mirror of
https://github.com/mageddo/dns-proxy-server.git
synced 2026-04-25 17:35:54 +03:00
[GH-ISSUE #429] random IPv6 of some other container is returned if proper IPv6 does not exist #152
Labels
No labels
bug
confirmed
discussion
duplicate
enhancement
feature
feature-request
not-planned
pull-request
secondary-feature
stale
triage
waiting-feedback
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/dns-proxy-server-mageddo#152
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @pschiffe on GitHub (Dec 16, 2023).
Original GitHub issue: https://github.com/mageddo/dns-proxy-server/issues/429
What is Happening / What is expected
It's visible in the log:
findBestNetworkchosephpmyadminnetwork, butplausibleis not connected to this network:plausibledoesn't have IPv6 enabled (plausible doesn't support dual-stack):Specs
3.15.13-snapshot@mageddo commented on GitHub (Apr 23, 2024):
Hey @pschiffe , I can see behavior that might be not wanted but different of what your reported.
Looks like DPS didn't use phpmyadmin network but answered the hostmachine IPV6 IP, the thing is, like you said, none of "plausible" container connected networks has support for IPV6, so maybe it doesn't makes sense to answer the hostmachine IP.
I will have to think in the use cases related to use hostmachine IP to check if this behavior can be considered was wanted or not, maybe it can be a togglable feature.
@pschiffe commented on GitHub (Apr 24, 2024):
I see, thanks for taking a look. You are right, the phpmyadmin has IP
fddb:21e4:36d4:1::2, and the host hasfddb:21e4:36d4:1::1(which is returned by the dns proxy).Returning the host IP in this case is useful only if the ports of the container are exposed to the host I think. Otherwise it's just a wrong answer. I think the correct behavior (at least that I would expect) is to return nothing, so the client can try for A record. Some clients on IPv6 enabled systems go for AAAA record first, and try for A only if AAAA is missing.
@mageddo commented on GitHub (May 2, 2024):
I've mapped returning the host IP in this case useful when:
-- updated --
@mageddo commented on GitHub (May 2, 2024):
@pschiffe please let me know if that solution can fix your unexpected behavior scenario
@pschiffe commented on GitHub (May 2, 2024):
this may not be good enough - for example, you expose one port for the web server, but not the other one for metrics, which you will gather only via
container.dockername.I have it like that in my setup, where grafana agent is running on the host and doing autodiscovery of container metrics via docker labels. As it's on the host, it's using dns proxy to resolve the IP of the containers.
It's true that most of the containers don't have ports exposed to the host, but there are ones like traefik proxy, and internal tools which have. Also for this to be a problem, these containers must have IPv6 missing, but there is still sw where dual stack is a problem.
Anyway, in general, I like the automagic feature, but it probably would be a good idea to be able to enforce the behavior with feature toggle as well :)
BTW, thanks for the great job!
@mageddo commented on GitHub (May 2, 2024):
Thanks for the feedback. I will work on the feature toggle then.
@mageddo commented on GitHub (May 8, 2024):
Hey @pschiffe
3.17.0-snapshotis being released, I would appreciate if you could check it out.@pschiffe commented on GitHub (May 8, 2024):
Very nice, seems to work great! Before:
With
MG_DOCKER_SOLVER_HOST_MACHINE_FALLBACK_ACTIVE: 'false':