Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Go to file
Sebastiaan van Stijn a5324d6950
Better selection of DNS server
Commit e353e7e3f0 updated selection of the
`resolv.conf` file to use in situations where systemd-resolvd is used as
a resolver.

If a host uses `systemd-resolvd`, the system's `/etc/resolv.conf` file is
updated to set `127.0.0.53` as DNS, which is the local IP address for
systemd-resolvd. The DNS servers that are configured by the user will now
be stored in `/run/systemd/resolve/resolv.conf`, and systemd-resolvd acts
as a forwarding DNS for those.

Originally, Docker copied the DNS servers as configured in `/etc/resolv.conf`
as default DNS servers in containers, which failed to work if systemd-resolvd
is used (as `127.0.0.53` is not available inside the container's networking
namespace). To resolve this, e353e7e3f0 instead
detected if systemd-resolvd is in use, and in that case copied the "upstream"
DNS servers from the `/run/systemd/resolve/resolv.conf` configuration.

While this worked for most situations, it had some downsides, among which:

- we're skipping systemd-resolvd altogether, which means that we cannot take
  advantage of addition functionality provided by it (such as per-interface
  DNS servers)
- when updating DNS servers in the system's configuration, those changes were
  not reflected in the container configuration, which could be problematic in
  "developer" scenarios, when switching between networks.

This patch changes the way we select which resolv.conf to use as template
for the container's resolv.conf;

- in situations where a custom network is attached to the container, and the
  embedded DNS is available, we use `/etc/resolv.conf` unconditionally. If
  systemd-resolvd is used, the embedded DNS forwards external DNS lookups to
  systemd-resolvd, which in turn is responsible for forwarding requests to
  the external DNS servers configured by the user.
- if the container is running in "host mode" networking, we also use the
  DNS server that's configured in `/etc/resolv.conf`. In this situation, no
  embedded DNS server is available, but the container runs in the host's
  networking namespace, and can use the same DNS servers as the host (which
  could be systemd-resolvd or DNSMasq
- if the container uses the default (bridge) network, no embedded DNS is
  available, and the container has its own networking namespace. In this
  situation we check if systemd-resolvd is used, in which case we skip
  systemd-resolvd, and configure the upstream DNS servers as DNS for the
  container. This situation is the same as is used currently, which means
  that dynamically switching DNS servers won't be supported for these
  containers.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-25 18:20:56 +02:00
.github Remove refs to jhowardmsft from .go code 2019-09-25 10:51:18 -07:00
api swagger: reformat, and wrap to ~80-chars 2020-05-02 18:10:28 +02:00
builder builder-next: fix layer access bug 2020-05-12 20:24:07 -07:00
cli remove uses of deprecated pkg/term 2020-04-21 16:29:27 +02:00
client Replace errors.Cause() with errors.Is() / errors.As() 2020-04-29 00:28:41 +02:00
cmd/dockerd Merge pull request #40930 from thaJeztah/bump_cobra 2020-05-14 21:28:51 +02:00
container Merge pull request #40856 from cpuguy83/reduce_allocs_on_env_repalce 2020-05-12 15:19:10 -07:00
contrib Merge pull request #40914 from cristianrz/40912-fix-curl-options 2020-05-19 12:10:25 -07:00
daemon Better selection of DNS server 2020-05-25 18:20:56 +02:00
distribution Move schema1 deprecation notice 2020-03-12 11:17:20 -07:00
dockerversion Use -X ldflags to set dockerversion package vars 2019-12-02 10:21:41 -08:00
docs cgroup2: implement `docker info` 2020-04-17 07:20:01 +09:00
errdefs bump gotest.tools v3.0.1 for compatibility with Go 1.14 2020-02-11 00:06:42 +01:00
hack Merge pull request #40892 from thaJeztah/cleanup_containerd_installer 2020-05-19 12:21:58 -07:00
image bump gotest.tools v3.0.1 for compatibility with Go 1.14 2020-02-11 00:06:42 +01:00
integration Using test names instead of hardcoded ones in integration/image directory 2020-05-18 16:37:09 +01:00
integration-cli Fix filter on expose and publish 2020-05-15 11:12:03 +02:00
internal/test/suite integration-cli: move each test suite to its own TestX testing function 2019-09-18 18:26:36 +00:00
layer Remove "could not get checksum with tar-split" debug message 2020-03-06 12:45:15 +01:00
libcontainerd cgroup2: implement `docker stats` 2020-04-02 17:51:34 +09:00
oci Move DefaultCapabilities() to caps package 2019-11-14 21:13:16 +02:00
opts enforce reserve internal labels. 2020-02-12 12:03:35 +08:00
patches Remove blurb about fixed in go1.11 in patch file 2020-04-24 11:23:14 -07:00
pkg pkg/archive: escape ":" symbol in overlay lowerdir 2020-05-12 13:28:04 +09:00
plugin Merge pull request #40867 from BurtonQin/double-lock 2020-05-15 18:07:39 +02:00
profiles Merge pull request #40731 from sqreen/fix/seccomp-profile 2020-05-20 00:31:32 +09:00
project LCOW: add "no_lcow" build tag to allow disabling lcow 2020-04-02 19:54:16 +02:00
reference fix goimports 2020-02-11 22:16:54 +09:00
registry registry: fix mtls config dir passing 2020-05-14 12:02:09 -07:00
reports Fix typos 2018-05-16 09:15:43 +08:00
restartmanager unconvert: remove unnescessary conversions 2019-09-18 12:57:33 +02:00
rootless rootless: support `--exec-opt native.cgroupdriver=systemd` 2020-02-14 15:32:31 +09:00
runconfig cgroup2: implement `docker info` 2020-04-17 07:20:01 +09:00
testutil Merge pull request #40595 from sfzhu93/GL_2_25 2020-05-08 16:00:52 +02:00
vendor Merge pull request #40908 from thaJeztah/bump_runtime_spec 2020-05-14 22:20:47 -07:00
volume SELinux: fix ENOTSUP errors not being detected when relabeling 2020-05-10 17:06:44 +02:00
.DEREK.yml Update .DEREK.yml 2019-05-06 13:27:04 -07:00
.dockerignore update .dockerignore to prevent '-unsupported' builds 2020-01-13 12:55:15 +01:00
.gitignore Use -X ldflags to set dockerversion package vars 2019-12-02 10:21:41 -08:00
.mailmap Update mailmap and authors 2019-09-30 19:12:18 +02:00
AUTHORS Update mailmap and authors 2019-09-30 19:12:18 +02:00
CHANGELOG.md Fix some typos 2018-09-07 13:13:47 +08:00
CONTRIBUTING.md Update CONTRIBUTING.md to have an option to keep name anonymous if requested 2019-07-15 16:04:11 +02:00
Dockerfile Bump Golang 1.13.11 2020-05-17 22:57:18 +02:00
Dockerfile.buildx Bump Golang 1.13.11 2020-05-17 22:57:18 +02:00
Dockerfile.e2e Bump Golang 1.13.11 2020-05-17 22:57:18 +02:00
Dockerfile.simple Bump Golang 1.13.11 2020-05-17 22:57:18 +02:00
Dockerfile.windows Bump Golang 1.13.11 2020-05-17 22:57:18 +02:00
Jenkinsfile Jenkinsfile: remove redundant DOCKER_EXPERIMENTAL 2020-04-07 00:59:15 +09:00
LICENSE Update LICENSE 2018-09-12 14:27:53 +01:00
MAINTAINERS Add myself as a curator 2020-01-09 15:03:38 -05:00
Makefile Makefile: remove empty targets, and slight refactor 2020-05-01 16:48:07 +02:00
NOTICE switch kr/pty to creack/pty v1.1.7 2019-07-29 16:59:08 -07:00
README.md Add "Lego set" back in README.md 2017-10-10 14:10:39 +00:00
ROADMAP.md Fix some typos in ROADMAP.md 2019-01-25 14:27:13 +08:00
SECURITY.md Update SECURITY.md to have an option to keep name anonymous if requested. 2019-06-18 16:37:16 +00:00
TESTING.md Bump golang 1.12.8 (CVE-2019-9512, CVE-2019-9514) 2019-08-14 02:27:05 +02:00
VENDORING.md fix the bare url and the Summary of http://semver.org 2017-01-17 16:20:11 +08:00
codecov.yml Add code coverage report and codecov config 2018-01-16 16:50:56 -05:00
poule.yml Poule: remove random assign 2019-09-05 20:57:17 +02:00
vendor.conf Merge pull request #40908 from thaJeztah/bump_runtime_spec 2020-05-14 22:20:47 -07:00

