UDP port 53 for dnsmasq fails (any port 1024 and lower) #3775

davidalger · 2019-07-31T20:07:54Z

I have tried with the latest version of my channel (Stable or Edge)
I have uploaded Diagnostics
Diagnostics ID:

Expected behavior

Forwarding 127.0.0.1:53:53/udp should work in the latest stable release of Docker Desktop.

Actual behavior

Docker Desktop for Mac v2.1.0.0 was released and as is normal, users on the stable release of Docker for Mac were prompted to upgrade:

After upgrading, my (and other team members) dnsmasq container ceased to function. The issue appears to possibly be related to #3464, except for that task was originally opened as a result of TCP port 80. There are other users who reported similar issue there however with UDP port 53.

Information

macOS Version: 10.14.6
Docker Desktop version 2.1.0.0
Issue is fully reproducible and can be seen by running the script on this gist: https://gist.github.com/davidalger/ff7be7e13f23ca59c96ada6004e3c25b

Steps to reproduce the behavior

Run the script on this gist: https://gist.github.com/davidalger/ff7be7e13f23ca59c96ada6004e3c25b

curl -s https://gist.githubusercontent.com/davidalger/ff7be7e13f23ca59c96ada6004e3c25b/raw/529c296a20452b182cece5f7f5529530e95395da/dnsforwardtest.sh | bash

Note the connection timed out in the output for DNS lookups on UDP 53 and 1024, but not 1025 or 5000 and each of the lookups of TCP (regardless of port) succeed:

   davidalger:~$ curl -s https://gist.githubusercontent.com/davidalger/ff7be7e13f23ca59c96ada6004e3c25b/raw/529c296a20452b182cece5f7f5529530e95395da/dnsforwardtest.sh | bash
   ==> cd /var/folders/c8/l3c87j253jx43f5_whq5zsqc0000gn/T/dnstest.j1s2ZdZN
   ==> docker-compose up -d
   Creating network "dnstestj1s2zdzn_default" with the default driver
   Creating dnstestj1s2zdzn_dnsmasq_1 ... done
   ==> dig +noall +answer apple.com @127.0.0.1 -p 53
   ;; connection timed out; no servers could be reached
   ==> dig +noall +answer apple.com @127.0.0.1 -p 1024
   ;; connection timed out; no servers could be reached
   ==> dig +noall +answer apple.com @127.0.0.1 -p 1025
   apple.com.		74	IN	A	17.142.160.59
   apple.com.		74	IN	A	17.172.224.47
   apple.com.		74	IN	A	17.178.96.59
   ==> dig +noall +answer apple.com @127.0.0.1 -p 5000
   apple.com.		74	IN	A	17.178.96.59
   apple.com.		74	IN	A	17.172.224.47
   apple.com.		74	IN	A	17.142.160.59
   ==> dig +tcp +noall +answer apple.com @127.0.0.1 -p 53
   apple.com.		74	IN	A	17.142.160.59
   apple.com.		74	IN	A	17.178.96.59
   apple.com.		74	IN	A	17.172.224.47
   ==> dig +tcp +noall +answer apple.com @127.0.0.1 -p 1024
   apple.com.		74	IN	A	17.172.224.47
   apple.com.		74	IN	A	17.142.160.59
   apple.com.		74	IN	A	17.178.96.59
   ==> dig +tcp +noall +answer apple.com @127.0.0.1 -p 1025
   apple.com.		74	IN	A	17.178.96.59
   apple.com.		74	IN	A	17.172.224.47
   apple.com.		74	IN	A	17.142.160.59
   ==> dig +tcp +noall +answer apple.com @127.0.0.1 -p 5000
   apple.com.		74	IN	A	17.142.160.59
   apple.com.		74	IN	A	17.178.96.59
   apple.com.		74	IN	A	17.172.224.47
   ==> docker-compose down -v
   Stopping dnstestj1s2zdzn_dnsmasq_1 ... done
   Removing dnstestj1s2zdzn_dnsmasq_1 ... done
   Removing network dnstestj1s2zdzn_default

