Supervisor: Make CoreDNS optional

[agners]

Home Assistant release with the issue:
0.97.2

Operating environment (HassOS/Generic):
Generic

Supervisor logs:

Description of problem:
CoreDNS broke DNS resolution with several devices. Even after setting my OpenWrt router as upstream DNS, the system seems not to be able to resolve internal addresses correctly. On the host system which uses the router as only DNS resolver all internal hosts resolve just fine.

Since DNS is such a integral part of the network I'd rather prefer to have full control over it. CoreDNS should be made optional, especially since it seems to create issues in some setups.

[aferraz]

After this update my supervisor can't start. Running on Cento 7 VM with docker 19.03.1:
[hassio.docker] Can't start hassio_dns: 500 Server Error: Internal Server Error ("OCI runtime create failed: sysctl "kernel.domainname" is not in a separate kernel namespace: unknown")

[startrk1995]

Agreed. I have spent all day restoring and trying to get this to run. What is the benefits of CoreDNS and it is worth the headache? It also looks like 8.8.8.8 and 1.1.1.1 is hardcoded. Are we going to get more options?

[SiliconAvatar]

This is a good example of why HassIO needs an Architecture discussions repository as much as Home Assistant does.

How does such a large breaking change get pushed through in a simple PR without someone noticing that this has the potential to break so so much in one's system. And the privacy concerns of hard coding a google DNS into it is pretty disconcerting.

[kolossboss]

Why not also „make auto update Supervisor optional“.
Its so annoying...

[frenck]

CoreDNS is a replacement for the DNS pipe we already provided since the beginning.
Just wonder why it all of a sudden CoreDNS should be optional...? That makes no sense and sounds like a reaction that misses a lot of fundamental misunderstandings.

CoreDNS has been put into place to solve a lot of general issues, if, however, the new setup gives issues: We are sorry, but we going to look into them and see how we can improve. (<- That is something that is now actually possible).

Let me be clear on the subject, without an internal resolver (previously done with hosts files, now using a proper DNS server), Hass.io cannot and would have never worked. Making it optional, is simply not an option.

[mihalski]

It also seems to break API based esphome devices.
All of mine are just jumping from one ip to the next and I have no idea how it's getting them. For example this device is on 192.168.1.171 and here are the logs I get after I connect to it via wifi:

INFO Reading configuration...
INFO Starting log output from family_room_lamp_sonoff.onosendai.xyz using esphome API
INFO Connecting to family_room_lamp_sonoff.onosendai.xyz:6053 (52.216.8.210)
WARNING Initial connection failed. The ESP might not be connected to WiFi yet (Error connecting to 52.216.8.210: timed out). Re-Trying in 1 seconds
INFO Connecting to family_room_lamp_sonoff.onosendai.xyz:6053 (52.216.238.250)
WARNING Initial connection failed. The ESP might not be connected to WiFi yet (Error connecting to 52.216.238.250: timed out). Re-Trying in 2 seconds
INFO Connecting to family_room_lamp_sonoff.onosendai.xyz:6053 (52.216.227.2)
WARNING Initial connection failed. The ESP might not be connected to WiFi yet (Error connecting to 52.216.227.2: timed out). Re-Trying in 4 seconds
INFO Connecting to family_room_lamp_sonoff.onosendai.xyz:6053 (52.216.95.130)
WARNING Initial connection failed. The ESP might not be connected to WiFi yet (Error connecting to 52.216.95.130: timed out). Re-Trying in 8 seconds

[Sergey-SRG]

@frenck add config coredns!

[frenck]

@Sergey-SRG No, that is not its function. If you want to run a DNS server, you can do that yourself. The CoreDNS main function is for handling internals of Hass.io and not meant to fool around with.

[Sergey-SRG]

@frenck But what about the corefile? I just need coredns to access my dnsserver and not google!

[frenck]

@Sergey-SRG I've identified a bug that is causing the coredns configuration not to update and we are working on it.

[Sergey-SRG]

After this innovation, all local names (.lan) do not work(((
Or you need to enter ip in the configuration?
Addon esphome not work((

[jariha]

Android Debug Bridge does not work after update to CoreDNS:
unable to connect to 192.168.2.54:5555: No route to host

[frenck]

@Sergey-SRG Again: We have identified a bug, we are working on it.

