9

This question is probably addressed to all docker gurus. But let me give some background first. I faced dns resolution problems (on docker's default network "bridge") until i read the following in the documentation at https://docs.docker.com/engine/userguide/networking/

The docker network inspect command above shows all the connected containers and their network resources on a given network. Containers in this default network are able to communicate with each other using IP addresses. Docker does not support automatic service discovery on the default bridge network. If you want to communicate with container names in this default bridge network, you must connect the containers via the legacy docker run --link option.

As the --link option is deprecated, makes any docker run command hang and finally smashes the docker daemon process (locally) i tried using a different bridged user network and pinned dummy instances to it.

docker network create -d bridge --subnet=172.15.0.0/16
  --gateway=172.15.0.1 
  -o com.docker.network.bridge.default_bridge=false 
  -o com.docker.network.bridge.enable_icc=true 
  -o com.docker.network.bridge.enable_ip_masquerade=true 
  -o com.docker.network.driver.mtu=1500 
  -o com.docker.network.bridge.name=docker1 
  -o com.docker.network.bridge.host_binding_ipv4=0.0.0.0 a

docker run --name db1 -e MYSQL_ROOT_PASSWORD=a -d mysql:5.7.16
docker run --name db2 -e MYSQL_ROOT_PASSWORD=a -d mysql:5.7.16
docker network connect --ip 172.15.0.40 a db1
docker network connect --ip 172.15.0.40 a db2

Now the resolution of services/containers named via --name works fine using ping but here is the question:

Why is service/container name resolution not possible on the default bridge network?

Would be great if any docker network guru could give a hint. Regards.

1 Answer 1

22

Why is service/container name resolution not possible on the default bridge network?

There's no technical reason this would not be possible, but a decision to keep backward compatibility.

The default ("bridge") network never supported service discovery through a built in DNS, and when the feature was under development, maintainers of some projects raised concerns that they did not want this added on the default network, as it would block alternative implementations.

In addition, custom networks are designed to explicitly allow containers to communicate. On the default network, this is achieved by disabling "inter container communication" (--icc=false), and using --link to establish a link between containers. Having automatic discovery for any container connected to the default network would make this a lot more complicated to use.

So; create a custom network, and attach containers to that network if they should be able to communicate with each other.

Note that in many cases, not all of the options you specified are needed; simply running docker network create foo should work for most use cases.

5
  • Let's suppose that I want to enable the same features that I could have on a user network on the default one, what should I do? Which flags should I enable in the daemon to unlock this? I am asking it because trying with both --icc=true or --icc=false didn't change a thing. And also in combination with that flag in the daemon, using the relative docker run --network-alias=... flag, still brings an error that says it can be used with user networks only. Any clear documentation that I can read how to use this feature then? Thank you in advance! Aug 1, 2017 at 17:43
  • @JulianXhokaxhiu It's not possible with the default bridge network. Is there a specific reason you don't want to use a custom network? It's easy to use one (I can update, and add a basic example if you want)
    – thaJeztah
    Aug 3, 2017 at 16:01
  • I have nothing wrong against user networks, although my main issue at the moment is how to attach dockers that I don't spawn directly ( but indirectly ) through another service ( see drone.io and their agents ). This is my current script, but the git docker is not in the same network ( it will be spawned later ) and is not able to fetch the code from the gogs docker. See github.com/julianxhokaxhiu/vps-powered-by-docker/blob/master/… Aug 4, 2017 at 17:14
  • 1
    That's really a different question, and depends on how CI sets up networking. It looks like the agent allows you to specify a network for the containers it starts; github.com/cncd/pipeline/blob/master/pipeline/backend/docker/… github.com/cncd/pipeline/blob/master/pipeline/backend/docker/… However, from the docs; they setup containers to use share the same networking namespace readme.drone.io/usage/services-guide (Service containers share the same network as your build and plugin containers, and are therefore available at 127.0.0.1)
    – thaJeztah
    Aug 6, 2017 at 22:28
  • First of all thanks for the reply! Does that mean that the whole pipeline is running inside a custom network? But then, this custom network will anyway inherit the default one right? So this means that if we have a possibility to enable DNS resolution on the default bridge, it should work. Aug 19, 2017 at 19:52

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.