{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/14627","labels_url":"https://api.github.com/repos/docker/docker/issues/14627/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/14627/comments","events_url":"https://api.github.com/repos/docker/docker/issues/14627/events","html_url":"https://github.com/docker/docker/issues/14627","id":94967061,"number":14627,"title":"Enable Docker  to connect with the local resolver on the host 127.0.0.1:53","user":{"login":"pjps","id":855804,"avatar_url":"https://avatars.githubusercontent.com/u/855804?v=3","gravatar_id":"","url":"https://api.github.com/users/pjps","html_url":"https://github.com/pjps","followers_url":"https://api.github.com/users/pjps/followers","following_url":"https://api.github.com/users/pjps/following{/other_user}","gists_url":"https://api.github.com/users/pjps/gists{/gist_id}","starred_url":"https://api.github.com/users/pjps/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pjps/subscriptions","organizations_url":"https://api.github.com/users/pjps/orgs","repos_url":"https://api.github.com/users/pjps/repos","events_url":"https://api.github.com/users/pjps/events{/privacy}","received_events_url":"https://api.github.com/users/pjps/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/kind/enhancement","name":"kind/enhancement","color":"E8CAAF"},{"url":"https://api.github.com/repos/docker/docker/labels/system/networking","name":"system/networking","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-07-14T15:02:41Z","updated_at":"2015-07-20T18:27:36Z","closed_at":null,"body":"When localhost(127.0.0.1) is the only entry in the host's '/etc/resolv.conf' file, Docker defaults to using Google public DNS servers inside containers. It is not the best solution for various reasons, ex. it can not resolve internal domain names.\r\n\r\n* https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver\r\n\r\nWith Fedora introducing default local(127.0.0.1:53) DNSSEC resolver on the host, it would the best option for container applications to take full advantage of the same. Currently, there is no way for the Docker containers to talk to the local resolver on the host. :-1: \r\n\r\nTo enable Docker containers to communicate with the local(127.0.0.1:53) resolver on the host, one would need to make following configuration changes on the host.\r\n\r\n* Enable local **lo** routing via **docker0** bridge interface. (it is **off** by default)\r\n    ```# sysctl -w net.ipv4.conf.docker0.route_localnet=1```\r\n\r\n* Enable local resolver to accept requests from **172.17.0.0/16** docker sub-network.\r\n    ```unbound(8): # vi /etc/unbound/unbound.conf -> access-control: 172.17.0.0/16 allow```\r\n    ```ndjbdns(8): # touch /etc/ndjbdns/ip/172.17```\r\n\r\n* Use iptables(8) destination nat(**DNAT**)  to divert DNS traffic from **docker0** to **lo** interface.\r\n    ```# iptables -t nat -I PREROUTING -p UDP -s 172.17.0.0/16 --dport 53 -i docker0 -j DNAT --to-destination 127.0.0.1:53```\r\n\r\nDocker daemon is best placed to make above changes on the host. It'll greatly help if the Docker daemon could conditionally make above configurations when the host lists only **127.0.0.1** as its name server.\r\n\r\nCould the Docker daemon be updated to make above changes please?\r\n\r\nThank you."},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/122976688","html_url":"https://github.com/docker/docker/issues/14627#issuecomment-122976688","issue_url":"https://api.github.com/repos/docker/docker/issues/14627","id":122976688,"user":{"login":"mrjana","id":1693482,"avatar_url":"https://avatars.githubusercontent.com/u/1693482?v=3","gravatar_id":"","url":"https://api.github.com/users/mrjana","html_url":"https://github.com/mrjana","followers_url":"https://api.github.com/users/mrjana/followers","following_url":"https://api.github.com/users/mrjana/following{/other_user}","gists_url":"https://api.github.com/users/mrjana/gists{/gist_id}","starred_url":"https://api.github.com/users/mrjana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrjana/subscriptions","organizations_url":"https://api.github.com/users/mrjana/orgs","repos_url":"https://api.github.com/users/mrjana/repos","events_url":"https://api.github.com/users/mrjana/events{/privacy}","received_events_url":"https://api.github.com/users/mrjana/received_events","type":"User","site_admin":false},"created_at":"2015-07-20T18:27:36Z","updated_at":"2015-07-20T18:27:36Z","body":"@rhatdan It is definitely a bit more work than just setting ip some iptable rules and setting some kernel networking knobs. But it doesn't have to be a lot more work and we can start with something simple which just gets the job done initially (before adding any bells and whistles interms of apis and options) and all of them can be contained within the libnetwork code base. "}}