on
Container bind mount pitfalls: DNS
It's not DNS. There's no way it's DNS. It was DNS.
Story time? Story time.
I had this very old deployment of Clojure app around, orchestrating quite many Docker containers and their data volumes. It was set up to connect to a PostgreSQL database and Redis running on the container host, implying no magical DNS solutions nor any convenience at all (manual /24 subnet configuration and firewalling). 1
It also bound whole /var/run into the container to access Docker API socket (it’s still sitting at /var/run/docker.sock at the time of writing).
@@ -16,9 +16,9 @@
#include <arpa/inet.h>
#include <netdb.h>
-main(int argc, char **argv) {
- struct hostent *lh = gethostbyname(argv[1]);
- printf("res: %s\n", (lh ? inet_ntoa(*((struct in_addr*) lh->h_addr_list[0])) : "(failed)"));
+main(int argc, char **argv) {
+ struct hostent *lh = gethostbyname(argv[1]);
+ printf("res: %s\n", (lh ? inet_ntoa(*((struct in_addr*) lh->h_addr_list[0])) : "(failed)"));
}
…and the one-liner copypasteable version:
echo -e '#include<stdio.h>\n#include<arpa/inet.h>\n#include<netdb.h>\nmain(int argc,char **argv){struct hostent *lh=gethostbyname(argv[1]); printf("res: %s\\n",(lh?inet_ntoa(*((struct in_addr*)lh->h_addr_list[0])):"(failed)"));}' | gcc -x c - -o /dns
Compiled and ran it on Ubuntu container, I saw this: 2
stat("/etc/resolv.conf", {st_mode=S_IFREG|0444, st_size=36, ...}) = 0
@@ -57,4 +57,4 @@
/var/lib/zentria into the container.Option 2: mount tmpfs over /var/run/nscd
That’s rather a temporary solution.
Option 3: mount /var/run somewhere else, like /host/var/run
That’ll work too, but you’ll also very likely expose unwanted files into the container. Less access the better it is.
You should consider picking Option 1 instead.
Option 4: access Docker API over TCP+TLS
That’s the most secure way, as this allows more fine grained control. Besides PKI based auth, you are able
to set up an authorization plugin to apply limits to the API - making Docker API access less equal to root access on host ;)
TL;DR
Linux DNS is not broken. Do not mount /var/run into container’s /var/run blindly - especially if you have nscd running on host.