[Bug]: Cannot access internet urls during building [eg. crates.io]

[Harokku]

I have done the following

• I have searched the existing issues
• If possible, I've reproduced the issue using the 'main' branch of this project

Steps to reproduce

Try to build a container that need to compile a rust program as part of the building stage.

[Dockerfile] (extract):
FROM rust:1.90-slim as builder
RUN --mount=type=cache,target=/usr/local/cargo/registry
cargo build --release <- here where it fail

[Build command]:
container build --tag disc_arch --file Dockerfile .

Network and bridge seem ok, since container build can fetch OCI image from docker repository (see log)

Tried to debug with following dockerfile:
FROM alpine:latest
RUN ping -c 3 google.com

No response.

Current behavior

failed to download from https://index.crates.io

It seem it can't reach crates.io,

With simpler dockerfile DNS resolution work, it resolve google.com correctly (pingable from host, so no network issue in place)

Expected behavior

It should build (same host, same command in docker compile)

It should ping google.com in the second test

Environment

- OS: Version 26.0 (25A354)
- Xcode: Version 26.0 (17A324)
- Container: 0.4.1

Relevant log output

container build --tag disc_arch --file Dockerfile .
[+] Building 134.8s (9/11)
 => [resolver] fetching image...docker.io/library/rust:1.90-slim                                     0.0s
 => [resolver] fetching image...docker.io/library/debian:bookworm-slim                               0.0s
 => [internal] load .dockerignore                                                                    0.1s
 => => transferring context: 1.12kB                                                                  0.1s
 => oci-layout://docker.io/library/rust:1.90-slim@sha256:40d4ee109c7e740b3a242f20cc3b5790af9c725828  0.0s
 => => resolve docker.io/library/rust:1.90-slim@sha256:40d4ee109c7e740b3a242f20cc3b5790af9c725828b8  0.0s
 => [internal] load build context                                                                    1.2s
 => => transferring context: 188.56MB                                                                1.1s
 => CACHED oci-layout://docker.io/library/debian:bookworm-slim@sha256:df52e55e3361a81ac1bead266f337  0.0s
 => => resolve docker.io/library/debian:bookworm-slim@sha256:df52e55e3361a81ac1bead266f3373ee55d29a  0.0s
 => CACHED [linux/arm64/v8 builder 1/4] WORKDIR /app                                                 0.0s
 => CACHED [linux/arm64/v8 builder 2/4] COPY . .                                                     0.0s
 => ERROR [linux/arm64 builder 3/4] RUN --mount=type=cache,target=/usr/local/cargo/registry     c  131.2s
------
 > [linux/arm64 builder 3/4] RUN --mount=type=cache,target=/usr/local/cargo/registry     cargo build --release:
0.074     Updating crates.io index
30.09 warning: spurious network error (3 tries remaining): [28] Timeout was reached (Connection timed out after 30010 milliseconds)
61.17 warning: spurious network error (2 tries remaining): [28] Timeout was reached (Connection timed out after 30003 milliseconds)
94.68 warning: spurious network error (1 try remaining): [28] Timeout was reached (Connection timed out after 30010 milliseconds)
131.2 error: failed to get `hostname` as a dependency of package `disc_arch v0.1.0 (/app)`
131.2
131.2 Caused by:
131.2   download of config.json failed
131.2
131.2 Caused by:
131.2   failed to download from `https://index.crates.io/config.json`
131.2
131.2 Caused by:
131.2   [28] Timeout was reached (Connection timed out after 30010 milliseconds)
------
Error: unknown (2): failed to solve: process "/bin/sh -c cargo build --release" did not complete successfully: exit code: 101

