nestybox / nestybox/sysbox

nftables & firewalld breaks DNS resolution when attached to a custom network

Open
#456 4 comments 0 reactions 1 assignee View on GitHub

@rodnymolina is already working on this.

Since Feb 23, 2022.

bug
Dominant language
Shell
Stars
3.9k
Forks
230
Avg merge
7h 48m
Merged PRs (30d)
3

Description

Create a new Dockerfile:

Failing dockerfile:

FROM ubuntu:rolling
ENTRYPOINT [ "/sbin/init", "--log-level=err" ]
RUN apt-get update
RUN apt-get install -y systemd openssh-server openssh-server nano vim
RUN echo "root:1" | chpasswd
RUN echo "PermitRootLogin yes" > /etc/ssh/sshd_config
RUN apt-get install -y firewalld dnsutils

Working dockerfile:

FROM ubuntu:focal
ENTRYPOINT [ "/sbin/init", "--log-level=err" ]
RUN apt-get update
RUN apt-get install -y systemd openssh-server openssh-server nano vim
RUN echo "root:1" | chpasswd
RUN echo "PermitRootLogin yes" > /etc/ssh/sshd_config
RUN apt-get install -y firewalld dnsutils
docker build -t firewalld_test .

Create the network:

docker network create -d bridge --subnet 10.6.0.0/16 firewalld_network

Run the container:

docker run --runtime sysbox-runc --ip 10.6.0.3 --rm --network firewalld_network firewalld

SSH into container:

ssh root@10.6.0.3

Run dig:

dig +time=3 +tries=1 @10.6.0.1 google.com # fails
dig +time=3 +tries=1 @1.1.1.1 google.com # works

cat /etc/resolv.conf
nameserver 10.6.0.1 # This is the expected value

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.