Running the same on the previous stable release of Docker for Mac (version 2.0.0.3) works as expected:

   davidalger:~$ curl -s https://gist.githubusercontent.com/davidalger/ff7be7e13f23ca59c96ada6004e3c25b/raw/529c296a20452b182cece5f7f5529530e95395da/dnsforwardtest.sh | bash
   ==> cd /var/folders/c8/l3c87j253jx43f5_whq5zsqc0000gn/T/dnstest.t8M3cNFL
   ==> docker-compose up -d
   Creating network "dnstestt8m3cnfl_default" with the default driver
   Pulling dnsmasq (jpillora/dnsmasq:)...
   latest: Pulling from jpillora/dnsmasq
   ba7f5deea89d: Pull complete
   bbeb009eb883: Pull complete
   609a25457ce0: Pull complete
   b0ad4c0d5e37: Pull complete
   d0477d12de9d: Pull complete
   Creating dnstestt8m3cnfl_dnsmasq_1 ... done
   ==> dig +noall +answer apple.com @127.0.0.1 -p 53
   apple.com.		3450	IN	A	17.172.224.47
   apple.com.		3450	IN	A	17.178.96.59
   apple.com.		3450	IN	A	17.142.160.59
   ==> dig +noall +answer apple.com @127.0.0.1 -p 1024
   apple.com.		3450	IN	A	17.142.160.59
   apple.com.		3450	IN	A	17.178.96.59
   apple.com.		3450	IN	A	17.172.224.47
   ==> dig +noall +answer apple.com @127.0.0.1 -p 1025
   apple.com.		3449	IN	A	17.172.224.47
   apple.com.		3449	IN	A	17.142.160.59
   apple.com.		3449	IN	A	17.178.96.59
   ==> dig +noall +answer apple.com @127.0.0.1 -p 5000
   apple.com.		3449	IN	A	17.178.96.59
   apple.com.		3449	IN	A	17.172.224.47
   apple.com.		3449	IN	A	17.142.160.59
   ==> dig +tcp +noall +answer apple.com @127.0.0.1 -p 53
   apple.com.		3449	IN	A	17.142.160.59
   apple.com.		3449	IN	A	17.178.96.59
   apple.com.		3449	IN	A	17.172.224.47
   ==> dig +tcp +noall +answer apple.com @127.0.0.1 -p 1024
   apple.com.		3449	IN	A	17.172.224.47
   apple.com.		3449	IN	A	17.142.160.59
   apple.com.		3449	IN	A	17.178.96.59
   ==> dig +tcp +noall +answer apple.com @127.0.0.1 -p 1025
   apple.com.		3449	IN	A	17.178.96.59
   apple.com.		3449	IN	A	17.172.224.47
   apple.com.		3449	IN	A	17.142.160.59
   ==> dig +tcp +noall +answer apple.com @127.0.0.1 -p 5000
   apple.com.		3449	IN	A	17.142.160.59
   apple.com.		3449	IN	A	17.178.96.59
   apple.com.		3449	IN	A	17.172.224.47
   ==> docker-compose down -v
   Stopping dnstestt8m3cnfl_dnsmasq_1 ... done
   Removing dnstestt8m3cnfl_dnsmasq_1 ... done
   Removing network dnstestt8m3cnfl_default

This issue makes the latest "stable" release of Docker Desktop completely unusable for myself and my colleagues, who rely on the dnsmasq container with a port forward for UDP 53 for *.test domains. Would be happy to provide more information if needed, but this appears to be a cut-n-dry case of a somewhat major regression in the stable release line.

The text was updated successfully, but these errors were encountered:

ericparton · 2019-07-31T20:49:54Z

I'm having the same issue using a similar setup with the codekitchen/dinghy-http-proxy container which also binds to port 53 to resolve local test domains for developers. The following command works on the previous version of docker for mac, but not the latest one:

nslookup app.test 127.0.0.1

JonathanGuo · 2019-07-31T22:00:11Z

Same issue happens to us as well with andyshinn/dnsmasq. Previous docker version works fine until upgraded to the latest one.

