Docker Community Forums

Share and learn in the Docker community.

Docker bridge no internet connection

Hi guys,
running into a new issue for me. Have docker installed on Debian. All containers running fine in host mode. While in Bridge mode all containers cannot acces internet. Did bash into them. Nameserver is set correctly. Cannot Ping towards domain nor ip. Did rebuild bridge which did not solve the problem. Any help is greatly appreciated.

Best regards,
Tom

Just fyi: https://forum.openmediavault.org/index.php?thread/32947-omv-upgrade-from-4-to-5-docker-issues/#post242264

Have tried quiet a lot of stuff. Still running into this issue…

First thing to check is run cat /etc/resolv.conf in the docker container. If it has an invalid DNS server, such as nameserver 127.0.x.x, then the container will not be able to resolve the domain names into ip addresses, so ping google.com will fail.

Second thing to check is run cat /etc/resolv.conf on the host machine. Docker basically copies the host’s /etc/resolv.conf to the container everytime a container is started. So if the host’s /etc/resolv.conf is wrong, then so will the docker container.

If you have found that the host’s /etc/resolv.conf is wrong, then you have 2 options:

Hardcode the DNS server in daemon.json. This is easy, but not ideal if you expect the DNS server to change.

Fix the hosts’s /etc/resolv.conf. This is a little trickier, but it is generated dynamically, and you are not hardcoding the DNS server.

  1. Hardcode DNS server in docker daemon.json

Edit /etc/docker/daemon.json

{
“dns”: [“10.1.2.3”, “8.8.8.8”]
}
Restart the docker daemon for those changes to take effect:
sudo systemctl restart docker

Now when you run/start a container, docker will populate /etc/resolv.conf with the values from daemon.json.

  1. Fix the hosts’s /etc/resolv.conf

A. Ubuntu 16.04 and earlier

For Ubuntu 16.04 and earlier, /etc/resolv.conf was dynamically generated by NetworkManager.

Comment out the line dns=dnsmasq (with a #) in /etc/NetworkManager/NetworkManager.conf

Restart the NetworkManager to regenerate /etc/resolv.conf :
sudo systemctl restart network-manager

Verify on the host: cat /etc/resolv.conf

B. Ubuntu 18.04 and later

Ubuntu 18.04 changed to use systemd-resolved to generate /etc/resolv.conf. Now by default it uses a local DNS cache 127.0.0.53. That will not work inside a container, so Docker will default to Google’s 8.8.8.8 DNS server, which may break for people behind a firewall.

/etc/resolv.conf is actually a symlink (ls -l /etc/resolv.conf) which points to /run/systemd/resolve/stub-resolv.conf (127.0.0.53) by default in Ubuntu 18.04.

Just change the symlink to point to /run/systemd/resolve/resolv.conf, which lists the real DNS servers:
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Verify on the host: cat /etc/resolv.conf

Now you should have a valid /etc/resolv.conf on the host for docker to copy into the containers.

Have checked that. It’s not the problem. Cannot access the internet at all… even have tried dns flag at Setup…

You said 127.0.0.11 would be wrong for nameserver in docker bridge? That’s what is set when I check inside container. Still in bridge mode no internet connection at all…

Don’t bother, lewish95 responses are usualy ambigously related to the post title and often times not even that…

“nameserver 127.0.0.11” is just fine, if the dns server in the hosts /etc/resolv.conf points to a valid dns server that is able to resolve the query (in other words: if name resolution works on the host, it should do the same in the container). Sounds like something doesn’t work as suppossed in docker’s network magic. Can you tell wether your system uses nftables or iptables? See: https://wiki.debian.org/iptables. Afaik, it needs to be iptables. I am not sure wether you need to restart the docker engine after switching to iptables.

That’s set just fine. I’m am really stunned. Never had a problem like that before…
IPtables is used.

So i checked /etc/docker/daemon.json
only Code inside is data-root: “/var/lib/docker”

when try to add dns and default-gateway I can save that file. When I restart docker though I only get an error until I set file as original…

Fyi using Odroid HC1 with OMV 5

I assume you are aware that json files require a terminating “,” at the end of each entry, except the laste one?

I Think i did.
Here is my input file:
{
“iptables”: true,
“default-gateway”: “192.168.2.1”,
“dns”: [“1.1.1.1”, “8.8.8.8”],
“data-root”: “/var/lib/docker”
}

When I restart docker i get the following error:
● docker.service - Docker Application Container Engine
Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Tue 2020-06-09 13:12:14 CEST; 8s ago
Docs: https://docs.docker.com
Process: 10937 ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock (code=exited, status=1/FAILURE)
Main PID: 10937 (code=exited, status=1/FAILURE)

Jun 09 13:12:14 TOM-HC1 systemd[1]: docker.service: Service RestartSec=2s expired, scheduling restart.
Jun 09 13:12:14 TOM-HC1 systemd[1]: docker.service: Scheduled restart job, restart counter is at 3.
Jun 09 13:12:14 TOM-HC1 systemd[1]: Stopped Docker Application Container Engine.
Jun 09 13:12:14 TOM-HC1 systemd[1]: docker.service: Start request repeated too quickly.
Jun 09 13:12:14 TOM-HC1 systemd[1]: docker.service: Failed with result ‘exit-code’.
Jun 09 13:12:14 TOM-HC1 systemd[1]: Failed to start Docker Application Container Engine.

I even cannot make the file original. Docker stil does not start. I have to do a reinstall basiclly in the webinterface:
Docker storage :: /var/lib/docker
Agent port:: 8000
Web port:: 9000
Opt-out :: 1
arch :: armhf
option :: docker
state :: install
extras :: 5.3.3
DNS OK.
Create override file …
Reload systemd daemon …
Skipping docker restart.
Done.

Only after that it does start again…

Your daemon.json looks about right. Though, I didn’t add any of those settings to my daemon.json. Mine only has data-root and a couple of settings to trim and locate the json logs.

There is definitly something fishy. I won’t be of any help here… good luck!

Mate you were right in the first place. I had nftables set. Just switched back to iptables and it works just fine.