[frenck]

@jariha That is a connection to an IP address and therefore not related to this all in any way.

[jariha]

@frenck Ok Thanks.

[kolossboss]

@jariha
you issue sound more like mine, but its also related to supervisor update 174

https://github.com/home-assistant/hassio/issues/1230

[LukasQ]

Please allow me a comment: As we tend to keep an eye on data privacy, could we try to avoid Google DNS? Let the users configure it, or at least hardcode OpenDNS or use DNSsec.

[frenck]

@LukasQ Agreed, on supervisor 180 Google has been replaced by Quad9.

[LukasQ]

as @frenck already wrote in an other thread, the discussion is held way to heated.
Just a small FYI: 180 resolved the issue only partially. Internal lookups still don't work.

• addressing other add-ons in configuration.yaml with 127.0.0.1 works
• adressing with hostname.lan doesn't.

on hassio CLI

nslookup hostname.lan

uses the correct internal DNS and returns the correct IP

[frenck]

@LukasQ Please see https://github.com/home-assistant/hassio/issues/1231#issuecomment-522312855

Most issues are addressed now. About the original question of this issue, my response in https://github.com/home-assistant/hassio/issues/1232#issuecomment-522218356 is still valid.

Hass.io cannot work without it, CoreDNS is a replacement of the feature we previously had.
We can, therefore, not make it optional.

[aferraz]

@frenck sorry, what about this errore:
[hassio.docker] Can't start hassio_dns: 500 Server Error: Internal Server Error ("OCI runtime create failed: sysctl "kernel.domainname" is not in a separate kernel namespace: unknown")

I'm running hassio docker on Centos 7 VM and from last 2 years I had no problems.

From last supervisor update I have this message, also with 180 and 181 version.
I can't star HA anymore

Regards
Alessandro

[agners]

CoreDNS is a replacement for the DNS pipe we already provided since the beginning.
Just wonder why it all of a sudden CoreDNS should be optional...? That makes no sense and sounds like a reaction that misses a lot of fundamental misunderstandings.

You are right, this request is based on a misunderstanding: I was under the impression that HassIO tries to replace my home networks DNS server. After all, that is how CoreDNS is configured by default: It ignores the local DHCP provided DNS and acts as DNS resolver with forwarders to upstream DNS servers.

CoreDNS has been put into place to solve a lot of general issues, if, however, the new setup gives issues: We are sorry, but we going to look into them and see how we can improve. (<- That is something that is now actually possible).

Let me be clear on the subject, without an internal resolver (previously done with hosts files, now using a proper DNS server), Hass.io cannot and would have never worked. Making it optional, is simply not an option.

So if CoreDNS is an internal only DNS server, then its of course fine, and it should be considered non-optional infrastructure for HassIO.

However, that it bluntly ignores the local DNS is a architectural bug IMHO. It should always rely on the local DNS, and not even fallback to a public DNS by default.

[beavis9k]

However, that it bluntly ignores the local DNS is a architectural bug IMHO. It should always rely on the local DNS, and not even fallback to a public DNS by default.

I absolutely agree. I noticed even after running hassio dns options --servers dns://xxx.xxx.xxx.xxx and restarting, 1.1.1.1 9.9.9.9 are still present in corefile. This is something I DON'T want.

[richard-scott]

Or at least give us a way to configure it to forward requests to use local DNS servers.

[pvizeli]

@richard-scott if you setup hass.io correct with NetworkManager backend, they will be. Otherwise, you did not run Hass.io like it should be and need self to maintain and set configs over cmd.

[beavis9k]

@pvizeli I followed the hass.io instructions at https://github.com/home-assistant/hassio-installer and I'm using NetworkManager - and I was still bitten by this. And I still have 1.1.1.1 and 9.9.9.9 as secondary and tertiary DNS servers and no clear way to remove them.

[Diaoul]

That's not good for privacy at all. HomeAssistant forwarding DNS queries to CloudFlare and Quad9.
Frontpage says:

Open source home automation that puts local control and privacy first.

Please change this behavior or make it so it's possible to opt-out.

Culprit: Coredns config with https://github.com/home-assistant/hassio/blob/master/hassio/const.py#L35