I think this is one of the widely discussed problem in SO Network. Most of the solutions are either out-dated or stale suggestions with latest Ubuntu (21.04)/Systemd changes.
Problem: VPN Changes from Host Network are not honored by Docker containers.
Tried Solutions:
- Docker daemon supports custom dns resolution.
{
"dns": ["172.17.0.1", "8.8.8.8", "8.8.4.4"]
}
This solution is not working with Systemd DNS Resolution.
resolvectl status
Link 7 (docker0)
Current Scopes: none
Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Link 92 (tun0)
Current Scopes: DNS
Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 1.1.1.1
DNS Servers: 1.1.1.1
DNS Domain: consul vpn.net
- Installed dnsmasq and bind it to
docker0 interface
in/etc/dnsmasq.conf
interface=docker0
listen-address=172.17.0.1
If I use bind-dynamic
, it fails with bind-dynamic and bind-interfaces
can't be used together. I had to dig up from where bind-interfaces
is being set
Finally found here:
cat /etc/dnsmasq.d/libvirt-daemon
───────┬───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│ File: /etc/dnsmasq.d/libvirt-daemon
───────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
1 │ bind-dynamic
2 │ except-interface=virbr0
Changed line 1 bind-interfaces
to bind-dynamic
and didn't add explicitly in dnsmasq.conf
.
This seems to be working post restarting docker and dnsmasq
services.
However post rebooting the system, this doesn't work again. It only works if I start services in the following order docker first (so that 172.17.0.1 comes available) and dnsmasq following that
or I have to restart dnsmasq service explicitly to bind to 172.17.0.1 properly.
I didn't disable Systemd DNS resolver to avoid any future upgrade/integration issues with Network Manager and any other components.
Please suggest the solution
- Avoid restarting dnsmasq service every time post reboot
- Is there elegant solution instead of messing around SystemD/dnsmasq/docker. Simply one DNS resolution across all services/interfaces?