Page 1 of 3
Docker nameserver resolution only as root
Posted: 03 Jul 2023, 02:35
by tommi2day
I noticed internal container name server resolution is only working if the container runs as root(id 0). Its complete independend from image, its always the same. As a non root user you cant neither resolve internal container names within docker network as not using global nor dedicated nameserver handover via --dns option.
sample:
grafana | logger=grafana.update.checker t=2023-07-02T17:29:33.63417048+02:00 level=error msg="Update check failed" error="failed to get latest.json repo from github.com: Get \"
https://raw.githubusercontent.com/grafa ... atest.json\": dial tcp: lookup raw.githubusercontent.com on [::1]:53: dial udp [::1]:53: connect: cannot assign requested address" duration=2.938707ms
after reading a lot pages it seems terramaster has an acl active which prohibits non root users to read resolv.conf. Is this intentional or an bug?
> docker inspect grafana
....
"Image": "sha256:f08ad401a4d5c0fa1eee19a42ad7a73bf01f809d414f0cbdf08a5599fb549e4e",
"ResolvConfPath": "/Volume1/DockerData/containers/03ad5c10c8c9ec7c59f8de69c3bfb690cad99335720d999b0f58cb47c05e2436/resolv.conf",
"HostnamePath": "/Volume1/DockerData/containers/03ad5c10c8c9ec7c59f8de69c3bfb690cad99335720d999b0f58cb47c05e2436/hostname",
>getfacl /Volume1/DockerData/containers/03ad5c10c8c9ec7c59f8de69c3bfb690cad99335720d999b0f58cb47c05e2436/resolv.conf
getfacl: Removing leading '/' from absolute path names
# file: Volume1/DockerData/containers/03ad5c10c8c9ec7c59f8de69c3bfb690cad99335720d999b0f58cb47c05e2436/resolv.conf
# owner: diskmaster
# group: diskmaster
user::---
user:diskmaster:rwx #effective:r--
user:tmbackup:r-x #effective:r--
user:docker:--x #effective:---
group::--x #effective:---
group:diskmaster:--x #effective:---
group:admin:rwx #effective:r--
group:media:rwx #effective:r--
mask::r--
other::---
Re: Docker nameserver resolution only as root
Posted: 26 Jul 2023, 02:14
by topo01
Hi
could this issue be related to my problem here:
viewtopic.php?f=43&t=4947
It too seams to be a problem with inter-container communication throwing an error about ...failure in name resolution...
Re: Docker nameserver resolution only as root
Posted: 27 Jul 2023, 03:01
by tommi2day
you can verify this if you try to run your container as root or use a ip instead of of container name in your db connection. As idea expose the db container ports to your nas, then you can use the ip of your nas with the exposed port as db connection to have a fixed NAS IP instead of dynamic container ips.
Re: Docker nameserver resolution only as root
Posted: 27 Jul 2023, 03:07
by tommi2day
Maybe now after 3 weeks would be a good time to get an official answer from terramaster support
Re: Docker nameserver resolution only as root
Posted: 28 Jul 2023, 03:11
by topo01
Thanks! Will try to explore along those lines.
Re: Docker nameserver resolution only as root
Posted: 30 Jul 2023, 04:51
by tab3rware
Hi, similar problem here.
Mi scenario:
- TOS: 5.1.40
- Docker: 1.1.99
I have installed "portainer", but i have tried from shell too. I try to create an Nextcloud instance, with "Nextcloud AIO", and i'm stuck in:
Code: Select all
Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request
Reason: DNS lookup failure for: localhost
In this case, it's not working with root user even. The problem is with the Docker internal DNS server, it can't resolve any domain or host. I tried with my computer, without problems. I raised an issue to "Nextcloud AIO" team, but it's clearly an error in terramaster docker package.
I check the docker networks, and the gateways, an all seems to be ok...
Please help!
Re: Docker nameserver resolution only as root
Posted: 31 Jul 2023, 19:31
by Bipe
I've made a script that will change permissions of all container resolv.conf files to 644, as they should be.
This will fix DNS resolving when running containers with users that are not root (eg. arr apps)
I have tried playing with group / user permissions via TOS GUI, but in the end the simplest solution was to create cron job that will simple find script
Code: Select all
#!/bin/bash
DOCKER_VOLUME=$(df --output=target | grep -i docker)
find $DOCKER_VOLUME/containers -name resolv.conf -exec chmod 644 {} \;
Re: Docker nameserver resolution only as root
Posted: 31 Jul 2023, 23:21
by tab3rware
Bipe wrote: ↑31 Jul 2023, 19:31
I've made a script that will change permissions of all container resolv.conf files to 644, as they should be.
This will fix DNS resolving when running containers with users that are not root (eg. arr apps)
I have tried playing with group / user permissions via TOS GUI, but in the end the simplest solution was to create cron job that will simple find script
Code: Select all
#!/bin/bash
DOCKER_VOLUME=$(df --output=target | grep -i docker)
find $DOCKER_VOLUME/containers -name resolv.conf -exec chmod 644 {} \;
Thank you!!!... i works, but still i have a very strange problem, if i try to resolve "localhost" inside a container it's return an error:
Code: Select all
mastercontainer:/var/www/docker-aio# nslookup localhost
Server: 127.0.0.11
Address: 127.0.0.11:53
** server can't find localhost: NXDOMAIN
** server can't find localhost: NXDOMAIN
Some ideas?. Thanks again.
Re: Docker nameserver resolution only as root
Posted: 01 Aug 2023, 00:23
by davidecavestro
tab3rware wrote: ↑31 Jul 2023, 23:21
Thank you!!!... i works, but still i have a very strange problem, if i try to resolve "localhost" inside a container it's return an error:
Code: Select all
mastercontainer:/var/www/docker-aio# nslookup localhost
Server: 127.0.0.11
Address: 127.0.0.11:53
** server can't find localhost: NXDOMAIN
** server can't find localhost: NXDOMAIN
Some ideas?. Thanks again.
Did you check contents of
/etc/hosts?
Re: Docker nameserver resolution only as root
Posted: 01 Aug 2023, 03:43
by davidecavestro
what about issuing this command?
setfacl -R -d -m o::r /Volume1/DockerData
After nearly 1 month without any advice from support I must try...
boar assault 