Sysbox unable to handle read-only rootfs requirement about sysbox HOT 5 CLOSED

@gramakri, i see your point.

The error that Sysbox displays above (as part of problem 2) is a direct consequence of some DNS tweaking we did a while back to avoid resolution issues in nested containers. Basically, in scenarios where docker internal DNS is utilized (i.e. whenever docker's custom-networks are used), docker pushes a "127.0.0.11" entry into the container's resolv.conf, and creates a SNAT iptable-entry to ensure that DNS queries are forwarded to the docker's embedded DNS running in the host. That works well for containers running at level-1, but it causes issues for nested containers (L2+), as these rely on Docker's default DNS server (i.e. 8.8.8.8). As a result, DNS queries initiated from L2 containers end up going to an external DNS server and not to the one running in the host.

We fixed this problem by having Sysbox writing a valid/routable address in resolv.conf (we picked the L1 container's egress iface), and by adjusting the iptables to ensure that all DNS queries are forwarded to Docker's embedded DNS server.

I'm explaining all this so that you understand that, from my perspective, your DNS setup is no special, you are just relying on Docker's embedded DNS server, and the problem is triggered simply coz we can't write into the container's resolv.conf as it's mounted as RO. (fix is WIP).

Please let me know if there's anything that i haven't fully understood from your DNS setup.

from sysbox.

Fixed by sysbox-runc PR #22. Closing now.

from sysbox.

(co-founder of Cloudron) . Let me know if you need any clarifications on the Cloudron setup. Do you know of any workaround for the DNS resolution? We have an unbound server on the host and we require the containers to resolve via that DNS server. This is required for email server dnsbl lookups to work reliably across all VPS providers.

Thanks for looking into this!

from sysbox.

(co-founder of Cloudron) . Let me know if you need any clarifications on the Cloudron setup. Do you know of any workaround for the DNS resolution? We have an unbound server on the host and we require the containers to resolve via that DNS server. This is required for email server dnsbl lookups to work reliably across all VPS providers.

Thanks for looking into this!

Thanks @gramakri, @vRobM has been very helpful answering my questions and providing the setup. I'm expecting to have a fix for this issue very soon.

Now, coming to the DNS issue that you eluded to, is this something that you have replicated in the setup that i've been using (with my temporary fixes), or is this a separate setup? If this is a different environment, could you please file a separate issue for this with a brief explanation?

from sysbox.

@rodnymolina Ah sorry, I was merely commenting on your point no. 2 in the initial bug report. I was just letting you know why our DNS setup is the way it is, nothing more :)

from sysbox.