Buildkit: Support custom DNS from dockerd config

[hetsch]

Hi,
i think that I stumbled upon a problem with buildkit and using our internal DNS server. Building the image without buildkit works fine, but if I use $ DOCKER_BUILDKIT=1 docker build ... it seems that i can't reach the Alpine Linux repositories. My question would be if buildkit is using the DNS server specified in /etc/docker/daemon.json or if this is not implemented right now. Thanks a bunch for your help!

Docker version 18.09.0, build 4d60db4

Daemon.json

$ cat /etc/docker/daemon.json
{
"dns": [
    "x.x.x.x", 
    "8.8.8.8"
],
"experimental": true
}

Console output:

[+] Building 12.5s (12/35)                                                                                                                                                                           
=> [internal] load build definition from Dockerfile                                                                                                                                            0.0s
=> => transferring dockerfile: 39B                                                                                                                                                             0.0s
=> [internal] load .dockerignore                                                                                                                                                               0.1s
=> => transferring context: 2B                                                                                                                                                                 0.0s
=> [internal] load metadata for docker.io/library/python:3.7-slim-stretch                                                                                                                      0.0s
=> [internal] load metadata for docker.io/library/alpine:3.8                                                                                                                                   0.0s
=> CACHED [internal] helper image for file operations                                                                                                                                          0.0s
=> [internal] load build context                                                                                                                                                               0.0s
=> => transferring context: 1.10kB                                                                                                                                                             0.0s
=> CACHED [alpine-runtime 1/2] FROM docker.io/library/alpine:3.8                                                                                                                               0.0s
=> [debian-runtime 1/2] FROM docker.io/library/python:3.7-slim-stretch                                                                                                                         0.0s
=> CACHED [debian-runtime 2/2] RUN set -ex  && cp /usr/share/zoneinfo/Europe/Vienna /etc/localtime  && echo Europe/Vienna > /etc/timezone  && mkdir -p /srv/archives /srv/wheels /srv/binarie  0.0s
=> CANCELED [base-production 1/1] RUN set -ex  && buildDeps=    curl     gnupg  && deps=    binutils     gosu     postgresql-client-11  && apt-get update && apt-get install -yq --no-instal  12.3s
=> ERROR [alpine-runtime 2/2] RUN apk --update --no-cache add     bash     tzdata  && cp /usr/share/zoneinfo/Europe/Vienna /etc/localtime && echo Europe/Vienna > /etc/timezone  && apk del   12.0s
=> CANCELED [debian-build 1/1] RUN set -ex  && apt-get update && apt-get install -yq --no-install-recommends     build-essential     libtool     libtool-bin     automake     autoconf     p  12.3s
------
> [alpine-runtime 2/2] RUN apk --update --no-cache add     bash     tzdata  && cp /usr/share/zoneinfo/Europe/Vienna /etc/localtime && echo Europe/Vienna > /etc/timezone  && apk del tzdata:
#27 1.691 fetch http://dl-cdn.alpinelinux.org/alpine/v3.8/main/x86_64/APKINDEX.tar.gz
#27 6.695 fetch http://dl-cdn.alpinelinux.org/alpine/v3.8/community/x86_64/APKINDEX.tar.gz
#27 6.695 WARNING: Ignoring http://dl-cdn.alpinelinux.org/alpine/v3.8/main/x86_64/APKINDEX.tar.gz: temporary error (try again later)
#27 11.70 WARNING: Ignoring http://dl-cdn.alpinelinux.org/alpine/v3.8/community/x86_64/APKINDEX.tar.gz: temporary error (try again later)
#27 11.70 ERROR: unsatisfiable constraints:
#27 11.70   bash (missing):
#27 11.70     required by: world[bash]
#27 11.70   tzdata (missing):
#27 11.70     required by: world[tzdata]

[tonistiigi]

@hetsch The custom dns overrides from dockerd config are not supported on the current release. We should pick up nameservers from the host config though.

[hetsch]

@tonistiigi Thanks for your answer. Forgot to mention that I'm on Ubuntu 18.04. On my system, it seems that buildkit it does not pick up the host config during build time.

• I completly removed the dns key from daemon.json
• It seems that the containers receive the valid DNS server during runtime

resolv.conf:

docker run --rm flungo/netutils cat /etc/resolv.conf
Unable to find image 'flungo/netutils:latest' locally
latest: Pulling from flungo/netutils
ff3a5c916c92: Already exists 
0d42de35d407: Pull complete 
Digest: sha256:cf2a22cf9edee0640bae64fc33b8916fef524cc7f454e0279d91509cc1aecd60
Status: Downloaded newer image for flungo/netutils:latest
# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 1.2.3.4

Dig google.com:

docker run --rm flungo/netutils dig google.com
; <<>> DiG 9.11.2-P1 <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44572
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 9

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.            IN  A

;; ANSWER SECTION:
google.com.     261 IN  A   216.58.201.110

;; AUTHORITY SECTION:
google.com.     15653   IN  NS  ns3.google.com.
google.com.     15653   IN  NS  ns2.google.com.
google.com.     15653   IN  NS  ns1.google.com.
google.com.     15653   IN  NS  ns4.google.com.

;; ADDITIONAL SECTION:
ns1.google.com.     18087   IN  A   216.239.32.10
ns2.google.com.     16459   IN  A   216.239.34.10
ns3.google.com.     39822   IN  A   216.239.36.10
ns4.google.com.     26735   IN  A   216.239.38.10
ns1.google.com.     94924   IN  AAAA    2001:4860:4802:32::a
ns2.google.com.     76405   IN  AAAA    2001:4860:4802:34::a
ns3.google.com.     166683  IN  AAAA    2001:4860:4802:36::a
ns4.google.com.     145904  IN  AAAA    2001:4860:4802:38::a

;; Query time: 2 msec
;; SERVER: 1.2.3.4#53(1.2.3.4)
;; WHEN: Fri Nov 23 08:05:20 UTC 2018
;; MSG SIZE  rcvd: 303

As said above, building works with standard Docker build engine, but not Buildkit. Might it have something to do that Ubuntu 18.04 switched from dnsmasq to systemd-resolved? See for example:

• https://github.com/docker/libnetwork/issues/1654
• https://github.com/moby/moby/issues/23910

[vsviridov]

My company does DNS filtering, and having google defaults totally does not work. I've tried overriding /etc/resolv.conf to no avail...

[hakanurhan]

For me https://github.com/moby/buildkit/issues/757 was the solution on Ubuntu 18.04.

In summary: sym. linking /run/systemd/resolve/resolv.conf to /etc resolved my build problem with buildkit.

[bentolor]

I'm running into the same situation: Corporate environment with no access to the default 8.8.8.8 and BuildKit does not respect the custom DNS settings.

I'm on Linux Mint and /etc/resolv.conf is already there, but redirecting to a DNS proxy:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.1.1

Manually adding an additional line nameserver 1.2.3.4 helped to temporarily workaround this issue for me.

[Billy-]

I'm also experiencing this issue in a corporate environment. I have put my custom nameservers into the /etc/resolv.conf and also tried the ln workaround from above but neither has worked. Are there any other workarounds, and, is there any estimate of when the option to customise the DNS will be available?

[tiborvass]

I'm closing as this should now work with Docker 19.03 (as well as with a buildkitd config)