Q: A containerized microservice makes HTTP calls to `api.example.com`. It works perfectly when tested locally on a developer laptop, but fails with DNS resolution errors when deployed inside a Docker container on the CI server. The CI server itself can resolve the domain fine. What is wrong?
Docker containers on user-defined networks use Docker's embedded DNS server (127.0.0.11). On the default bridge network, containers inher...
#Docker #Must enable BuildKit #L2 #Containers #Linux #systemd
🎙️ Candidate Opening & Architectural Context
""Container stability relies on clean signal handling (SIGTERM vs SIGKILL) and immutable image tagging. The interviewer is testing: Container DNS resolution, Docker's embedded DNS server.. I structure my answer around systematic triage first, root cause analysis second, and permanent remediation third.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Initial Diagnostics & Root Cause Analysis
Docker containers on user-defined networks use Docker's embedded DNS server (127.0.0.11). On the default bridge network, containers inherit the host's /etc/resolv.conf. However, if the host uses 127.0.0.53 (systemd-resolved's stub resolver), Docker copies this into the container where it's meaningless because the container cannot reach the host's loopback address.
- Per container:
docker run --dns 8.8.8.8 myapp - Globally in
/etc/docker/daemon.json:{"dns": ["8.8.8.8", "8.8.4.4"]} - Or switch the CI server's systemd-resolved to expose on a real interface rather than the loopback stub.
2️⃣
Remediation & Permanent Safeguards
*Fix:* Explicitly configure DNS for the container or Docker daemon:
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: Per container: docker run --dns 8.8.8.8 myapp."
⚡ 60-Second Elevator Pitch Talking Points
- Per container: docker run --dns 8.8.8.8 myapp
- Globally in /etc/docker/daemon.json: {"dns": ["8.8.8.8", "8.8.4.4"]}
- Or switch the CI server's systemd-resolved to expose on a real interface rather than the loopback...
Advertisement