Docker nameserver resolution only as root

[tommi2day]

I noticed internal container name server resolution is only working if the container runs as root(id 0). Its complete independend from image, its always the same. As a non root user you cant neither resolve internal container names within docker network as not using global nor dedicated nameserver handover via --dns option.
sample:

grafana | logger=grafana.update.checker t=2023-07-02T17:29:33.63417048+02:00 level=error msg="Update check failed" error="failed to get latest.json repo from github.com: Get \"https://raw.githubusercontent.com/grafa ... atest.json\": dial tcp: lookup raw.githubusercontent.com on [::1]:53: dial udp [::1]:53: connect: cannot assign requested address" duration=2.938707ms

after reading a lot pages it seems terramaster has an acl active which prohibits non root users to read resolv.conf. Is this intentional or an bug?

> docker inspect grafana
....
"Image": "sha256:f08ad401a4d5c0fa1eee19a42ad7a73bf01f809d414f0cbdf08a5599fb549e4e",
"ResolvConfPath": "/Volume1/DockerData/containers/03ad5c10c8c9ec7c59f8de69c3bfb690cad99335720d999b0f58cb47c05e2436/resolv.conf",
"HostnamePath": "/Volume1/DockerData/containers/03ad5c10c8c9ec7c59f8de69c3bfb690cad99335720d999b0f58cb47c05e2436/hostname",

>getfacl /Volume1/DockerData/containers/03ad5c10c8c9ec7c59f8de69c3bfb690cad99335720d999b0f58cb47c05e2436/resolv.conf
getfacl: Removing leading '/' from absolute path names
# file: Volume1/DockerData/containers/03ad5c10c8c9ec7c59f8de69c3bfb690cad99335720d999b0f58cb47c05e2436/resolv.conf
# owner: diskmaster
# group: diskmaster
user::---
user:diskmaster:rwx #effective:r--
user:tmbackup:r-x #effective:r--
user:docker:--x #effective:---
group::--x #effective:---
group:diskmaster:--x #effective:---
group:admin:rwx #effective:r--
group:media:rwx #effective:r--
mask::r--
other::---

[topo01]

Hi
could this issue be related to my problem here:
viewtopic.php?f=43&t=4947

It too seams to be a problem with inter-container communication throwing an error about ...failure in name resolution...

[tommi2day]

you can verify this if you try to run your container as root or use a ip instead of of container name in your db connection. As idea expose the db container ports to your nas, then you can use the ip of your nas with the exposed port as db connection to have a fixed NAS IP instead of dynamic container ips.

[tommi2day]

Maybe now after 3 weeks would be a good time to get an official answer from terramaster support

[topo01]

{L_BUTTON_AT}tommi2day

Thanks! Will try to explore along those lines.

[tab3rware]

Hi, similar problem here.

Mi scenario:
- TOS: 5.1.40
- Docker: 1.1.99

I have installed "portainer", but i have tried from shell too. I try to create an Nextcloud instance, with "Nextcloud AIO", and i'm stuck in:

Code: Select all

Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request

Reason: DNS lookup failure for: localhost

In this case, it's not working with root user even. The problem is with the Docker internal DNS server, it can't resolve any domain or host. I tried with my computer, without problems. I raised an issue to "Nextcloud AIO" team, but it's clearly an error in terramaster docker package.

I check the docker networks, and the gateways, an all seems to be ok...

Please help!

[Bipe]

I've made a script that will change permissions of all container resolv.conf files to 644, as they should be.
This will fix DNS resolving when running containers with users that are not root (eg. arr apps)

I have tried playing with group / user permissions via TOS GUI, but in the end the simplest solution was to create cron job that will simple find script

Code: Select all

#!/bin/bash
DOCKER_VOLUME=$(df --output=target | grep -i docker)

find $DOCKER_VOLUME/containers -name resolv.conf -exec chmod 644 {} \;

[tab3rware]

I've made a script that will change permissions of all container resolv.conf files to 644, as they should be.
This will fix DNS resolving when running containers with users that are not root (eg. arr apps)

I have tried playing with group / user permissions via TOS GUI, but in the end the simplest solution was to create cron job that will simple find script

Code: Select all

#!/bin/bash
DOCKER_VOLUME=$(df --output=target | grep -i docker)

find $DOCKER_VOLUME/containers -name resolv.conf -exec chmod 644 {} \;

Thank you!!!... i works, but still i have a very strange problem, if i try to resolve "localhost" inside a container it's return an error:

Code: Select all

mastercontainer:/var/www/docker-aio# nslookup localhost
Server:         127.0.0.11
Address:        127.0.0.11:53

** server can't find localhost: NXDOMAIN

** server can't find localhost: NXDOMAIN

Some ideas?. Thanks again.

[davidecavestro]

Thank you!!!... i works, but still i have a very strange problem, if i try to resolve "localhost" inside a container it's return an error:

Code: Select all

mastercontainer:/var/www/docker-aio# nslookup localhost
Server:         127.0.0.11
Address:        127.0.0.11:53

** server can't find localhost: NXDOMAIN

** server can't find localhost: NXDOMAIN

Some ideas?. Thanks again.

Did you check contents of /etc/hosts?

[davidecavestro]

what about issuing this command?
setfacl -R -d -m o::r /Volume1/DockerData
After nearly 1 month without any advice from support I must try... boar assault