README.md

The Moby Project

Moby Project logo

Moby is an open-source project created by Docker to enable and accelerate software containerization.

It provides a "Lego set" of toolkit components, the framework for assembling them into custom container-based systems, and a place for all container enthusiasts and professionals to experiment and exchange ideas. Components include container build tools, a container registry, orchestration tools, a runtime and more, and these can be used as building blocks in conjunction with other tools and projects.

Principles

Moby is an open project guided by strong principles, aiming to be modular, flexible and without too strong an opinion on user experience. It is open to the community to help set its direction.

  • Modular: the project includes lots of components that have well-defined functions and APIs that work together.
  • Batteries included but swappable: Moby includes enough components to build fully featured container system, but its modular architecture ensures that most of the components can be swapped by different implementations.
  • Usable security: Moby provides secure defaults without compromising usability.
  • Developer focused: The APIs are intended to be functional and useful to build powerful tools. They are not necessarily intended as end user tools but as components aimed at developers. Documentation and UX is aimed at developers not end users.

Audience

The Moby Project is intended for engineers, integrators and enthusiasts looking to modify, hack, fix, experiment, invent and build systems based on containers. It is not for people looking for a commercially supported system, but for people who want to work and learn with open source code.

Relationship with Docker

The components and tools in the Moby Project are initially the open source components that Docker and the community have built for the Docker Project. New projects can be added if they fit with the community goals. Docker is committed to using Moby as the upstream for the Docker Product. However, other projects are also encouraged to use Moby as an upstream, and to reuse the components in diverse ways, and all these uses will be treated in the same way. External maintainers and contributors are welcomed.

The Moby project is not intended as a location for support or feature requests for Docker products, but as a place for contributors to work on open source code, fix bugs, and make the code more useful. The releases are supported by the maintainers, community and users, on a best efforts basis only, and are not intended for customers who want enterprise or commercial support; Docker EE is the appropriate product for these use cases.


Legal

Brought to you courtesy of our legal counsel. For more context, please see the NOTICE document in this repo.

Use and transfer of Moby may be subject to certain restrictions by the United States and other governments.

It is your responsibility to ensure that your use and/or transfer does not violate applicable laws.

For more information, please see https://www.bis.doc.gov

Licensing

Moby is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.