Problems reaching outside world from container on docker swarm

I have a docker swarm with three manager nodes on which I deployed the jordan/icinga2 image using the ingress network. I can reach the icingaweb site well but the other direction does not work, i.e. I cannot reach anything in the outer world from within the container. When I ping an external computer, this server receives the ping packages with a source address of
Any advice what I have forgotten?

The docker create command I use is

docker service create --name icinga2 -p 5665:5665 -p 443:443 -p 80:80 \
  [ommitting several mounts]
 --hostname "" \
 --dns \

Many thanks, Cord


I’m thinking that the --dns you specified is not sufficient enough on it’s own.

Example of the default /etc/resolv.conf generated in a container run in my Docker Swarm.

$ docker container run -it --rm ubuntu:latest cat /etc/resolv.conf
# This file is managed by man:systemd-resolved(8). Do not edit.
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.


Maybe try adding a second --dns for instance Google’s DNS server --dns

1 Like

In circumstances --add-host proved to be valuable, when the fqdn can not be resolved to the required target ip by the reachable dns servers, e.g. in a private network without internet breakout or when dnat is involved and the resolved target ip is different to the ip actualy required.

1 Like

While the problem became visible with DNS problems it seems to be deeper: When I ping an external server specified by its IP address this server gets PING REQUESTs with a source IP of