Docker nameserver resolution only as root

[Bipe]

Thank you!!!... i works, but still i have a very strange problem, if i try to resolve "localhost" inside a container it's return an error:

Code: Select all

mastercontainer:/var/www/docker-aio# nslookup localhost
Server:         127.0.0.11
Address:        127.0.0.11:53

** server can't find localhost: NXDOMAIN

** server can't find localhost: NXDOMAIN

Some ideas?. Thanks again.

Did you check contents of /etc/hosts?

yap!

etc/hosts have same permission issue (640)

@tab3rware
chmod 644 etc/hosts inside container and that should do it

[tommi2day]

You cant do chmod 644 if you are not root within the container. I am also afraid it would be not sufficient because the files will be rewritten at any restart.

This is the first docker implementation i see with this behavior. All others are creating these files with 0644 permission

@TMSupport: Do you have already brought this issue to your developers? Is there no QA in place to detect such errors? Many companies does not allow to run docker containers as root anymore.

[Bipe]

just change resolv.conf to hosts in my script from previous post and it will do the trick

it's not a permanent solution, that's why I've said create cron job

anyway, TM should either provide us with steps how to add users to acl or just leave everything 644

[Bipe]

to make it simpler, here are few steps that will:
create fixPerms.sh script (find all etc/resolv.conf and etc/hosts files in docker containers and apply chmod 644)
make script executable
add script crontab and run every minute

Code: Select all

# Create script
cat <<EOF > fixPerms.sh
#!/bin/bash
DOCKER_VOLUME=$(df --output=target | grep -i docker)

find $DOCKER_VOLUME/containers -name resolv.conf -o -name hosts -exec chmod 644 {} \;
EOF

# Make script executable
chmod +x fixPerms.sh

# Add script to crontab
echo "* * * * * $(pwd)/fixPerms.sh" >> /var/spool/cron/crontabs/$(whoami)

this is a dirty fix, but it should resolve our issues till there is a official fix

[davidecavestro]

Great! In the meantime I've seen that recursively granting read rights with the default ACL solves the issue.
I did it on the whole /Volume1/DockerData... probably it could be limited to /Volume1/DockerData/containers even though it is not fine-grained as I would.

I don't write here the command since I have little experience with ACLs and I don't want to mess up other folks NAS. (ifor the fearless readers, t is the setfacl I wrote above).

[tab3rware]

Thank you @Bipe and @davidecavestro for your usefull tips...

I will try them asap!

[tab3rware]

Yes, the "hostname" resolution works flawlessly, but we must change the permissions for Volumes too...

But the @Bipe scripts, i have to make a little modification:

Code: Select all

#!/bin/bash
DOCKER_VOLUME=$(df --output=target | grep -i docker)

# This not work... i don't know why...
# find $DOCKER_VOLUME/containers -name resolv.conf -exec chmod 644 {} \;

# Fix: split in two sentences
find $DOCKER_VOLUME/containers -name resolv.conf -exec chmod 644 {} \;
find $DOCKER_VOLUME/containers -name hosts -exec chmod 644 {} \;

The Terramaster docker package is buggy, and I would not recommend it for novice users.

[Bipe]

this will do:

Code: Select all

#!/bin/bash
DOCKER_VOLUME=$(df --output=target | grep -i docker)

find $DOCKER_VOLUME/containers \( -name resolv.conf -o -name hosts \) -exec chmod 644 {} \;

I've noticed that crontab is not persistent after reboot...

[TMzethar]

{L_BUTTON_AT}Bipe

Hi, We are troubleshooting DNS resolution issues for Docker containers. If possible, can you provide us with the detailed usage process? You can record and package the process in graphic form and send it to our support email support(at)terra-mater.com. This will help us better locate the problem.
Here's what we need to know:
1. What is the image name of the container you used when you found the problem?
2. What kind of usage scenarios and running purposes do you need the docker container to achieve?
3. How is your container configured?
4. Under what circumstances did you encounter DNS resolution problems?
5. What role do you think DNS resolution can play in the mirror application?
Sincerely thank you for your feedback.

[tommi2day]

@ TMzethar

Maybe you (and all others from TM) have overseen in my initial post in this thread i made already a complete analyis of this problem.

You can take ANY Image to see this problem. If you running this image as root, its working fine, if you have to use another user, its in stuck
sample. This affects ANY Container with the working User not running as root (as it is recommanded for security reasons)

Code: Select all

docker run --rm -it ubuntu
root@7ae02c35fcbe:/# getent hosts www.google.de
2a00:1450:400c:c07::5e www.google.de

We are root, it works
Now create a "normal user", switch to this user and try again

Code: Select all

root@7ae02c35fcbe:/# useradd -m test
root@7ae02c35fcbe:/# su - test
$ id
uid=1000(test) gid=1000(test) groups=1000(test)
$ getent hosts www.google.de

No answer means not found. The reason is (as already explained), the resolv.conf and maybe more files in /Volume1/DockerData are not readable within the container for others

Code: Select all

root@7ae02c35fcbe:/# ls -l /etc/resolv.conf
-rw-r-----+ 1 root root 469 Aug 23 18:46 /etc/resolv.conf

with docker inspect <container> |grep Path you can find the real location of these system mountet files

Code: Select all

"ResolvConfPath": "/Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/resolv.conf",
        "HostnamePath": "/Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/hostname",
        "HostsPath": "/Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/hosts",
        "LogPath": "/Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61-json.log",
> ls -laZ /Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/resolv.conf
-rwxrwx---+ 1 diskmaster diskmaster ? 86 Aug 23 21:01 /Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/resolv.conf       

You can compare the needed file system permission with other docker implementations. Here is a sample from a ubuntu vm, these files should be readable for "others"

Code: Select all

sudo ls -laZ /docker_sys/var/containers/07c3215f6b7fe4ed02b7644dab5ca10e6ced6dfd490f86508e9a30a39e1bf3ef/resolv.conf
-rw-r--r-- 1 root root ? 81 Aug 20 09:16 /docker_sys/var/containers/07c3215f6b7fe4ed02b7644dab5ca10e6ced6dfd490f86508e9a30a39e1bf3ef/resolv.conf

Pls fix the the permission settings and this problem will be solved