This patch adds detail on how the host's `/etc/resolv.conf` file is
filtered when creating the copy for the container.
Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)
| ... | ... |
@@ -183,10 +183,27 @@ Four different options affect container domain name services. |
| 183 | 183 |
only look up `host` but also `host.example.com`. |
| 184 | 184 |
Use `--dns-search=.` if you don't wish to set the search domain. |
| 185 | 185 |
|
| 186 |
-Note that Docker, in the absence of either of the last two options |
|
| 187 |
-above, will make `/etc/resolv.conf` inside of each container look like |
|
| 188 |
-the `/etc/resolv.conf` of the host machine where the `docker` daemon is |
|
| 189 |
-running. You might wonder what happens when the host machine's |
|
| 186 |
+Regarding DNS settings, in the absence of either the `--dns=IP_ADDRESS...` |
|
| 187 |
+or the `--dns-search=DOMAIN...` option, Docker makes each container's |
|
| 188 |
+`/etc/resolv.conf` look like the `/etc/resolv.conf` of the host machine (where |
|
| 189 |
+the `docker` daemon runs). When creating the container's `/etc/resolv.conf`, |
|
| 190 |
+the daemon filters out all localhost IP address `nameserver` entries from |
|
| 191 |
+the host's original file. |
|
| 192 |
+ |
|
| 193 |
+Filtering is necessary because all localhost addresses on the host are |
|
| 194 |
+unreachable from the container's network. After this filtering, if there |
|
| 195 |
+are no more `nameserver` entries left in the container's `/etc/resolv.conf` |
|
| 196 |
+file, the daemon adds public Google DNS nameservers |
|
| 197 |
+(8.8.8.8 and 8.8.4.4) to the container's DNS configuration. If IPv6 is |
|
| 198 |
+enabled on the daemon, the public IPv6 Google DNS nameservers will also |
|
| 199 |
+be added (2001:4860:4860::8888 and 2001:4860:4860::8844). |
|
| 200 |
+ |
|
| 201 |
+> **Note**: |
|
| 202 |
+> If you need access to a host's localhost resolver, you must modify your |
|
| 203 |
+> DNS service on the host to listen on a non-localhost address that is |
|
| 204 |
+> reachable from within the container. |
|
| 205 |
+ |
|
| 206 |
+You might wonder what happens when the host machine's |
|
| 190 | 207 |
`/etc/resolv.conf` file changes. The `docker` daemon has a file change |
| 191 | 208 |
notifier active which will watch for changes to the host DNS configuration. |
| 192 | 209 |
|