Browse code

Add information on resolv.conf localhost filtering to networking.md

This patch adds detail on how the host's `/etc/resolv.conf` file is
filtered when creating the copy for the container.

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)

Phil Estes authored on 2015/03/08 12:13:56
Showing 1 changed files
... ...
@@ -183,10 +183,27 @@ Four different options affect container domain name services.
183 183
     only look up `host` but also `host.example.com`.
184 184
     Use `--dns-search=.` if you don't wish to set the search domain.
185 185
 
186
-Note that Docker, in the absence of either of the last two options
187
-above, will make `/etc/resolv.conf` inside of each container look like
188
-the `/etc/resolv.conf` of the host machine where the `docker` daemon is
189
-running.  You might wonder what happens when the host machine's
186
+Regarding DNS settings, in the absence of either the `--dns=IP_ADDRESS...`
187
+or the `--dns-search=DOMAIN...` option, Docker makes each container's
188
+`/etc/resolv.conf` look like the `/etc/resolv.conf` of the host machine (where
189
+the `docker` daemon runs).  When creating the container's `/etc/resolv.conf`,
190
+the daemon filters out all localhost IP address `nameserver` entries from
191
+the host's original file.
192
+
193
+Filtering is necessary because all localhost addresses on the host are
194
+unreachable from the container's network.  After this filtering, if there 
195
+are no more `nameserver` entries left in the container's `/etc/resolv.conf`
196
+file, the daemon adds public Google DNS nameservers
197
+(8.8.8.8 and 8.8.4.4) to the container's DNS configuration.  If IPv6 is
198
+enabled on the daemon, the public IPv6 Google DNS nameservers will also
199
+be added (2001:4860:4860::8888 and 2001:4860:4860::8844).
200
+
201
+> **Note**:
202
+> If you need access to a host's localhost resolver, you must modify your
203
+> DNS service on the host to listen on a non-localhost address that is
204
+> reachable from within the container.
205
+
206
+You might wonder what happens when the host machine's
190 207
 `/etc/resolv.conf` file changes.  The `docker` daemon has a file change
191 208
 notifier active which will watch for changes to the host DNS configuration.
192 209