Internal network DNS fails to resolve about moby HOT 9 CLOSED

I can verify that the test I wrote in the issue above is fixed with the latest release of docker 26.1. Thanks for the comments, I forgot to loop back around and check this out!

from moby.

I think this may be related to a security fix that fixed internal-only networks being able to access external DNS servers; GHSA-mq39-4gv4-mvpx

In this case, "external" would be the dns service, which is part of the same network, but the internal resolver likely won't take that into account; @robmry any thoughts?

from moby.

Oh! Looks like a PR was opened that looks related;

• #47821

from moby.

Ah, yes! Thank you for re-opening this as a moby issue.

As @thaJeztah says, it's fallout from the security fix that went too far. The new PR should sort things out.

from moby.

While I absolutely see the point if this fix, how are we supposed to work around this issue? I'd use --dns ..., but do I have to use it in every container? Or can I just recreate the network in a manner, that would allow this behavior?
I know I shouldn't do it for security reasons, but it's a homelab and I don't feel like extending every single docker-compose file to contain the DNS entry. Besides: I run Traefik and pihole within the same internal network, but also use pihole with the host IP at port 53.

What's the correct solution and is there a way to restore the previous behavior?

from moby.

@divStar did you try with docker 26.1.3? A fix was merged and included in that version; #47832

from moby.

Thanks for confirming!

from moby.

Thank you! It seems to work for just about any container I use - except Jellyfin, but I suppose it's because of Traefik seeing two networks (I use a regular bridge network and a macvlan) and assigning weird IP addresses. The external access seems fixed though, at least from what I understand.

from moby.

@divStar Without more details it's hard to pinpoint what's going wrong in your environment. You could try to ask on our community Slack, on our forum, or in the Discussions tab here on GH.

If your container is connected to multiple networks, it might be due to bad network precedence during DNS resolution or something along this line. If you're currently using an unqualified container name (eg. foobar), you could try to use a qualified name instead (eg. foobar.<network_name>).

from moby.