F21 System Wide Change: Default Local DNS Resolver

Andrew Lutomirski luto at mit.edu
Tue Apr 29 16:29:00 UTC 2014

On Tue, Apr 29, 2014 at 8:18 AM, Chuck Anderson <cra at wpi.edu> wrote:
> On Tue, Apr 29, 2014 at 05:15:57PM +0200, Alexander Larsson wrote:
>> On tis, 2014-04-29 at 14:15 +0200, Jaroslav Reznik wrote:
>> > = Proposed System Wide Change:  Default Local DNS Resolver =
>> > https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver
>> >
>> > Change owner(s): P J P <pjp at fedoraproject.org>, Pavel Šimerda
>> > <pavlix at pavlix.net>,         Tomas Hozza <thozza at redhat.com>
>> >
>> > To install a local DNS resolver trusted for the DNSSEC validation running on
>> > This must be the only name server entry in /etc/resolv.conf.
>> This is gonna conflict a bit with docker, and other  users of network
>> namespaces, like systemd-nspawn. When docker runs, it picks up the
>> current /etc/resolv.conf and puts it in the container, but the container
>> itself runs in a network namespace, so it gets its own loopback device.
>> This will mean points to the container itself, not the
>> host, so dns resolving in the container will not work.
>> Not sure how to fix something like that though...
> Is it possible to use a different loopback device like and
> then have that point outside the container somehow?

I like this solution, although I think it'll require making unbound
bind to for the non-container case, too.

OTOH, it would be straightforward to write a tiny stub that forwards to something outside the container.


More information about the devel mailing list