moby / moby/moby

'swarm leave' breaks DNS resolution in a bridge network

Open
#45,144 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area/networking area/networking/dns area/swarm kind/bug status/0-triage
Dominant language
Go
Stars
72.1k
Forks
19.2k
Avg merge
1d 17h
Merged PRs (30d)
164

Description

Description

After leaving a swarm, hostname resolution in standalone containers within a bridge network is broken.

Consider the following docker-compose.yml:

version: "2"

services:
  node-1:
    image: alpine
    networks:
      - test_network
    command: tail -f /dev/null

  node-2:
    image: alpine
    networks:
      - test_network
    command: tail -f /dev/null

networks:
  test_network:
    driver: bridge
Reproduce
  1. $ docker compose up -d
  2. $ docker compose exec node-1 getent hosts node-2
    172.19.0.2 node-2 node-2
  3. $ docker compose exec node-2 getent hosts node-1
    172.19.0.3 node-1 node-1
  4. $ docker swarm init
  5. $ docker swarm leave --force
  6. $ docker compose exec node-1 getent hosts node-2
    (no result)
  7. $ docker compose exec node-2 getent hosts node-1
    (no result)
  8. $ docker compose exec node-1 ping node-2
    ping: bad address 'node-2'
Expected behavior
  • output in steps 6-7 is the same as in steps 2-3
  • ping in step 8 is successful
docker version
Client: Docker Engine - Community
 Version:           20.10.17
 API version:       1.41
 Go version:        go1.17.11
 Git commit:        100c701
 Built:             Mon Jun  6 23:02:46 2022
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.17
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.17.11
  Git commit:       a89b842
  Built:            Mon Jun  6 23:00:51 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.6
  GitCommit:        10c12954828e7c7c9b6e0ea9b0c02b01407d3ae1
 runc:
  Version:          1.1.2
  GitCommit:        v1.1.2-0-ga916309
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
docker info
Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Docker Buildx (Docker Inc., v0.8.2-docker)
  compose: Docker Compose (Docker Inc., v2.6.0)
  scan: Docker Scan (Docker Inc., v0.17.0)

Server:
 Containers: 2
  Running: 2
  Paused: 0
  Stopped: 0
 Images: 51
 Server Version: 20.10.17
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 10c12954828e7c7c9b6e0ea9b0c02b01407d3ae1
 runc version: v1.1.2-0-ga916309
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: default
  cgroupns
 Kernel Version: 5.15.0-67-generic
 Operating System: Ubuntu 22.04 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 1
 Total Memory: 7.764GiB
 Name: kuzjkavm
 ID: FVID:U7VB:TP5U:2UVI:QK2W:3SJD:BE5E:YXS7:HZNY:DP7R:UYL4:2BVO
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false
Additional Info

Hostname resolution is restored after restarting with docker compose restart.

Probably related to #38900, #42877

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure with the shown docker-compose.yml and the listed docker compose and docker swarm commands, comparing bridge-network DNS before and after swarm leave. Trace the swarm-leave transition and the bridge network state; done means node-1 and node-2 resolve and ping each other afterward without requiring docker compose restart.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, docker-compose
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.