------
Second dockerfile output:
[+] Building 13.4s (4/4) FINISHED
 => [resolver] fetching image...docker.io/library/alpine:latest                                      0.0s
 => [internal] load .dockerignore                                                                    0.1s
 => => transferring context: 1.12kB                                                                  0.1s
 => CACHED oci-layout://docker.io/library/alpine:latest@sha256:4bcff63911fcb4448bd4fdacec207030997c  0.0s
 => => resolve docker.io/library/alpine:latest@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea  0.0s
 => ERROR [linux/arm64 1/2] RUN ping -c 3 google.com                                                12.1s
------
 > [linux/arm64 1/2] RUN ping -c 3 google.com:
0.061 PING google.com (216.58.204.238): 56 data bytes
12.07
12.07 --- google.com ping statistics ---
12.07 3 packets transmitted, 0 packets received, 100% packet loss
------
Error: unknown (2): failed to solve: process "/bin/sh -c ping -c 3 google.com" did not complete successfully: exit code: 1

Code of Conduct

• I agree to follow this project's Code of Conduct

[adrianmm12]

Any updates on this?

[henrahmagix]

I have the exact same issue: DNS resolution does not work inside a container. I cannot resolve dl-cdn.alpinelinux.org or bbc.co.uk or anything else inside the container, but I can ping their IP when resolved on my host macbook.

This makes it impossible to build up our own system images because packages cannot be installed since apk upgrade and apk add do not work:

$ container image pull alpine # I hit enter so the progress can be copy-pasted here after it's done
⠹ [2/2] Unpacking image for platform linux/arm/v6 (519 entries, 6.6 MB, 168 KB/s) [6s]
⠸ [2/2] Unpacking image for platform linux/arm64/v8 (519 entries, 8.1 MB, 119 KB/s) [8s]

$ container ls
ID        IMAGE                                               OS     ARCH   STATE    ADDR          CPUS  MEMORY
buildkit  ghcr.io/apple/container-builder-shim/builder:0.6.1  linux  arm64  running  192.168.64.3  8     4096 MB

$ container image ls
NAME                       TAG                  DIGEST
alpine                     latest               4b7ce07002c69e8f3d704a9c...

$ container run --rm -it --platform linux/amd64 alpine
/ # apk upgrade
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.22/main: temporary error (try again later)
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/community/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.22/community: temporary error (try again later)
ERROR: Not continuing due to stale/unavailable repositories.Use --force-missing-repositories to continue.
/ # apk upgrade --force-missing-repositories
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.22/main: temporary error (try again later)
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/community/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.22/community: temporary error (try again later)
OK: 7 MiB in 16 packages
/ # apk add yarn
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.22/main: temporary error (try again later)
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/community/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.22/community: temporary error (try again later)
ERROR: unable to select packages:
  yarn (no such package):
    required by: world[yarn]
/ # ping bbc.co.uk
ping: bad address 'bbc.co.uk'
/ #

$ ping bbc.co.uk
PING bbc.co.uk (151.101.192.81): 56 data bytes
64 bytes from 151.101.192.81: icmp_seq=0 ttl=59 time=7.154 ms
64 bytes from 151.101.192.81: icmp_seq=1 ttl=59 time=11.079 ms
^C
--- bbc.co.uk ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 7.154/9.117/11.079/1.962 ms

$ container run --rm -it --platform linux/amd64 alpine
/ # ping 151.101.192.81
PING 151.101.192.81 (151.101.192.81): 56 data bytes
64 bytes from 151.101.192.81: seq=0 ttl=58 time=15.212 ms
64 bytes from 151.101.192.81: seq=1 ttl=58 time=8.847 ms
^C
--- 151.101.192.81 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 8.847/12.029/15.212 ms
/ #

Here's my system info:

$ arch
arm64

$ system_profiler SPHardwareDataType | grep Chip
      Chip: Apple M1 Pro

$ sw_vers
ProductName:		macOS
ProductVersion:		26.0.1
BuildVersion:		25A362

$ container system status
apiserver is running
application data root: /Users/henry/Library/Application Support/com.apple.container/
application install root: /usr/local/
container-apiserver version: container-apiserver version 0.5.0 (build: release, commit: 48230f3)
container-apiserver commit: 48230f380499efecd663fdc6749a2cbaf2f8ed76

