Local DNSSEC resolver & Containers

[P J P]

Hello,


  -> https://lists.fedoraproject.org/pipermail/cloud/2015-January/004867.html


As per the previous discussion above, I was able to use iptables(8) DNAT rule to divert
DNS traffic from Docker containers to a DNSSEC resolver on the host at 127.0.0.1:53.


Please see:

  ->
https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver#Docker_...

One needs to enable local 'lo' routing via 'docker0' bridge and add the
DNAT rule to divert DNS requests to the local resolver. Above configuration is working
good on F22 with Docker version 1.6.0, build 9d26a07/1.6.0.


I'd like to hear if you have any comments/suggestions/inputs about the same. Because
when the local DNSSEC feature goes live(F23), it would be required to add such
configuration on the host, so that the container applications could take full advantage of
the DNSSEC resolver. 


IMO, Docker daemon is best suited to make the required configuration changes on the host.
Because one, it already adds few iptables(8) rules on the host. And second, it checks
host's name-server settings in '/etc/resolv.conf' and copies the
non-localhost(127.0.0.1) servers to the container. When localhost(127.0.0.1) is the only
name-server on the host, it defaults to using Google public DNS servers inside containers.
It should be fairly straight forward for the Docker daemon to enable local 'lo'
routing and add the DNAT rule upon detecting '127.0.0.1' as name-server on the
host.


Your comments/suggestions/inputs are most welcome.


Thank you.

---
Regards
   -P J P
http://feedmug.com