not listening on any interfaces

Bug #1955680 reported by Timothy Garay
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu Docker Images
Fix Released
Medium
Athos Ribeiro

Bug Description

Running latest image:

root@intelnuc8a:/mnt/data/bind9# docker images --no-trunc --quiet ubuntu/bind9:latest
sha256:330c010c5341a35276f62cb3c659289fbd393c96b0535285d9a9b8652ff0a8d7

Running on Docker on Ubuntu 20.04

Logs always show these entries and DNS is not listening on port 53:

23-Dec-2021 17:21:01.638 listening on IPv4 interface lo, 127.0.0.1#53
23-Dec-2021 17:21:01.638 creating IPv4 interface lo failed; interface ignored
23-Dec-2021 17:21:01.638 listening on IPv4 interface eth0, 172.17.0.25#53
23-Dec-2021 17:21:01.638 creating IPv4 interface eth0 failed; interface ignored
23-Dec-2021 17:21:01.638 not listening on any interfaces

Otherwise container is running.

Full logs:

Starting named...
exec /usr/sbin/named -g ""
23-Dec-2021 17:21:01.630 starting BIND 9.16.15-Ubuntu (Stable Release) <id:4469e3e>
23-Dec-2021 17:21:01.630 running on Linux x86_64 5.4.0-90-generic #101-Ubuntu SMP Fri Oct 15 20:00:55 UTC 2021
23-Dec-2021 17:21:01.630 built with '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=/usr/include' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-option-checking' '--disable-silent-rules' '--libdir=/usr/lib/x86_64-linux-gnu' '--runstatedir=/run' '--disable-maintainer-mode' '--disable-dependency-tracking' '--libdir=/usr/lib/x86_64-linux-gnu' '--sysconfdir=/etc/bind' '--with-python=python3' '--localstatedir=/' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-gost=no' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-libidn2' '--with-json-c' '--with-lmdb=/usr' '--with-gnu-ld' '--with-maxminddb' '--with-atf=no' '--enable-ipv6' '--enable-rrl' '--enable-filter-aaaa' '--disable-native-pkcs11' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -ffile-prefix-map=/build/bind9-ZzfSc7/bind9-9.16.15=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -fno-strict-aliasing -fno-delete-null-pointer-checks -DNO_VERSION_DATE -DDIG_SIGCHASE' 'LDFLAGS=-Wl,-Bsymbolic-functions -flto=auto -Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2'
23-Dec-2021 17:21:01.630 running as: named -g
23-Dec-2021 17:21:01.630 compiled by GCC 10.3.0
23-Dec-2021 17:21:01.630 compiled with OpenSSL version: OpenSSL 1.1.1j 16 Feb 2021
23-Dec-2021 17:21:01.630 linked to OpenSSL version: OpenSSL 1.1.1l 24 Aug 2021
23-Dec-2021 17:21:01.630 compiled with libxml2 version: 2.9.10
23-Dec-2021 17:21:01.630 linked to libxml2 version: 20912
23-Dec-2021 17:21:01.630 compiled with json-c version: 0.15
23-Dec-2021 17:21:01.630 linked to json-c version: 0.15
23-Dec-2021 17:21:01.630 compiled with zlib version: 1.2.11
23-Dec-2021 17:21:01.630 linked to zlib version: 1.2.11
23-Dec-2021 17:21:01.630 ----------------------------------------------------
23-Dec-2021 17:21:01.630 BIND 9 is maintained by Internet Systems Consortium,
23-Dec-2021 17:21:01.630 Inc. (ISC), a non-profit 501(c)(3) public-benefit
23-Dec-2021 17:21:01.630 corporation. Support and training for BIND 9 are
23-Dec-2021 17:21:01.630 available at https://www.isc.org/support
23-Dec-2021 17:21:01.630 ----------------------------------------------------
23-Dec-2021 17:21:01.630 found 8 CPUs, using 8 worker threads
23-Dec-2021 17:21:01.630 using 8 UDP listeners per interface
23-Dec-2021 17:21:01.634 using up to 21000 sockets
23-Dec-2021 17:21:01.634 loading configuration from '/etc/bind/named.conf'
23-Dec-2021 17:21:01.634 reading built-in trust anchors from file '/etc/bind/bind.keys'
23-Dec-2021 17:21:01.634 looking for GeoIP2 databases in '/usr/share/GeoIP'
23-Dec-2021 17:21:01.634 using default UDP/IPv4 port range: [32768, 60999]
23-Dec-2021 17:21:01.634 using default UDP/IPv6 port range: [32768, 60999]
23-Dec-2021 17:21:01.638 listening on IPv4 interface lo, 127.0.0.1#53
23-Dec-2021 17:21:01.638 creating IPv4 interface lo failed; interface ignored
23-Dec-2021 17:21:01.638 listening on IPv4 interface eth0, 172.17.0.25#53
23-Dec-2021 17:21:01.638 creating IPv4 interface eth0 failed; interface ignored
23-Dec-2021 17:21:01.638 not listening on any interfaces
23-Dec-2021 17:21:01.638 couldn't mkdir '//run/named': Permission denied
23-Dec-2021 17:21:01.638 generating session key for dynamic DNS
23-Dec-2021 17:21:01.638 couldn't mkdir '//run/named': Permission denied
23-Dec-2021 17:21:01.638 could not create //run/named/session.key
23-Dec-2021 17:21:01.638 failed to generate session key for dynamic DNS: permission denied
23-Dec-2021 17:21:01.638 sizing zone task pool based on 0 zones
23-Dec-2021 17:21:01.638 none:101: 'max-cache-size 90%' - setting to 14293MB (out of 15881MB)
23-Dec-2021 17:21:01.662 obtaining root key for view _default from '/etc/bind/bind.keys'
23-Dec-2021 17:21:01.662 set up managed keys zone for view _default, file 'managed-keys.bind'
23-Dec-2021 17:21:01.662 automatic empty zone: 10.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 16.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 17.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 18.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 19.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 20.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 21.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 22.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 23.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 24.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 25.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 26.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 27.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 28.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 29.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 30.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 31.172.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 168.192.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 64.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 65.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 66.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 67.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 68.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 69.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 70.