`127.0.0.11` fails to resolve

[schnittchen]

• This is a bug report
• This is a feature request
• I searched existing issues before opening this one

Expected behavior

repo.hex.pm can be resolved inside a container

Actual behavior

Container /etc/resolv.conf/ has 127.0.0.11 configured as nameserver. Logs:

DEBU[2018-08-08T11:35:12.703301702+02:00] Name To resolve: repo.hex.pm.                
DEBU[2018-08-08T11:35:12.703586195+02:00] [resolver] query repo.hex.pm. (A) from 172.18.0.4:41996, forwarding to udp:192.168.0.1 
DEBU[2018-08-08T11:35:12.713382116+02:00] [resolver] read from DNS server failed, read udp 172.18.0.4:41996->192.168.0.1:53: read: connection refused 

The 127.0.0.1 can be pinged both from inside the container and from the host.

From the host:

 ~ ✓ host repo.hex.pm 127.0.0.11
;; connection timed out; no servers could be reached
 ~ ✘ host repo.hex.pm 
repo.hex.pm is an alias for dualstack.f2.shared.global.fastly.net.
dualstack.f2.shared.global.fastly.net has address 151.101.114.2
dualstack.f2.shared.global.fastly.net has IPv6 address 2a04:4e42:1b::514

Output of docker version:

Client:
 Version:      17.11.0-ce
 API version:  1.34
 Go version:   go1.8.3
 Git commit:   1caf76c
 Built:        Mon Nov 20 18:32:34 2017
 OS/Arch:      linux/amd64

Server:
 Version:      17.11.0-ce
 API version:  1.34 (minimum version 1.12)
 Go version:   go1.8.5
 Git commit:   1caf76c
 Built:        Mon Nov 20 18:39:28 2017
 OS/Arch:      linux/amd64
 Experimental: false

Output of docker info:

Containers: 3
 Running: 3
 Paused: 0
 Stopped: 0
Images: 177
Server Version: 17.11.0-ce
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 992280e8e265f491f7a624ab82f3e238be086e49
runc version: 0351df1c5a66838d0c392b4ac4cf9450de844e2d
init version: 949e6fa
Security Options:
 seccomp
  Profile: default
Kernel Version: 4.14.56-1-lts
Operating System: Arch Linux
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 15.43GiB
Name: basil
ID: 435S:M62O:6TGC:OLOV:EUEA:5P45:HCMH:GIGE:NW3O:R7SJ:ZU3N:M3LN
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

[schnittchen]

It's the proxy DNS on my modem.

[thaJeztah]

This is the error;

192.168.0.1:53: read: connection refused 

The embedded DNS (accessible through 127.0.0.11 inside the container networking namespace) only handles service discovery/resolution; any other DNS lookup is forwarded to the DNS that's configured on the host (or set through the --dns option either on docker run, or configured on the dockerd daemon)

In this case, that DNS is 192.168.0.1, and it's refusing connections from the container; likely due to it being in a different IP range.

Does it work if you configure a different (external) DNS for the container? For example;

docker run -it --dns=8.8.8.8 alpine ping repo.hex.pm

[schnittchen]

Thanks @thaJeztah. What seems to work well to diagnose is to change the host dns to 1.1.1.1 temporarily and see if that helps.