nftables & firewalld breaks DNS resolution when attached to a custom network
Open
@rodnymolina is already working on this.
Since Feb 23, 2022.
bug
- Dominant language
- Shell
- Stars
- 3.9k
- Forks
- 230
- Avg merge
- 7h 48m
- Merged PRs (30d)
- 3
Description
Create a new Dockerfile:
Failing dockerfile:
FROM ubuntu:rolling
ENTRYPOINT [ "/sbin/init", "--log-level=err" ]
RUN apt-get update
RUN apt-get install -y systemd openssh-server openssh-server nano vim
RUN echo "root:1" | chpasswd
RUN echo "PermitRootLogin yes" > /etc/ssh/sshd_config
RUN apt-get install -y firewalld dnsutils
Working dockerfile:
FROM ubuntu:focal
ENTRYPOINT [ "/sbin/init", "--log-level=err" ]
RUN apt-get update
RUN apt-get install -y systemd openssh-server openssh-server nano vim
RUN echo "root:1" | chpasswd
RUN echo "PermitRootLogin yes" > /etc/ssh/sshd_config
RUN apt-get install -y firewalld dnsutils
docker build -t firewalld_test .
Create the network:
docker network create -d bridge --subnet 10.6.0.0/16 firewalld_network
Run the container:
docker run --runtime sysbox-runc --ip 10.6.0.3 --rm --network firewalld_network firewalld
SSH into container:
ssh root@10.6.0.3
Run dig:
dig +time=3 +tries=1 @10.6.0.1 google.com # fails
dig +time=3 +tries=1 @1.1.1.1 google.com # works
cat /etc/resolv.conf
nameserver 10.6.0.1 # This is the expected value
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.