Docker desktop community (for mac): 2.1.0.0 (36874)
ENgine: 19.03.1
Compose: 1.24.1

hagleyj · 2019-08-01T19:10:11Z

I too am having this issue with a bind container and port 53 UDP. It does with with port 53 TCP though

christhomas · 2019-08-02T09:46:09Z

I also have this problem and now I have to downgrade docker in order for it to work again. It would be nice if we were given a more technical explanation of what is happening here rather than a patch is made or something like this. I would like to know why this is happening and what the resolution was. On a technical level.

Oops: I should have also added that yes, I confirm that hagleyj is right, 2.0.0.3 is functioning, but 2.1.0.0 is broken

hagleyj · 2019-08-02T12:30:37Z

I can confirm that downgrading to 2.0.0.3 stable allows UDP below 1024 to work again

stephen-turner · 2019-08-04T09:41:01Z

Any idea, @djs55?

back-2-95 · 2019-08-05T09:06:04Z

Also see pygmystack/pygmy-legacy#42

…3 for macOS hosts

djs55 · 2019-08-05T14:54:37Z

@davidalger thanks very much for the clear reproduction script. It does reproduce for me -- I'll try to figure out why. It's suspicious that it works for "unprivileged" ports but not for "privileged" ones. The code path for "privileged" ports is different so perhaps the problem is there.

christhomas · 2019-08-05T15:00:47Z

Just to give you some extra input. This has been an on-and-off problem with versions of docker for more than a year now. One version will be ok, the next will not be, a couple of versions after and it's back to normal again. Then it'll break suddenly. I was upgrading every edge version and having similar issues.

stephdavid · 2019-08-07T20:27:59Z

Hello, I have been suffering with this problem. I'm a little confused. Has it been fixed? If so, how do I go about sorting it on my system. This is stopping me from working on my local WordPress sites.

guillaumerose · 2019-08-07T21:07:59Z

We are preparing the release. It will be out tomorrow morning (UTC). You can give a try to https://download.docker.com/mac/stable/37199/Docker.dmg - it's the promoted build, not published yet.

…port 6053 for macOS hosts" This reverts commit 623d83c.

davidalger · 2019-08-07T21:32:56Z

Nice turnaround time @guillaumerose and @djs55. You guys rock!

Just installed the promoted build and I can confirm that build 37199 (v2.1.0.1) as linked above resolves the issue both in the provided test case as well as with our tooling on Warden where I initially discovered the issue.

Looking forward to seeing the release drop tomorrow! 🎉

guillaumerose · 2019-08-08T09:57:57Z

Release is out! Edge will be updated today or Monday.

christhomas · 2019-08-08T13:24:14Z

Yes, this is working, thanks for the quick fix!

Removed note about Docker Desktop edge line given the underlying issue was resolved in docker/for-mac#3775

docker-robott · 2020-07-02T03:01:18Z

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows.
/lifecycle locked

benschw mentioned this issue Aug 1, 2019

Stopped working in docker desktop for mac v2.1.0.0 4km3/docker-dnsmasq#26

Closed

hagleyj mentioned this issue Aug 1, 2019

Unable to contact a container over UDP #3780

Closed

dasrecht mentioned this issue Aug 2, 2019

local websites are not working after docker4mac upgrade to 2.1.0.0 pygmystack/pygmy-legacy#41

Closed

science695 mentioned this issue Aug 2, 2019

Docker for Mac 2.1.0.0 update breaks bind server cytopia/devilbox#616

Closed

lmakarov mentioned this issue Aug 3, 2019

Docksal breaks after updating to Docker 2.1.0.0 (macOS) docksal/docksal#1106

Closed

Keoghan mentioned this issue Aug 3, 2019

There are some issues with binding to low ports in Docker 2.1.0.0 (so use 2.0.0.3) konsulting/porter#66