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 71.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 72.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 73.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 74.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 75.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 76.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 77.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 78.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 79.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 80.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 81.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 82.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 83.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 84.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 85.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 86.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 87.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 88.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 89.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 90.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 91.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 92.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 93.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 94.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 95.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 96.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 97.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 98.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 99.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 100.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 101.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 102.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 103.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 104.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 105.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 106.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 107.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 108.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 109.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 110.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 111.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 112.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 113.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 114.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 115.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 116.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 117.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 118.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 119.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 120.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 121.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 122.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 123.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 124.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 125.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 126.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 127.100.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 0.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 127.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 254.169.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 2.0.192.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 100.51.198.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 113.0.203.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 255.255.255.255.IN-ADDR.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: D.F.IP6.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 8.E.F.IP6.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 9.E.F.IP6.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: A.E.F.IP6.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: B.E.F.IP6.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: EMPTY.AS112.ARPA
23-Dec-2021 17:21:01.662 automatic empty zone: HOME.ARPA
23-Dec-2021 17:21:01.662 none:101: 'max-cache-size 90%' - setting to 14293MB (out of 15881MB)
23-Dec-2021 17:21:01.682 configuring command channel from '/etc/bind/rndc.key'
23-Dec-2021 17:21:01.682 couldn't add command channel 127.0.0.1#953: permission denied
23-Dec-2021 17:21:01.682 configuring command channel from '/etc/bind/rndc.key'
23-Dec-2021 17:21:01.682 couldn't add command channel ::1#953: permission denied
23-Dec-2021 17:21:01.682 not using config file logging statement for logging due to -g option
23-Dec-2021 17:21:01.682 additionally listening on IPv4 interface lo, 127.0.0.1#53
23-Dec-2021 17:21:01.686 creating IPv4 interface lo failed; interface ignored
23-Dec-2021 17:21:01.686 additionally listening on IPv4 interface eth0, 172.17.0.25#53
23-Dec-2021 17:21:01.686 creating IPv4 interface eth0 failed; interface ignored
23-Dec-2021 17:21:01.694 managed-keys-zone: loaded serial 10
23-Dec-2021 17:21:01.702 all zones loaded
23-Dec-2021 17:21:01.702 running
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:500:2::c#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:7fe::53#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:503:ba3e::2:30#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:dc3::35#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:500:200::b#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:500:2f::f#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:500:12::d0d#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:500:2d::d#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:500:a8::e#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:503:c27::2:30#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:7fd::1#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:500:1::53#53
23-Dec-2021 17:21:01.726 address not available resolving './NS/IN': 2001:500:9f::42#53
23-Dec-2021 17:21:01.810 managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete)
23-Dec-2021 17:21:01.834 resolver priming query complete

root@intelnuc8a:/mnt/data/bind9# cat named.conf
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

