Arch Linux

C13251

Member

Registered: 2013-12-13

Posts: 6

docker can ping but can't resolve hosts

Hello!

My docker has this weird issue where it can ping but cannot resolve hostnames. Any idea is appreciated!

$ docker run  -it busybox sh
/ # ping -c 2 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=59 time=81.877 ms
64 bytes from 8.8.8.8: seq=1 ttl=59 time=17.054 ms

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 17.054/49.465/81.877 ms
/ # cat /etc/resolv.conf 
nameserver 8.8.8.8
nameserver 8.8.4.4
/ # ping google.com
ping: bad address 'google.com'
/ # nslookup -debug -timeout=10 google.com 8.8.8.8
;; connection timed out; no servers could be reached

I tried:
- Disabling ufw
- Mess with sysctl forward (enable/disable)
- Prune all docker configurations
- Reinstall docker
- Using this: https://aur.archlinux.org/packages/ufw-docker
- Mess with resolvectl

Any idea is very appreciated. I have none.

$ networkctl list                     
IDX LINK    TYPE     OPERATIONAL SETUP     
  1 lo      loopback carrier     unmanaged
  2 enp3s0  ether    enslaved    configured
  3 br0     bridge   routable    configured
  4 wlp2s0  wlan     off         unmanaged
 12 docker0 bridge   no-carrier  unmanaged

5 links listed.

$ resolvectl status
Global
           Protocols: +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported
    resolv.conf mode: uplink
  Current DNS Server: 8.8.8.8#dns.google
         DNS Servers: 1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net 8.8.8.8#dns.google 2606:4700:4700::1111#cloudflare-dns.co
Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net 8.8.8.8#dns.google 2606:4700:4700::1111#cloudflare-dns.com 2620:fe::9#dns.quad9.net
                      2001:4860:4860::8888#dns.google

Link 2 (enp3s0)
Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 3 (br0)
    Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
         Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 208.67.220.220
       DNS Servers: 208.67.220.220 208.67.222.222 192.168.32.1

Link 4 (wlp2s0)
Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 12 (docker0)
Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

$ docker info
Client:
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc., v0.8.2-docker)
  compose: Docker Compose (Docker Inc., 2.6.0)

Server:
 Containers: 2
  Running: 0
  Paused: 0
  Stopped: 2
 Images: 1
 Server Version: 20.10.17
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: false
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 10c12954828e7c7c9b6e0ea9b0c02b01407d3ae1.m
 runc version: 
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
  cgroupns
 Kernel Version: 5.15.47-1-lts
 Operating System: Arch Linux
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 7.617GiB
 Name: nuc-arch
 ID: IM2O:QJ2U:VVYV:L4MZ:GB5Q:PH7J:IDZF:5VKM:HG26:DUSD:JPK3:XLFN
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

C13251

Member

Registered: 2013-12-13

Posts: 6

Re: docker can ping but can't resolve hosts

After all looks that the problem is only UDP.

For example,

$ docker run --rm -ti toolbelt/dig google.com @1.1.1.1

; <<>> DiG 9.16.29 <<>> google.com @1.1.1.1
;; global options: +cmd
;; connection timed out; no servers could be reached

fails because dig uses port 53 UDP. But is successful when forced to use TCP

$ docker run --rm -ti toolbelt/dig google.com @1.1.1.1 +tcp

; <<>> DiG 9.16.29 <<>> google.com @1.1.1.1 +tcp
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46390
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             143     IN      A       172.217.168.174

;; Query time: 10 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Sun Jun 19 20:20:01 UTC 2022
;; MSG SIZE  rcvd: 55

Last edited by C13251 (2022-06-19 20:41:17)