Docker does not pickup DNS information from Cisco AnyConnect

Hi *,

it seems to me that docker for mac does not use the internal OS X DNS service for retrieving information about DNS. At work we are using Cisco VPN and the OS X client AnyConnect. This client does not modify /etc/resolv.conf rather it uses the internal OS X servcies for configuring DNS. This works quite well for many applications, but docker for mac fails.

Expected behavior

Docker should recognize DNS settings if used in conjunction with VPN clients.

Actual behavior

It doesn’t. I can’t pull images from our private registry and Im also not able to ping services from inside a container.

$ docker pull internal.dockerreg.lan/myimage
Using default tag: latest
Pulling repository internal.dockerreg.lan/myimage
Error while pulling image: Get http://internal.dockerreg.lan/v1/repositories/myimage/images: dial tcp: lookup internal.dockerreg.lan on 192.168.65.1:53: no such host

root@9b8355683444:/# ping internal.dockerreg.lan
ping: unknown host

Im able to solve this problem if I add the output (resolver section) from scutil --dns to /etc/resolv.conf, but this file is regenerated on every restart.

Information

Docker for Mac: version: mac-v1.12.0-beta16.2
OS X: version 10.11.5 (build: 15F34)
logs: /tmp/20160627-081233.tar.gz
failure: No error was detected
[OK]     docker-cli
[OK]     app
[OK]     menubar
[OK]     virtualization
[OK]     system
[OK]     osxfs
[OK]     db
[OK]     slirp
[OK]     moby-console
[OK]     logs
[OK]     vmnetd
[OK]     env
[OK]     moby
[OK]     driver.amd64-linux

OS X 10.11.5

Thankful for every advice!

1 Like

did you try docker info that should print out proxy information.

If Im connected via VPN the output is

$ docker info
Containers: 0
 Running: 0
 Paused: 0
 Stopped: 0
Images: 10
Server Version: 1.12.0-rc2
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 38
 Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: overlay bridge null host
Swarm: inactive
Runtimes: default
Default Runtime: default
Security Options: seccomp
Kernel Version: 4.4.13-moby
Operating System: Alpine Linux v3.4
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 1.954 GiB
Name: moby
ID: ANPA:3GOM:CGXG:3FYS:2EBJ:PO44:NAVE:FOYM:KLS7:OWPQ:ITZV:AD3Q
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): true
 File Descriptors: 21
 Goroutines: 29
 System Time: 2016-06-27T11:31:56.977849657Z
 EventsListeners: 1
No Proxy: *.local, 169.254/16
Registry: https://index.docker.io/v1/
Experimental: true
Insecure Registries:
 internal.dockerreg.lan
 127.0.0.0/8

I have exactly the same problem

[details=docker info]Containers: 3
Running: 3
Paused: 0
Stopped: 0
Images: 74
Server Version: 1.12.0-rc2
Storage Driver: aufs
Root Dir: /var/lib/docker/aufs
Backing Filesystem: extfs
Dirs: 160
Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: null overlay bridge host
Swarm: inactive
Runtimes: default
Default Runtime: default
Security Options: seccomp
Kernel Version: 4.4.13-moby
Operating System: Alpine Linux v3.4
OSType: linux
Architecture: x86_64
CPUs: 1
Total Memory: 3.857 GiB
Name: moby
ID: DN2I:LDBN:O7VR:D2KH:JK3T:OXJ3:NVTF:5KAL:63PV:VXEI:43HT:ABMO
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): true
File Descriptors: 55
Goroutines: 75
System Time: 2016-06-27T15:37:24.415057462Z
EventsListeners: 3
No Proxy: *.local, 169.254/16
Username: petervorman
Registry: https://index.docker.io/v1/
Experimental: true
Insecure Registries:
127.0.0.0/8[/details]

[details=self-test]Docker for Mac: version: mac-v1.12.0-beta16.2
OS X: version 10.11.5 (build: 15F34)
logs: /tmp/20160627-184018.tar.gz
failure: No error was detected
[OK] docker-cli
[OK] app
[OK] menubar
[OK] virtualization
[OK] system
[OK] osxfs
[OK] db
[OK] slirp
[OK] moby-console
[OK] logs
[OK] vmnetd
[OK] env
[OK] moby
[OK] driver.amd64-linux
[/details]

confirmation

$ docker exec -it isvc bash
root@isvc:/# ping google.com
ping: unknown host google.com
root@isvc:/# ping redis
PING redis (172.19.0.2) 56(84) bytes of data.
64 bytes from redis.itemservice_default (172.19.0.2): icmp_seq=1 ttl=64 time=0.096 ms
64 bytes from redis.itemservice_default (172.19.0.2): icmp_seq=2 ttl=64 time=0.052 ms
^C
— redis ping statistics —
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.052/0.074/0.096/0.022 ms

I’d rather say that from inside my containers I can’t get resources from the Internet at all…
Previously (before 1.12) that issue has appeared accidentally from time to time. My workaround was to restart Docker app, but in the current version that doesn’t work anymore.
;(

The issue has been reported a few times, we discussed it here and a Docker engineer told us they are tracking this issue internally (#3124): Docker pull not using correct DNS server when private registry on VPN

There are various workarounds discussed on stackoverflow