1

Imagine I have this setup:

  • An application server
    • Private IP: 1.0.0.1; Private hostname: machine1.internal.domain
    • Public IP : 2.0.0.1; Public hostname : machine1.example.com
  • A database server
    • Private IP: 1.0.0.2; Private hostname: machine2.internal.domain
    • Public IP : 2.0.0.2; Public hostname : machine2.example.com

These 2 machines are in a DMZ.

Machine1 needs to connect to machine2 using the internal hostname. One thing is important: we don't want any traffic between these two to go outside the DMZ. And hostname machine2.internal.domain is hardcoded in the application running on machine #1.

Without Dockerized setup:

  • Case#1: If name resolution works for machine2.internal.domain, everything is good already.
  • Case#2: Otherwise, I would add an entry in /etc/hosts in machine1: machine2.internal.domain 1.0.0.2

With Dockerized setup I know when name resolution doesn't work, Docker container cannot reach machine2 since it doesn't inherit entries in /etc/hosts of host machine.

How can I make this thing working the best way? ... for both cases: DNS resolving working and not working.

I have reviewed following options for case 2:

  • Passing the IP of machine2 to Docker container in machine1: docker run --add-host machine2.internal.domain:1.0.0.2 ...
    • I have to define IP of machine2.internal.domain twice: once in /etc/hosts and once in Docker run command
  • Not containarizing network for container in machine1: docker blabla --net=host
    • This doesn't feel right although I can't tell what the consequences would be.
0

If you have an internal DNS server you can run your docker app with the --dns=[] option.

Set your internal DNS server to be a forwarder to the real DNS when name lookup fails so that way any internal names will use the internal address.

Another option is to write a custom hosts file into your docker image which is OK if they are fixed, but not always ideal.

A third way is to consider using something like skydns. If your docker hosts are running CoreOS or if you have an etcd2 cluster that would work too.

By far the best option is to have your hosts work out through some discovery mechanism where things are and not rely on DNS. However, they usually will require something like etcd2 or consul.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.