//include "/etc/bind/named.conf.options";
//include "/etc/bind/named.conf.local";
//include "/etc/bind/named.conf.default-zones";

options {
        directory "/var/cache/bind";

        forwarders {
                8.8.8.8;
                8.8.4.4;
        };

        dnssec-validation auto;

        // Configure the IPs to listen on here.
        listen-on { any; };
        listen-on-v6 { none; };

        // If you want to allow only specific hosts to use the DNS server:
        allow-query { any; };

};

Related branches

Revision history for this message
Nicholas Fries (nicfries) wrote :

I just ran into the same problem. Also latest with host OS Ubuntu 20.04. Can provide more info if needed but it's basically the same as you described above.

Changed in ubuntu-docker-images:
assignee: nobody → Athos Ribeiro (athos-ribeiro)
Revision history for this message
Athos Ribeiro (athos-ribeiro) wrote :

Hi Timothy, Nicholas, and anyone else affected,

While working on reproducing this, I noticed 2 issues with our current image:

- Our tests were not trying to verify if bind was indeed listening on port 53. I proposed a fix in https://github.com/canonical/server-test-scripts/pull/145.

- The Dockerfile for the image, which IMHO also server as documentation for the image, only exposes port 53 for TCP. Bind needs it to be exposed for UDP as well.

Then, I tried reproducing the issue with the following steps, from a fresh Ubuntu 20.04 install:

# apt update
# apt install -y docker.io
# docker pull docker.io/ubuntu/bind9:latest
# docker run -d --rm -p 5053:53/udp -p 5053:53/tcp docker.io/ubuntu/bind9:latest
# dig @127.0.0.1 -p 5053 ubuntu.com > /dev/null && echo PASSED || echo FAILED

Which outputs the expected result.

I also tried the minimal configuration file provided in this bug report:

# cat <<EOF > named.conf
options {
        directory "/var/cache/bind";

        forwarders {
                8.8.8.8;
                8.8.4.4;
        };

        dnssec-validation auto;

        // Configure the IPs to listen on here.
        listen-on { any; };
        listen-on-v6 { none; };

        // If you want to allow only specific hosts to use the DNS server:
        allow-query { any; };

};
EOF

# docker run --rm -it -p 5053:53/udp -p 5053:53/tcp -v ${PWD}/named.conf:/etc/bind/named.conf docker.io/ubuntu/bind9:latest

# dig @127.0.0.1 -p 5053 ubuntu.com > /dev/null && echo PASSED || echo FAILED

Which also did output the expected results.

Would you mind sharing the version of docker.io you are using and whether it is the deb package available in Ubuntu archives, the snap, or from any other sources?

Revision history for this message
Athos Ribeiro (athos-ribeiro) wrote :

I noticed this is reproducible in microk8s.

This is likely due to how net.ipv4.ip_unprivileged_port_start is set for the container runtime.

Would you (affected) mind running docker with

--sysctl net.ipv4.ip_unprivileged_port_start=0

so we can verify this behavior?

Another workaround here would be to run bind9 from a different port. e.g., change the config file to read

listen-on port 5353 { any; };

Finally, I will change the image to run as root and start bind passing the "-u bind" flag to it. This should fix the bug.

Changed in ubuntu-docker-images:
status: New → In Progress
importance: Undecided → Medium
Revision history for this message
Athos Ribeiro (athos-ribeiro) wrote :
Revision history for this message
Athos Ribeiro (athos-ribeiro) wrote :

The fix has been merged and released as discussed here.

Please, verify the fix and let me know if you are still experiencing any issues in this regard.

Changed in ubuntu-docker-images:
status: In Progress → Fix Released
Revision history for this message
Timothy Garay (timothygaray) wrote :

I did finally get around to testing on my system. The fixes work for me as well.

Thank you!

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.