search

alpinelinux / docker-alpine

Official Alpine Linux Docker image. Win at minimalism!
MIT License
1.11k stars 264 forks source link

DNS lookups broken in 3.13 #165

Open carlosefr opened 3 years ago

carlosefr commented 3 years ago

DNS lookups seem broken in the alpine:3.13 docker image. 

$ sudo docker run -ti --rm alpine:3.13 ping -c 1 google.com
ping: bad address 'google.com'

$ sudo docker run -ti --rm alpine:3.12 ping -c 1 google.com
PING google.com (216.58.201.142): 56 data bytes
64 bytes from 216.58.201.142: seq=0 ttl=61 time=16.582 ms

--- google.com ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 16.582/16.582/16.582 ms

I'm seeing this with docker 20.10.5 on CentOS 7.9, CentOS 8.3, and Ubuntu 20.04 LTS, all running as VMs on virtualbox/vagrant but noticed that it works with docker 20.10.5 on macOS and with CentOS 7.9 on a DigitalOcean VM that I have...

Investigating further, I see that on the vagrant VMs the problem goes away if I remove this line from my Vagrantfile:

vm.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]
jaybauson commented 3 years ago

I just had the same issue so I just went back to 3.10 instead.

jimbali commented 3 years ago

This issue has manifested itself in the ruby:2.7.3-alpine3.13 image now too. DNS lookups are fine on ruby:2.7.3-alpine3.12.

jimbali commented 3 years ago

For me it seems to work on Linux but not on Docker for Mac, so it could be a Docker issue.

kmaounis commented 3 years ago

Same for 3.14, https://github.com/alpinelinux/docker-alpine/issues/165

hutstep commented 3 years ago

I have the same issue with 3.13 in a k8s environment. Is there any workaround to fix this?

wolfgangrittner commented 3 years ago

We switched our application to a custom resolver (aka a "stub resolver"). Most languages come with stub resolver implementations you can opt in to. We're using Ruby, which you can configure to use Ruby's own DNS resolver instead of the (broken) system one. Afaik there are similar solutions for most languages.

jimbali commented 3 years ago

In my case there was only one domain that it was struggling to resolve, so I just added an --add-host argument to the docker run command. The same can be achieved with host aliases in k8s: https://v1-17.docs.kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

jaybauson commented 3 years ago

This might help some: Create or add this in your /etc/docker/daemon.json { "dns": ["8.8.8.8", "192.168.0.1"] } With this, you will be able to update and install packages. But if you are connected with a VPN service like AT&T or CISCO, and you want to reach your internal serversfrom your containers, you may want to use --add-host.

I am hoping that this issue will get fixed soon, I am still using alpine:3.10.4 for my images because of this problem.

wolfgangrittner commented 3 years ago

I would not hold my breath for this getting fixed any time soon, or ever. It's a deliberate choice of the underlying musl libc implementation to not support DNS over TCP, which is the root cause for some DNS requests not working.

This post might help shed some more light on what is going on and why some DNS queries just won't resolve with Alpine: https://christoph.luppri.ch/fixing-dns-resolution-for-ruby-on-alpine-linux/

patrikbeno commented 3 years ago

Workaround: Install dnsmasq, forward to your original DNS, and change your resolv.conf to use 127.0.0.1:53

tpo commented 2 years ago

I would not hold my breath for this getting fixed any time soon, or ever. It's a deliberate choice of the underlying musl libc implementation to not support DNS over TCP, which is the root cause for some DNS requests not working.

This post might help shed some more light on what is going on and why some DNS queries just won't resolve with Alpine: https://christoph.luppri.ch/fixing-dns-resolution-for-ruby-on-alpine-linux/

I have not found a bug tracker for musl, however I have found this feature requests for DNS-over-TCP. I do not know if that's the currnet optinion of musl's author(s) on the DNS-over-TCP issue.

tpo commented 2 years ago

Fix for k8s (this is an example for a Deployment - adapt accordingly for Pods etc.)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-deployment
spec:
  template:
    spec:
      dnsConfig:
        nameservers:
        # replace with DNS resolver that works for you
        - 1.1.1.1

If you are using Helm Chart, then you might want to use a post-renderer to fix the DNS problem.