Coredns process consumes high resources about docker-wireguard HOT 13 CLOSED

from docker-wireguard.

I also have the high CPU usage from coredns when running this image out of the box. The command I'm using to create the container is:

docker create
--name=wireguard
--cap-add=NET_ADMIN
--cap-add=SYS_MODULE
-e PUID=1000
-e PGID=1000
-e TZ=<mytz>
-e SERVERURL=<mydomain> `#optional`
-e SERVERPORT=51820 `#optional`
-e PEERS=1 `#optional`
-e PEERDNS=auto `#optional`
-e INTERNAL_SUBNET=10.13.13.0 `#optional`
-p 51820:51820/udp
-v /wireguard/config:/config
-v /lib/modules:/lib/modules
--sysctl="net.ipv4.conf.all.src_valid_mark=1"
--restart unless-stopped
linuxserver/wireguard

What am I doing wrong? I tried changing PEERDNS=auto to PEERDNS=<my router ip> but it made no difference.

sorry for the delays but we've only just recently determined the root cause, thanks to user Tokugero on discord. The issue is that when you use docker create, as you did here without specifying a docker network, it will use the default bridge network which does NOT support docker dns. In compose, this is not an issue, with docker run or docker create, you must specify the user-defined docker network you created. You can also simply set PEERDNS=8.8.8.8 or something.

We are updating the application setup section in the readme to address this.

from docker-wireguard.

specifically, the docker dns address we used, 127.0.0.11, is not present in the default bridge network (or host networking). That's why coredns was going crazy.

We have a fix now, which will tell coredns to use the /etc/resolv.conf info instead rather than the hardcoded 127.0.0.11. Existing users will have to delete their /config/coredns/Corefile and restart after updating the image to the next build.

from docker-wireguard.

I'm experiencing the same issue.

Edit:
Using docker-compose template - coredns seems to be used when PEERDNS is set to auto ?
Couldn't be a way to disable coreDNS with an env variable ?

from docker-wireguard.

Found it !

CoreDNS config was pointing to itself, which lead to infinite loop

@mr-cn
Check your config/coredns/Corefile

. {
    forward . 127.0.0.11
}

And point to another DNS

Example

. {
    forward . 8.8.8.8
}

Edit: Formatting

from docker-wireguard.

It's not pointing to itself. It's pointing to the docker dns resolver, 127.0.0.11, which should forward requests to whatever dns resolver is set by the docker system (likely host)

from docker-wireguard.

Running /app/coredns from container gives me this for each query

[INFO] 127.0.0.1:53456 - 63497 "A IN <whatever_domain>. udp 34 false 512" NOERROR qr,aa,rd 106 0.000091121s

Note: container is mapped with host network

from docker-wireguard.

Note: container is mapped with host network

That would be why you're having issues

from docker-wireguard.

Found it !

CoreDNS config was pointing to itself, which lead to infinite loop

@mr-cn
Check your config/coredns/Corefile

. {
    forward . 127.0.0.11
}

And point to another DNS

Example

. {
    forward . 8.8.8.8
}

Edit: Formatting

For the avoidance of doubt this quoted post is incorrect.

To expand on @aptalca reply docker has an internal DNS system which presents as a loopback within each container on 127.0.0.11. This allows you to lookup both public DNS (via hosts resolver) and internal docker DNS e.g. other container names.

If you make the change listed above you will fundamentally break internal docker lookups.

Unless you absolutely understand what this means and actually need to break it then do not do this.

from docker-wireguard.

I also have the high CPU usage from coredns when running this image out of the box. The command I'm using to create the container is:

docker create
--name=wireguard
--cap-add=NET_ADMIN
--cap-add=SYS_MODULE
-e PUID=1000
-e PGID=1000
-e TZ=<mytz>
-e SERVERURL=<mydomain> `#optional`
-e SERVERPORT=51820 `#optional`
-e PEERS=1 `#optional`
-e PEERDNS=auto `#optional`
-e INTERNAL_SUBNET=10.13.13.0 `#optional`
-p 51820:51820/udp
-v /wireguard/config:/config
-v /lib/modules:/lib/modules
--sysctl="net.ipv4.conf.all.src_valid_mark=1"
--restart unless-stopped
linuxserver/wireguard

What am I doing wrong? I tried changing PEERDNS=auto to PEERDNS=<my router ip> but it made no difference.

from docker-wireguard.

from docker-wireguard.

I've had the same problem. try changing your Corefile in /coredns. Like this example:

$ cat Corefile
.:5353 {
  wgsd example.com. wg0
}

https://coredns.io/explugins/wgsd/

from docker-wireguard.

@vimania what exactly does that do and how does it work?

from docker-wireguard.