docker pull: lookup registry host fails with "no such host"

[mariorasch]

I installed colima and docker using Homebrew.

Alas e.g. docker pull openapi-generator-cli fails with following output:

Using default tag: latest
Error response from daemon: Get "https://registry-1.docker.io/v2/": dial tcp: lookup registry-1.docker.io on 127.0.0.53:53: no such host

colima ssh -- cat /etc/resolv.conf shows this:

nameserver 127.0.0.53
options edns0 trust-ad
search rlan

AFAIK this means that resolved process listens to requests to 127.0.0.53 and forwards them.

colima ssh -- resolvectl status shows this:

Global
         Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
  resolv.conf mode: stub

Link 2 (eth0)
    Current Scopes: DNS
         Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 192.168.5.2
       DNS Servers: 192.168.5.2
        DNS Domain: rlan

Link 3 (docker0)
    Current Scopes: none
         Protocols: -DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

I guess this means resolved forwards requests to 192.168.5.2.

192.168.5.2 is NATed IP that gets forwarded to my host's loopback 127.0.0.1.

I know this forwarding in general works because 192.168.5.2 is also used for HTTP(S)_PROXY environment variables inside colima and accessing HTTP(S) proxy that is listening on my host's loopback works. I can e.g. run a 'colima ssh -- curl -I www.google.com' successfully, and same command fails when e.g. I kill HTTP(S) proxy process on my host.

Also on my host I setup cloudflared and configured it to do DOH. This is working as e.g. dig @127.0.0.1 registry-1.docker.io on my host correctly resolves.

BUT as said above docker pull fails and also e.g. colima ssh -- resolvectl query registry-1.docker.io -t A fails with

registry-1.docker.io: resolve call failed: Name 'registry-1.docker.io' not found
FATA[0000] exit status 1

So my question is: do I miss some configuration here to get this working?

Many thanks in advance for any help!

[cscetbon]

I had the same issue and restarting colima solved it.

[mariorasch]

Alas restarting does not help in my case.

Underlying problem is that I use Colima in a context where I'm only allowed to access Internet through my company's proxy - so I shouldn't be in the need of resolving external hosts. And indeed my company's DNS servers can only resolve internal hostnames, but not external ones.

Nevertheless, if for whatever reason you need resolving to work in situations like mine (i.e. being behind a company's proxy and company's DNS servers only resolving internal addresses) I found a solution that can at least be used temporarily on macOS machines:

• brew install dnscrypt-proxy
• edit /opt/homebrew/etc/dnscrypt-proxy.toml and edit server_names, enable http_proxy and configure forwarding_rules so that internal domains are resolved by internal DNS servers.
• start dnscrypt-proxy
• networksetup -setdnsservers Wi-Fi 127.0.0.1 (network service "Wi-Fi" used here may differ)

To disable this locally running DNS server kill dnscrypt-proxy process and issue networksetup -setdnsservers Wi-Fi Empty.