Comments (5)
@gramakri, i see your point.
The error that Sysbox displays above (as part of problem 2) is a direct consequence of some DNS tweaking we did a while back to avoid resolution issues in nested containers. Basically, in scenarios where docker internal DNS is utilized (i.e. whenever docker's custom-networks are used), docker pushes a "127.0.0.11" entry into the container's resolv.conf, and creates a SNAT iptable-entry to ensure that DNS queries are forwarded to the docker's embedded DNS running in the host. That works well for containers running at level-1, but it causes issues for nested containers (L2+), as these rely on Docker's default DNS server (i.e. 8.8.8.8). As a result, DNS queries initiated from L2 containers end up going to an external DNS server and not to the one running in the host.
We fixed this problem by having Sysbox writing a valid/routable address in resolv.conf (we picked the L1 container's egress iface), and by adjusting the iptables to ensure that all DNS queries are forwarded to Docker's embedded DNS server.
I'm explaining all this so that you understand that, from my perspective, your DNS setup is no special, you are just relying on Docker's embedded DNS server, and the problem is triggered simply coz we can't write into the container's resolv.conf as it's mounted as RO. (fix is WIP).
Please let me know if there's anything that i haven't fully understood from your DNS setup.
from sysbox.
Fixed by sysbox-runc PR #22. Closing now.
from sysbox.
(co-founder of Cloudron) . Let me know if you need any clarifications on the Cloudron setup. Do you know of any workaround for the DNS resolution? We have an unbound server on the host and we require the containers to resolve via that DNS server. This is required for email server dnsbl lookups to work reliably across all VPS providers.
Thanks for looking into this!
from sysbox.
(co-founder of Cloudron) . Let me know if you need any clarifications on the Cloudron setup. Do you know of any workaround for the DNS resolution? We have an unbound server on the host and we require the containers to resolve via that DNS server. This is required for email server dnsbl lookups to work reliably across all VPS providers.
Thanks for looking into this!
Thanks @gramakri, @vRobM has been very helpful answering my questions and providing the setup. I'm expecting to have a fix for this issue very soon.
Now, coming to the DNS issue that you eluded to, is this something that you have replicated in the setup that i've been using (with my temporary fixes), or is this a separate setup? If this is a different environment, could you please file a separate issue for this with a brief explanation?
from sysbox.
@rodnymolina Ah sorry, I was merely commenting on your point no. 2 in the initial bug report. I was just letting you know why our DNS setup is the way it is, nothing more :)
from sysbox.
Related Issues (20)
- podman/buildah cannot list nestybox+cri-o containers HOT 2
- AKS sysbox nodes sporadically enter bad state (`stat failed on /var/lib/containers/storage/overlay/...`) HOT 16
- docker: Error response from daemon: unknown or invalid runtime name: sysbox-runc. HOT 1
- AKS sysbox container missing /proc/sys/net/ipv4/neigh/default HOT 8
- No such file or directory - unprivileged_userns_clone HOT 8
- Sysbox doesn't work with estargz compressed images
- Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? HOT 6
- EKS 1.28 won't install sysbox through sysbox-deploy-k8s daemonset HOT 5
- Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? HOT 3
- content of /proc/sys/kernel/random/uuid is always the same HOT 2
- Error in supervisord.conf of jenkins exemplary docker file HOT 2
- Kubernetes 1.29 support HOT 1
- failed to create sysbox-mgr: ID-mapping check failed on ZFS HOT 3
- can't build sysbox-in-docker image. `sysbox-runc` binary not available HOT 2
- writing /etc/resolv.conf caused: open /etc/resolv.conf: permission denied: unknown without "userns-remap":"sysbox"; kernel version is fine HOT 4
- sysbox k8s directory mounted as nobody HOT 9
- ingress networking in docker swarm in dind not working.. it's working fine on the docker host HOT 1
- Docker Desktop Compatibility (Windows 11) HOT 2
- Missing packages cmp, slices with 4a266da HOT 2
- sysbox-fs high cpu usage, infinite unmount calls on shared device HOT 11
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sysbox.