How does the Docker DNS work?

Huỳnh Quang Thảo

Today, I have an issue related to the DNS inside my docker container. I ask myself a very “obvious” question: how does the docker DNS work. The first Google result is:

https://kerneltalks.com/networking/how-docker-container-dns-works/

Docker is coded in a smart way. When you run new container on the docker host without any DNS related option in command, it simply copies host’s /etc/resolv.conf into the container.

The explanation is very clear. Sound likes I understand how docker DNS works. If you confuse what is the purpose of /etc/resolv.confThere is the documentation here.

I try to verify again by creating a docker container and then check the matching of the file resolv.confbetween the created container with the host. Here are the commands:

# run sample nginx image
docker run --name nginx -d nginx
# get the resolv.conf content
docker exec -it nginx cat /etc/resolv.conf
[Result]
nameserver 192.168.65.1

192.168.65.1is the private IP and furthermore, it doesn’t match with macOS /etc/resolv.conf file.

nameserver 8.8.8.8 (I am using Google DNS)

That is not what I expected. Luckily, I found this issue on the GitHub:

https://github.com/docker/for-mac/issues/684

Docker for Mac does some “magic” (using vpnkit) to transparently route the network traffic from the containers (running inside a Linux VM, as well as the docker daemon) to your macOS networking stack. VPNKit is automatically updated when you update /etc/resolv.confbut it doesn't update the VM (and containers) network configuration.

I guess the above theory will be correct on Linux machines? I try an experiment by creating a Linux instance using Digital Ocean service. Then I run the following commands:

docker run  --name nginx -d nginx
docker exec -it nginx cat /etc/resolv.conf
[Result]
nameserver 67.207.67.2
nameserver 67.207.67.3

After that, I compare with Digital Ocean instance /etc/resolv.conf file.

cat /etc/resolv.conf[Result]
nameserver 127.0.0.53
options edns0

Strange :( It is still not equal. 127.0.0.53 is a private IP but 67.207.67.2 and 67.207.67.3are public IPs. Who is the owner of those public IPs?

whois 67.207.67.2[Result]
Organization: DigitalOcean, LLC (DO-13)
RegDate: 2016-04-12
Updated: 2016-04-12

Understood. This is the Digital Ocean’s DNS servers. So my container uses those IPs for resolving domain names. In that case, what is the private IP 127.0.0.53? Looking at the comment in the file /etc/resolv.conf

# This is a dynamic resolv.conf file for connecting local clients to the internal DNS stub resolver of systemd-resolved. This file lists all configured search domains.

# Run “systemd-resolve — status” to see details about the uplink DNS server currently in use.

So I try as the comment says:

systemd-resolve --status[Result]
DNS servers:
67.207.67.2
67.207.67.3

Problem solved. Docker containers take DNS IPs from the host machine, which is managed by systemd-resolve . Those IPs themselves are the cloud provider’s DNS.

Just the last question, why do we need systemd-resolvein the first place, but not use DNS IP directly. Here is the answer from the Ubuntu man page:

http://manpages.ubuntu.com/manpages/bionic/man8/systemd-resolved.service.8.html

systemd-resolved is a system service that provides network name resolution to local applications. It implements a caching and validating DNS/DNSSEC stub resolver, as well as an LLMNR resolver and responder.

I try the last command to see how much does this service can cache the data:

systemd-resolve --statistics[Result]
DNSSEC supported by current servers: no
Transactions
Current Transactions: 0
Total Transactions: 6212
Cache
Current Cache Size: 3
Cache Hits: 2408
Cache Misses: 3830
...

That is the end of our journey. Hope you see this blog post useful: )

Huỳnh Quang Thảo

Written by

Always true 98%. Don’t care 3% others

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade