[R2.20-Build 17]: host DNS config is getting changed after container creation

Bug #1455168 reported by alok kumar
14
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Juniper Openstack
Status tracked in Trunk
R2.20
Fix Committed
Critical
Ignatious Johnson Christopher
Trunk
Fix Committed
Critical
Ignatious Johnson Christopher
nova-docker
Fix Committed
Undecided
Ignatious Johnson Christopher

Bug Description

In docker hypervisor setup when we launch the container, it just uses the /etc/resolv.conf from host on the container and host DNS confiuration is getting changed after that.

NS config on compute node just after fresh provisioning:

root@nodec59:~# cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 10.204.216.51
nameserver 172.29.147.60
nameserver 10.209.194.133
search englab.juniper.net juniper.net

after launching docker1 in subnet 1.1.1.0/24(through horizon) :

root@nodec59:/opt/contrail/utils# cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 1.1.1.2
nameserver 10.204.216.51
nameserver 172.29.147.60
search englab.juniper.net juniper.net

after this, DNS resolution fails on the host.
NS config on docker1(which is same as host config before instance creation):

ubuntu@instance-00000001:/$ cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 10.204.216.51
nameserver 172.29.147.60
nameserver 10.209.194.133
search englab.juniper.net juniper.net

after launching instance in subnet 2.2.2.0/24:

root@nodec59:/opt/contrail/utils# cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 1.1.1.2
nameserver 2.2.2.2
nameserver 10.204.216.51
search englab.juniper.net juniper.net

each time a new instance is created from a new subnet, resolv.conf on host is getting overwritten with entry of DNS server of the subnet.

As per docker documentation:
"Regarding DNS settings, in the absence of either the --dns=IP_ADDRESS... or the --dns-search=DOMAIN... option, Docker makes each container's /etc/resolv.conf look like the /etc/resolv.conf of the host machine (where the docker daemon runs). When creating the container's /etc/resolv.conf, the daemon filters out all localhost IP address nameserver entries from the host's original file.

https://docs.docker.com/articles/networking/#dns

Tags: docker
information type: Proprietary → Public
Changed in nova-docker:
assignee: nobody → Ignatious Johnson Christopher (ijohnson-x)
Changed in nova-docker:
status: New → In Progress
tags: added: releasenote
Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : A change has been merged

Reviewed: https://review.opencontrail.org/10731
Committed: http://github.org/Juniper/contrail-packaging/commit/22ac9793701d0844dea10bbcffdd3eabe4a2f821
Submitter: Zuul
Branch: R2.20

commit 22ac9793701d0844dea10bbcffdd3eabe4a2f821
Author: Ignatious Johnson Christopher <email address hidden>
Date: Fri May 22 16:33:26 2015 -0700

Removing veth interfaces if the contrainer launch failed
Closes-Bug: 1452151
Closes-Bug: 1454976

Using inet6 argument with ip command to configure ipv6 address to container
Closes-Bug: 1455616

Configure network using statically instead of using dhclient to avoid
it writting to the compute hosts resolv.conf
Closes-Bug: 1455168

Periodically check the vrouter agent conncetion and publish the port informaton to
the vrouter agent.
Closes-Bug: 1454655

Change-Id: I3f59055da0748df2a8dddfd82cf2eb062377dfab

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote :

Reviewed: https://review.opencontrail.org/10730
Committed: http://github.org/Juniper/contrail-packaging/commit/70bbb08f57773280a40c6f1565f853918c0bb120
Submitter: Zuul
Branch: master

commit 70bbb08f57773280a40c6f1565f853918c0bb120
Author: Ignatious Johnson Christopher <email address hidden>
Date: Fri May 22 16:09:24 2015 -0700

Removing veth interfaces if the contrainer launch failed
Closes-Bug: 1452151
Closes-Bug: 1454976

Using inet6 argument with ip command to configure ipv6 address to container
Closes-Bug: 1455616

Configure network using statically instead of using dhclient to avoid
it writting to the compute hosts resolv.conf
Closes-Bug: 1455168

Periodically check the vrouter agent conncetion and publish the port informaton to
the vrouter agent.
Closes-Bug: 1454655

