New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
DNS searches across namespaces is BROKEN on some OSes #10161
Comments
|
Per https://docs.docker.com/articles/networking/, docker mimics the /etc/resolv.conf from host, onto the container if we dont use dns flags while creating the container. So one way could be to modify the /etc/hosts file on each node to have the additional nameserver, new search paths and the ndots option. This also helps make cluster dns available to nodes without having to specify 10.0.0.10 Proof-of-concept below.. |
|
That would explain why we didn't see this in most of our (OpenShift) testing - we moved the resolver entry for service DNS to the node resolv.conf so that the docker daemon could resolve service DNS names and apply SSL certificates to the internal hosted Docker registry (which was a service).
|
|
Do you set ndots? How do you do namespace-relative resolving without a
|
|
To make the resolv.conf pod-specific, kubelet could create a pod-specific foo-pod-resolve.conf and mount foo-pod-resolv.conf to /etc/resolv.conf for the pod's pause container. This is not a clean solution, but could be a workaround till docker gives the ndots flag. |
|
Abhi, Great idea but I can't find a way to make Docker respect that as a volume On Sun, Jun 21, 2015 at 1:18 PM, Abhi Shah notifications@github.com wrote:
|
|
Yeah it's not possible to mount over
|
If we modify kubelet to mount the custom resolv.conf on the pause container, it should work. Edit: The above doesn't work. Seen comments below |
|
That is not the behavior I see. On Sun, Jun 21, 2015 at 5:25 PM, Abhi Shah notifications@github.com wrote:
|
|
@thockin I see the behavior you see. Node's /etc/resolv.conf always wins. Edit: Check comment below. we can simply umount /etc/resolv.conf and the user-defined mount becomes visible. |
|
@thockin @smarterclayton umount /etc/resolv.conf does the trick. (if container is running as privileged) $ docker run -ti --privileged -v /tmp/foo.conf:/etc/resolv.conf ubuntu:latest /bin/bash
root@ab7c3cd9f8d3:/# cat /etc/resolv.conf
search corp.google.com prod.google.com prodz.google.com google.com
options ndots:2
nameserver 8.8.8.8
nameserver 8.8.4.4
root@ab7c3cd9f8d3:/# umount /etc/resolv.conf
root@ab7c3cd9f8d3:/# cat /etc/resolv.conf
nameserver 10.0.0.10
search hockin.org
options ndots:3 |
|
Unfortunately, this means that every container would have to be able to run as privileged to execute umount. Maybe we can use nsenter to unmount without having to run the docker container as privileged. |
|
To run the container in non-privileged mode, and still override resolv.conf we can do the following: |
|
And they would all have to have and run umount. This is a non-starter, I On Mon, Jun 22, 2015 at 7:53 AM, Abhi Shah notifications@github.com wrote:
|
|
Steps would be:
|
|
This is a race with containers actually starting up. On Mon, Jun 22, 2015 at 8:43 AM, Abhi Shah notifications@github.com wrote:
|
|
The node's /etc/resolv.conf isn't wrong.. it is just a subset and does not resolve cluster dns names. Also, since ndots is not specified in the original /etc/resolv.conf, we don't have to worry about incorrect resolutions.. |
|
|
Although I guess that's still controlled inside the container. I don't know if there's a way around having ndots written to inner container. Everything else is arbitrary search. |
|
We can do the following:
At this point, functionality-wise, nothing has changed. The mounted /etc/resolv.conf is ignored.
containers with no problems keep working since the new /etc/resolv.conf is essentially the same So we dont go backwards with this approach.. |
|
This might just work. It's a little scary, but it might work.
|
|
Scary. Seems like ndots is a pretty valuable thing for Docker in general - is there already an issue open to consider it?
|
|
Yes, I have a sketch PR for them, too.
|
|
I am working on a proof-of-concept PR to do the mount/umount stuff. I started working on it today. |
|
Experimental Proof-of-concept I tried the PR by launching a cluster with it and verifying the created pod-containers. |
|
I moved this back 1.0 because it broke with any docker image which has ubuntu as the base image for now, @thockin? |
|
I will take a look later today.
|
|
There might also be a simpler option: That way we never mount or umount anything... |
|
Fixed by #10266, I think |
Debian wheezy:
Debian jessie (and ubuntu 14.04):
Our DNS tester just happens to be based on wheezy, as does our container VM image. Apparently this does not (and has never?) worked for other OSes. There is a resolv.conf param called "ndots" that governs this and it is documented as defaulting to 1 while we need it to be at least 3. I found a thread where someone else also saw this on Debian late 2014, but no root cause.
As far as I can tell, there is no way to get docker to write this resolv.conf option. I will open a bug with them.
@smarterclayton @bgrant0607 @brendandburns @ArtfulCoder
I am marking this as P0 for discussion so we can decide what, if anything, to do.
The text was updated successfully, but these errors were encountered: