Join Log in
Score:0
itasahobby avatar Server

How to blacklist private dns resolution inside docker?

mm flag
itasahobby

Problem

I want to block DNS resolutions that return private range IP addresses. What I've found so far is that to do such thing you need to setup a cache/recursive DNS server. However since I want to use it inside docker that's where I stumble upon difficulties.

The simplest way I found is using dnsmasq (as explained in this other answer). On the other hand just needs to run a single process so found out about supervisord which solves that issue. Nevertheless, created a sample docker image and when I use the localhost dns server (dnsmasq) by adding the flag --dns 127.0.0.1 or replacing /etc/resolv.conf from within the container I get an error ** server can't find google.com: REFUSED , which just makes sense after the warning I get at the time of running the container :

WARNING: Localhost DNS setting (--dns=127.0.0.1) may fail in containers.

Environment

Sample docker image:

FROM ubuntu:latest

RUN apt update &&\
    apt upgrade -y

RUN apt install -y supervisor \
    dnsmasq \
    dnsutils \
    iputils-ping \
    nano

RUN echo "stop-dns-rebind" > /etc/dnsmasq.d/stop-rebinding

COPY supervisor.conf /etc/supervisor.conf

ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisor.conf"]

supervisor.conf:

[supervisord]
nodaemon=true
logfile=/dev/stdout
logfile_maxbytes=0

[program:dnsmasq]
command=dnsmasq --no-daemon
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0

Build:

sudo docker build . -t samplednsmasq

Run:

sudo docker run -it --dns 127.0.0.1 --rm samplednsmasq:latest

Is it doable?

I would like to know if there is any way of making it work (without using multi-container like docker-compose) and dnsmasq, I'm also open to other alternatives that doesn't involve a dns caching server.

Solution: Changed the supervisor.conf to:

[supervisord]
nodaemon=true
logfile=/dev/stdout
logfile_maxbytes=0

[program:dnsmasq]
command=dnsmasq --no-daemon --interface=lo --stop-dns-rebind
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0

Also updated the Dockerfile

FROM ubuntu:latest

RUN apt update &&\
    apt upgrade -y

RUN apt install -y supervisor \
    dnsmasq \
    dnsutils \
    iputils-ping \
    nano \
    net-tools

RUN echo "listen-address=127.0.0.1\nbind-interfaces\nstop-dns-rebind" > /etc/dnsmasq.d/stop-rebinding &&\
    echo "\nserver=8.8.8.8\nserver=8.8.4.4\nno-resolv" >> /etc/dnsmasq.conf

COPY supervisor.conf /etc/supervisor.conf

ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisor.conf"]
78
0 + 0
Score:1
avatar Server
jp flag
AlexD

server can't find google.com: REFUSED means that there is no DNS server listening on the specified address. By default dnsmasq won't listen on 127.0.0.1 address.

0 + 0
itasahobby avatar
mm flag
itasahobby
That could be a reason, however when I use `netstat` it shows that it's indeed listening (edited the post to include that info)
0
Reply
jp flag
AlexD
`0.0.0.0` is not the same as `127.0.0.1`.
0
Reply
itasahobby avatar
mm flag
itasahobby
Oh my bad, thought that using 0/0 would also include localhost, going to try forcing localhost thanks so far
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.