In docker-compose, what is the effect/purpose of `dns-search: .`

user_1090611 0
Viewed 783

I am looking at the stackstorm docker-compose file, and within it almost all containers have a line dns_search: . According to docker-compose documentation, dns_search is for the purpose of configuring search domains.

I am used to seeing this in context of transparently adding a domain to unqualified short domains. For example if I add dns_search: mydomain.com, I would expect "host1" to transparently resolve as "host1.mydomain.com".

I have never seen this set as a single dot . before. What is the effect/purpose of doing this configuration?

docker-compose
3 Answers

I believe this is because all domain names end in . under the hood, but browsers and other software abstracts this out.

For example. under the hood www.google.com is actually www.google.com.

So, in the docker-compose file, this would essentially be saying "Find me any domain"

A bit more detail on why there's an extra dot, if you're interested:

Domain name resolution is heirachical, reading right to left, with each block, separated by a ., being a step in the process. A DNS resolver will first find a source of ., which will be able to return the address for a resolver for the next block, until it reaches the final block, where it returns the full DNS record.

user_167657160

I'm posting the answer from the Stackstorm Git project issue see comment/"dns_search: .". Paraphrasing: it was useful in old versions of Docker before 2017, before the ndots configuration was available. Nowadays that configuration has no impact, and in fact has been removed from the stackstorm docker-compose file.

user_10906110

Extending EdwardTeach's answer:

@ytjohn effectively said they did in the past because putting dns_search: . configures the DNS search domains to be only . instead of inheriting the host ones. I can't confirm that because I didn't test it.

Now, I tested what docker-compose does today, and in a container, cat /etc/resolve.conf returns:

nameserver 127.0.0.11
options ndots:0

Where options ndots:0 is (from resolv.conf docs):

ndots:n Sets a threshold for the number of dots which must appear in a name given to res_query(3) (see resolver(3)) before an initial absolute query will be made. The default for n is 1, meaning that if there are any dots in a name, the name will be tried first as an absolute name before any search list elements are appended to it. The value for this option is silently capped to 15.

With ndots:0, all domains will be attempted using the absolute name first, only then using the search list.

How I came to this conclusion

The Github comment:

If you don't set this dns_search: ., then whatever the host has in search in their /etc/resolv.conf will get put into your container's /etc/resolv.conf.

This doesn't happen. My host has search domain[0]: broadband (macOS command: scutil --dns), and in docker containers, it doesn't show broadband (linux command: cat /etc/resolv.conf). Instead, it says options ndots:0

  • dns_search docs:

dns defines custom DNS search domains to set on container network interface configuration. Can be a single value or a list.

  • What is a DNS search domain?

It is the DNS service used to resolve hostnames that are not fully qualified, e.g. hostname will try hostname.example.com then hostname.website.com if your search domains list was example.com, website.com. More information on https://superuser.com/a/184366

  • In another repo (crossdock), their dockerfile had the comment:
`dns_search: .  # Ensures unified DNS config.`
user_73658660
Related