DNS resolution not working in a rootful systemd container without unshare-netns option.

[kerneis-anssi]

It looks a lot like #1075 except I’m not using --unshare-netns.

Steps to reproduce:

$ sudo mkdir /home/fedora
$ distrobox create --image quay.io/toolbx-images/fedora-toolbox:39 --init  --additional-packages "systemd"  --root --home /home/fedora --name fedora-tb
$ distrobox enter --root fedora-tb
[…]
📦[kerneis@fedora-tb kerneis]$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=116 time=2.33 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=116 time=2.78 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 2.332/2.554/2.777/0.222 ms
📦[kerneis@fedora-tb kerneis]$ ping www.google.com
ping: www.google.com: Temporary failure in name resolution
📦[kerneis@fedora-tb kerneis]$ 

Note that the exact same command-line with --unshare-netns (as found in #1075 (comment)) does work.

[89luca89]

Hi @kerneis-anssi thanks for the issue

I was not able to reproduce this issue

[kerneis-anssi]

I found the following in the container's log (journalctl -b0):

Feb 02 12:16:31 fedora-tb.fedora systemd-resolved[492]: LLMNR-IPv4(UDP): There appears to be another LLMNR responder running, or previously systemd-resolved crashed with some outstanding transfers.
Feb 02 12:16:31 fedora-tb.fedora systemd-resolved[492]: LLMNR-IPv4(TCP): There appears to be another LLMNR responder running, or previously systemd-resolved crashed with some outstanding transfers.
Feb 02 12:16:31 fedora-tb.fedora systemd-resolved[492]: LLMNR-IPv4(TCP): Failed to bind socket: Address already in use
Feb 02 12:16:31 fedora-tb.fedora systemd-resolved[492]: Another LLMNR responder prohibits binding the socket to the same port. Turning off LLMNR support.
Feb 02 12:16:31 fedora-tb.fedora systemd-resolved[492]: Another process is already listening on TCP socket 127.0.0.53:53.
Feb 02 12:16:31 fedora-tb.fedora systemd-resolved[492]: Turning off local DNS stub support.

The following made name resolution work again (from the container):

sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved

I have no clue why, I hope others will find this useful.

[89luca89]

Nice find, I'll transform this in a discussion for future reference for other people 👍