$ container system property list
ID                 TYPE    VALUE                                     DESCRIPTION
build.rosetta      Bool    *undefined*                               Build amd64 images on arm64 using Rosetta, instead of QEMU.
dns.domain         String  container                                 If defined, the local DNS domain to use for containers with unqualified names.
image.builder      String  ghcr.io/apple/container-builder-shim/...  The image reference for the utility container that `container build` uses.
image.init         String  ghcr.io/apple/containerization/vminit...  The image reference for the default initial filesystem image.
kernel.binaryPath  String  opt/kata/share/kata-containers/vmlinu...  If the kernel URL is for an archive, the archive member pathname for the kernel file.
kernel.url         String  https://github.com/kata-containers/ka...  The URL for the kernel file to install, or the URL for an archive containing the kernel file.
network.subnet     String  *undefined*                               Default subnet for IP allocation (used on macOS 15 only).
registry.domain    String  docker.io                                 The default registry to use for image references that do not specify a registry.

[adrianmm12]

Any updates here? I'm surprised no one has addressed this, it really limits image builds.

[ulf-engels]

Hi,

I can confirm that networking (especially name resolution) is quite limited in cnotainer yet. But I found a workaround for "container run". Her an example

If I run an alpine container "the normal way" I am unable to fetch package updates

container run -it alpine / # apk update fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/main/aarch64/APKINDEX.tar.gz WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.22/main: temporary error (try again later) fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/community/aarch64/APKINDEX.tar.gz WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.22/community: temporary error (try again later)

But if I add the "--dns" parameter, it works nicely (you can change the IP after "dns" to any other reachable DNS of your choice)

container run -it --dns 8.8.8.8 alpine / # apk update fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/main/aarch64/APKINDEX.tar.gz fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/community/aarch64/APKINDEX.tar.gz v3.22.2-114-g3bc4c29c93b [https://dl-cdn.alpinelinux.org/alpine/v3.22/main] v3.22.2-131-g6a96199c31d [https://dl-cdn.alpinelinux.org/alpine/v3.22/community] OK: 26161 distinct packages available / # apk add curl (1/9) Installing brotli-libs (1.1.0-r2) (2/9) Installing c-ares (1.34.5-r0) (3/9) Installing libunistring (1.3-r0) (4/9) Installing libidn2 (2.3.7-r0) (5/9) Installing nghttp2-libs (1.65.0-r0) (6/9) Installing libpsl (0.21.5-r3) (7/9) Installing zstd-libs (1.5.7-r0) (8/9) Installing libcurl (8.14.1-r2) (9/9) Installing curl (8.14.1-r2) Executing busybox-1.37.0-r19.trigger OK: 13 MiB in 25 packages / #

Unfortunately I did not find a way (yet) to set the DNS for the buildkit container. Hints or the "--dns" option for the build command would be highly appreciated

[theZMC]

A temporary workaround I've found is to exec into the buildkit container and modify the /etc/resolv.conf to point to a known good DNS server:

container exec buildkit /bin/sh -c 'echo "nameserver 8.8.8.8" > /etc/resolv.conf'

Obviously not an ideal long-term solution but should unblock in the short term.

[saccy]

Same train of though as @theZMC - Just modified /etc/resolver/containerization.container (this is on your mac filesystem) by adding google dns followed by a reboot, seems to work although download speeds during build process are all over the place for me.

/etc/resolver/containerization.container:

domain container
search container
nameserver 8.8.8.8 127.0.0.1
port 2053

(Running behind cloudflare doesn't seem to work at all)

[jiridanek]

If you're running a local DNS resolver, the cause may be

• [Bug]: DNS Resolution Fails in Containers When a Local Service Binds to Port 53 on Specific Interfaces #402

[jongross]

I just ran into this issue as well, and would love to see this fixed!

[jmasson]

Oddly I had no issues on 0.8 but after updating to 0.9 and trying to build the same image, I hit this issue ... worked around it by running container exec buildkit /bin/sh -c 'echo "nameserver 8.8.8.8" > /etc/resolv.conf' after starting the container service.