Local DNSSEC resolver & Containers

pjp at fedoraproject.org pjp at fedoraproject.org
Tue Aug 25 06:11:54 UTC 2015


Hello Colin, all


> On Monday, 24 August 2015 8:34 PM, Colin Walters <walters at verbum.org> wrote:
> One problem with this is you're capturing *all* traffic to port 53,
> but I can imagine valid use cases for skipping the local resolver.
> We're already seen one with the hotspot detection.


  Yes, true. We realised that, but it's only a PoC for diverting container
DNS traffic to the local resolver on the host. We could tweak the DNAT rule
to divert specific DNS traffic, like say requests addressed to docker0(172.17.42.1)
bridge interface, provided 'resolv.conf' inside Docker container holds '172.17.42.1'
as the name server, instead of the Google public DNS servers.


> Another more complex problem is that while your solution will work for the
> docker defaults, it's quite common to use something other than the defaults
> for clustered networking for e.g. Kubernetes.


  I see. I'm still experimenting with it, so not quite sure how different parts
fit together and work together.


About unbound(8) supporting Unix domain sockets,

  see -> https://github.com/docker/docker/issues/14627#issuecomment-122968821


The upstream 'docker/libnetwork' folks have proposed a similar solution of
having a DNS proxy service on the host which will route DNS traffic between
Docker containers and the host resolver.
---
Regards
   -P J P
http://feedmug.com 


More information about the cloud mailing list