Page 2 of 3
Re: Docker nameserver resolution only as root
Posted: 01 Aug 2023, 04:04
by Bipe
davidecavestro wrote: ↑01 Aug 2023, 00:23
tab3rware wrote: ↑31 Jul 2023, 23:21
Thank you!!!... i works, but still i have a very strange problem, if i try to resolve "localhost" inside a container it's return an error:
Code: Select all
mastercontainer:/var/www/docker-aio# nslookup localhost
Server: 127.0.0.11
Address: 127.0.0.11:53
** server can't find localhost: NXDOMAIN
** server can't find localhost: NXDOMAIN
Some ideas?. Thanks again.
Did you check contents of
/etc/hosts?
yap!
etc/hosts have same permission issue (640)
@tab3rware
chmod 644 etc/hosts inside container and that should do it
Re: Docker nameserver resolution only as root
Posted: 01 Aug 2023, 04:08
by tommi2day
You cant do chmod 644 if you are not root within the container. I am also afraid it would be not sufficient because the files will be rewritten at any restart.
This is the first docker implementation i see with this behavior. All others are creating these files with 0644 permission
@TMSupport: Do you have already brought this issue to your developers? Is there no QA in place to detect such errors? Many companies does not allow to run docker containers as root anymore.
Re: Docker nameserver resolution only as root
Posted: 01 Aug 2023, 04:22
by Bipe
just change resolv.conf to hosts in my script from previous post and it will do the trick
it's not a permanent solution, that's why I've said create cron job
anyway, TM should either provide us with steps how to add users to acl or just leave everything 644
Re: Docker nameserver resolution only as root
Posted: 01 Aug 2023, 05:12
by Bipe
to make it simpler, here are few steps that will:
create fixPerms.sh script (find all etc/resolv.conf and etc/hosts files in docker containers and apply chmod 644)
make script executable
add script crontab and run every minute
Code: Select all
# Create script
cat <<EOF > fixPerms.sh
#!/bin/bash
DOCKER_VOLUME=$(df --output=target | grep -i docker)
find $DOCKER_VOLUME/containers -name resolv.conf -o -name hosts -exec chmod 644 {} \;
EOF
# Make script executable
chmod +x fixPerms.sh
# Add script to crontab
echo "* * * * * $(pwd)/fixPerms.sh" >> /var/spool/cron/crontabs/$(whoami)
this is a dirty fix, but it should
resolve our issues till there is a official fix
Re: Docker nameserver resolution only as root
Posted: 01 Aug 2023, 12:50
by davidecavestro
Great! In the meantime I've seen that recursively granting read rights with the default ACL solves the issue.
I did it on the whole /Volume1/DockerData... probably it could be limited to /Volume1/DockerData/containers even though it is not fine-grained as I would.
I don't write here the command since I have little experience with ACLs and I don't want to mess up other folks NAS. (ifor the fearless readers, t is the setfacl I wrote above).
Re: Docker nameserver resolution only as root
Posted: 16 Aug 2023, 23:53
by tab3rware
Thank you @Bipe and @davidecavestro for your usefull tips...
I will try them asap!
Re: Docker nameserver resolution only as root
Posted: 17 Aug 2023, 00:12
by tab3rware
Yes, the "hostname" resolution works flawlessly, but we must change the permissions for Volumes too...
But the @Bipe scripts, i have to make a little modification:
Code: Select all
#!/bin/bash
DOCKER_VOLUME=$(df --output=target | grep -i docker)
# This not work... i don't know why...
# find $DOCKER_VOLUME/containers -name resolv.conf -exec chmod 644 {} \;
# Fix: split in two sentences
find $DOCKER_VOLUME/containers -name resolv.conf -exec chmod 644 {} \;
find $DOCKER_VOLUME/containers -name hosts -exec chmod 644 {} \;
The Terramaster docker package is buggy, and I would not recommend it for novice users.
Re: Docker nameserver resolution only as root
Posted: 17 Aug 2023, 01:53
by Bipe
this will do:
Code: Select all
#!/bin/bash
DOCKER_VOLUME=$(df --output=target | grep -i docker)
find $DOCKER_VOLUME/containers \( -name resolv.conf -o -name hosts \) -exec chmod 644 {} \;
I've noticed that crontab is not persistent after reboot...
Re: Docker nameserver resolution only as root
Posted: 22 Aug 2023, 21:42
by TMzethar
Hi, We are troubleshooting DNS resolution issues for Docker containers. If possible, can you provide us with the detailed usage process? You can record and package the process in graphic form and send it to our support email support(at)terra-mater.com. This will help us better locate the problem.
Here's what we need to know:
1. What is the image name of the container you used when you found the problem?
2. What kind of usage scenarios and running purposes do you need the docker container to achieve?
3. How is your container configured?
4. Under what circumstances did you encounter DNS resolution problems?
5. What role do you think DNS resolution can play in the mirror application?
Sincerely thank you for your feedback.
Re: Docker nameserver resolution only as root
Posted: 24 Aug 2023, 03:14
by tommi2day
@ TMzethar
Maybe you (and all others from TM) have overseen in my initial post in this thread i made already a complete analyis of this problem.
You can take ANY Image to see this problem. If you running this image as root, its working fine, if you have to use another user, its in stuck
sample. This affects ANY Container with the working User not running as root (as it is recommanded for security reasons)
Code: Select all
docker run --rm -it ubuntu
root@7ae02c35fcbe:/# getent hosts www.google.de
2a00:1450:400c:c07::5e www.google.de
We are root, it works
Now create a "normal user", switch to this user and try again
Code: Select all
root@7ae02c35fcbe:/# useradd -m test
root@7ae02c35fcbe:/# su - test
$ id
uid=1000(test) gid=1000(test) groups=1000(test)
$ getent hosts www.google.de
No answer means not found. The reason is (as already explained), the resolv.conf and maybe more files in /Volume1/DockerData are not readable within the container for others
Code: Select all
root@7ae02c35fcbe:/# ls -l /etc/resolv.conf
-rw-r-----+ 1 root root 469 Aug 23 18:46 /etc/resolv.conf
with docker inspect <container> |grep Path you can find the real location of these system mountet files
Code: Select all
"ResolvConfPath": "/Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/resolv.conf",
"HostnamePath": "/Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/hostname",
"HostsPath": "/Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/hosts",
"LogPath": "/Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61-json.log",
> ls -laZ /Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/resolv.conf
-rwxrwx---+ 1 diskmaster diskmaster ? 86 Aug 23 21:01 /Volume1/DockerData/containers/2c8461f8bcc17da9b0cd15fa3b6f9bd7278d35a4e0805a61c397f8b805bc2d61/resolv.conf
You can compare the needed file system permission with other docker implementations. Here is a sample from a ubuntu vm, these files should be readable for "others"
Code: Select all
sudo ls -laZ /docker_sys/var/containers/07c3215f6b7fe4ed02b7644dab5ca10e6ced6dfd490f86508e9a30a39e1bf3ef/resolv.conf
-rw-r--r-- 1 root root ? 81 Aug 20 09:16 /docker_sys/var/containers/07c3215f6b7fe4ed02b7644dab5ca10e6ced6dfd490f86508e9a30a39e1bf3ef/resolv.conf
Pls fix the the permission settings and this problem will be solved