Change-Id: I79360edd27ca59743f5ee6afee928f77c6a31435

Revision history for this message
Ignatious Johnson Christopher (ijohnson-x) wrote : Re: [R2.20-Build 17]: DNS configuration in docker container is wrong and host DNS config is getting changed too

Reviewed: https://review.opencontrail.org/10730
Committed: http://github.org/Juniper/contrail-packaging/commit/70bbb08f57773280a40c6f1565f853918c0bb120
Submitter: Zuul
Branch: master

commit 70bbb08f57773280a40c6f1565f853918c0bb120
Author: Ignatious Johnson Christopher <email address hidden>
Date: Fri May 22 16:09:24 2015 -0700

Removing veth interfaces if the contrainer launch failed
Closes-Bug: 1452151
Closes-Bug: 1454976

Using inet6 argument with ip command to configure ipv6 address to container
Closes-Bug: 1455616

Configure network using statically instead of using dhclient to avoid
it writting to the compute hosts resolv.conf
Closes-Bug: 1455168

Periodically check the vrouter agent conncetion and publish the port informaton to
the vrouter agent.
Closes-Bug: 1454655

Change-Id: I79360edd27ca59743f5ee6afee928f77c6a31435

Revision history for this message
Ignatious Johnson Christopher (ijohnson-x) wrote :

Reviewed: https://review.opencontrail.org/10731
Committed: http://github.org/Juniper/contrail-packaging/commit/22ac9793701d0844dea10bbcffdd3eabe4a2f821
Submitter: Zuul
Branch: R2.20

commit 22ac9793701d0844dea10bbcffdd3eabe4a2f821
Author: Ignatious Johnson Christopher <email address hidden>
Date: Fri May 22 16:33:26 2015 -0700

Removing veth interfaces if the contrainer launch failed
Closes-Bug: 1452151
Closes-Bug: 1454976

Using inet6 argument with ip command to configure ipv6 address to container
Closes-Bug: 1455616

Configure network using statically instead of using dhclient to avoid
it writting to the compute hosts resolv.conf
Closes-Bug: 1455168

Periodically check the vrouter agent conncetion and publish the port informaton to
the vrouter agent.
Closes-Bug: 1454655

Change-Id: I3f59055da0748df2a8dddfd82cf2eb062377dfab

Changed in nova-docker:
status: In Progress → Fix Committed
status: Fix Committed → In Progress
alok kumar (kalok)
tags: removed: releasenote
summary: - [R2.20-Build 17]: DNS configuration in docker container is wrong and
- host DNS config is getting changed too
+ [R2.20-Build 17]: host DNS config is getting changed after container
+ creation
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova-docker (master)

Reviewed: https://review.openstack.org/177972
Committed: https://git.openstack.org/cgit/stackforge/nova-docker/commit/?id=12b11b31b6f4274efa88f3011d2e4b884ed0e30c
Submitter: Jenkins
Branch: master

commit 12b11b31b6f4274efa88f3011d2e4b884ed0e30c
Author: Ignatious Johnson Christopher <email address hidden>
Date: Mon Apr 27 14:12:12 2015 -0700

    During opencontrail attach vifs the containers use dhclient to lease an ip address.
    When bulk container create request is sent, the /var/lib/dhcp/dhclient.leases file is overwritten.
    Due to the corrupted file Successive docker containers are not getting IP lease
    as the dhclient command is failling .

    Fixing it by creating separate lease files for each docker container.
    Closes-Bug: #1446929

    Removing veth interfaces if the contrainer launch failed
    Closes-Bug: #1452151

    Using inet6 argument with ip command to configure ipv6 address to container
    Closes-Bug: #1455616

    Configure network using statically instead of using dhclient to avoid
    it writting to the compute hosts resolv.conf
    Closes-Bug: #1455168

    Periodically check the vrouter agent conncetion and publish the port informaton to
    the vrouter agent.
    Closes-Bug: #1454655

    Change-Id: I345dddefa3036b29a2ee987216e1094ba9bd23e8

Changed in nova-docker:
status: In Progress → Fix Committed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.