understood our contributing guidelines;
https://github.com/moby/moby/blob/master/CONTRIBUTING.md
** Make sure all your commits include a signature generated with `git commit -s` **
For additional information on our contributing process, read our contributing
guide https://docs.docker.com/opensource/code/
If this is a bug fix, make sure your description includes "fixes #xxxx", or
"closes #xxxx"
Please provide the following information:
-->
**- What I did**
**- How I did it**
**- How to verify it**
**- Description for the changelog**
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog:
-->
**- A picture of a cute animal (not mandatory but encouraged)**