Closed

guillaumerose mentioned this issue Aug 3, 2019

19.03.1 breaks ipv4 bindings #3792

Closed

2 tasks

guillaumerose added the status/acknowledged label Aug 3, 2019

stephen-turner assigned stephen-turner and djs55 and unassigned stephen-turner Aug 4, 2019

guillaumerose mentioned this issue Aug 5, 2019

Docker for Windows 2.1.0.0, UDP mapping is not working for intra-container communication docker/for-win#4424

Closed

2 tasks

back-2-95 mentioned this issue Aug 5, 2019

Fix non-working DNS resolver after docker 2.1.0.0 update druidfi/stonehenge#34

Merged

davidalger changed the title ~~UDP port 53 for dnsmasq fails (any port lower than 1024)~~ UDP port 53 for dnsmasq fails (any port 1024 and lower) Aug 5, 2019

davidalger added a commit to wardenenv/warden that referenced this issue Aug 5, 2019

Implement workaround for docker/for-mac#3775; publish DNS on port 605…

623d83c

…3 for macOS hosts

djs55 mentioned this issue Aug 5, 2019

go: fix binding of privileged UDP ports via vmnetd moby/vpnkit#485

Merged

davidalger added a commit to wardenenv/warden that referenced this issue Aug 7, 2019

Revert "Implement workaround for docker/for-mac#3775; publish DNS on …

30cea36

…port 6053 for macOS hosts" This reverts commit 623d83c.

guillaumerose closed this as completed Aug 8, 2019

davidalger added a commit to wardenenv/warden that referenced this issue Aug 19, 2019

Update README

14f6eb5

Removed note about Docker Desktop edge line given the underlying issue was resolved in docker/for-mac#3775

docker locked and limited conversation to collaborators Jul 2, 2020

docker-robott added the lifecycle/locked label Jul 2, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

UDP port 53 for dnsmasq fails (any port 1024 and lower) #3775

UDP port 53 for dnsmasq fails (any port 1024 and lower) #3775

davidalger commented Jul 31, 2019

ericparton commented Jul 31, 2019

JonathanGuo commented Jul 31, 2019

hagleyj commented Aug 1, 2019

christhomas commented Aug 2, 2019 •

edited

Loading

hagleyj commented Aug 2, 2019

stephen-turner commented Aug 4, 2019

back-2-95 commented Aug 5, 2019

djs55 commented Aug 5, 2019

christhomas commented Aug 5, 2019

stephdavid commented Aug 7, 2019

guillaumerose commented Aug 7, 2019

davidalger commented Aug 7, 2019

guillaumerose commented Aug 8, 2019 •

edited

Loading

christhomas commented Aug 8, 2019

docker-robott commented Jul 2, 2020

UDP port 53 for dnsmasq fails (any port 1024 and lower) #3775

UDP port 53 for dnsmasq fails (any port 1024 and lower) #3775

Comments

davidalger commented Jul 31, 2019

Expected behavior

Actual behavior

Information

Steps to reproduce the behavior

ericparton commented Jul 31, 2019

JonathanGuo commented Jul 31, 2019

hagleyj commented Aug 1, 2019

christhomas commented Aug 2, 2019 • edited Loading

hagleyj commented Aug 2, 2019

stephen-turner commented Aug 4, 2019

back-2-95 commented Aug 5, 2019

djs55 commented Aug 5, 2019

christhomas commented Aug 5, 2019

stephdavid commented Aug 7, 2019

guillaumerose commented Aug 7, 2019

davidalger commented Aug 7, 2019

guillaumerose commented Aug 8, 2019 • edited Loading

christhomas commented Aug 8, 2019

docker-robott commented Jul 2, 2020

christhomas commented Aug 2, 2019 •

edited

Loading

guillaumerose commented Aug 8, 2019 •

edited

Loading