Comment 8 for bug 925511

On 08/02/12 08:33, Ritesh Raj Sarraf wrote:
> On Wednesday 08 February 2012 03:54 AM, Serge Hallyn wrote:
>> @Ritesh,
>>
>> Unfortunately I don't know that that many people would read the README :)
>> It is worth adding though, thanks for the suggestion.
>>
>> In addition, I will add an LXC section to the ubuntu server guide soon,
>> and this should be mentioned there.
>>
>> I'm also marking this (and the equivalent libvirt) bugs as affecting
>> dnsmasq. Perhaps we can do something to its default configuration to be
>> less belligerant. Maybe even just an explicit
>> '--except-interface=virbr0,lxcbr0', though hard-coding that seems a bit
>> ugly.
>
> Serge,
>
> IMO the better option would be to just ship a binder in /etc/dnsmasq.d/
>
> dnsmasq is a personal dns caching service. I doubt if anyone is using it
> as a bind replacement.
>
> By shipping a dnsmasq sub conf file (and making it bind to loopback
> only), you eliminate the need to track the list of virtual bridges.
> Then, you also don't need to spawn off your own dnsmasq proc from the
> lxc init script.
>

There is special provision in dnsmasq to do exactly this, but it's never
made it into libvirt upstream. Please feel free to push there!

from "man dnsmasq" NOTES section:

--------------------------------------------------------------
dhcp-range may have an interface name supplied as
"interface:<interface-name>". The semantics if this are as follows: For
DHCP, if any other dhcp-range exists _without_ an interface name, then
the interface name is ignored and and dnsmasq behaves as if the
interface parts did not exist, otherwise DHCP is only provided to
interfaces mentioned in dhcp-range declarations. For DNS, if there are
no --interface or --listen-address flags, behaviour is unchanged by the
interface part. If either of these flags are present, the interfaces
mentioned in dhcp-ranges are added to the set which get DNS service.

Similarly, enable-tftp may take an interface name, which enables TFTP
only for a particular interface, ignoring --interface or
--listen-address flags. In addition --tftp-secure and --tftp-unique-root
and --tftp-no-blocksize are ignored for requests from such interfaces.
(A --tftp-root directive giving a root path and an interface should be
provided too.)

These rules may seem odd at first sight, but they
allow a single line of the form
"dhcp-range=interface:virt0,192.168.0.4,192.168.0.200" to be added to
dnsmasq configuration which then supplies DHCP and DNS services to
that interface, without affecting what services are supplied to
other interfaces and irrespective of the existance or lack of
"interface=<interface>" lines elsewhere in the dnsmasq configuration.
"enable-tftp=virt0" and "tftp-root=<root>,virt0" do the same job for TFTP.

The idea is that such a line can be added automatically by libvirt or
equivalent systems, without disturbing any manual configuration.
---------------------------------------------------------------

Cheers,

Simon.