docker: support IPv6 nameservers in nginx resolver derivation - #79
docker: support IPv6 nameservers in nginx resolver derivation#79ashbrener wants to merge 1 commit into
Conversation
The entrypoint derives nginx's resolver from /etc/resolv.conf but wrote
IPv6 nameserver addresses unbracketed. On hosts with an IPv6 resolver
(e.g. Fly.io's fdaa::3) nginx fails at startup with
[emerg] invalid port in resolver "fdaa::3"
and the container crash-loops. Bracket any nameserver containing a colon
so nginx parses it as an IPv6 address instead of host:port.
Also drop the hardcoded ipv6=off, which prevented proxying to IPv6-only
upstreams (e.g. Fly.io .flycast hosts) by discarding AAAA answers.
|
Friendly bump on this one — happy to rebase or split it if that helps. Quick recap of what it fixes: The change is 5 lines in that script — bracket nameservers containing a colon, No rush at all if it's not a priority — mainly flagging it since it's a silent |
Problem
docker/40-openconcho-config.shderives nginx'sresolverfrom the container's/etc/resolv.conf, but writes nameserver addresses verbatim. Two issues:IPv6 nameservers crash nginx at startup. nginx requires IPv6 resolver addresses in brackets; unbracketed, it parses everything after the last colon as a port. On any host whose resolv.conf carries an IPv6 nameserver — e.g. Fly.io machines, where the resolver is
fdaa::3— the container crash-loops with:Hardcoded
ipv6=offbreaks IPv6-only upstreams. Withipv6=off, nginx discards AAAA answers, so the header-driven/apiproxy can never reach upstreams that only resolve to IPv6 — e.g. Fly.io private.flycastaddresses.Fix
00-resolver.conf(fdaa::3→[fdaa::3]), so nginx parses it as an IPv6 address instead ofhost:port.ipv6=offso AAAA resolution works for IPv6-only upstreams. IPv4-only environments are unaffected: happy-eyeballs-style fallback still resolves A records as before.Testing
Ran the patched script inside
nginxinc/nginx-unprivileged:alpine(busybox awk, same as the image build) followed bynginx -t:/etc/resolv.confnameservers00-resolver.confnginx -tfdaa::3(Fly.io)resolver [fdaa::3] valid=10s;fdaa::3+8.8.8.8resolver [fdaa::3] 8.8.8.8 valid=10s;resolver 127.0.0.11 valid=10s;(fallback)Previously the first case rendered
resolver fdaa::3 ipv6=off valid=10s;and nginx failed with the emerg above.We hit this deploying the image on Fly.io; currently working around it with an extra entrypoint script that post-processes
00-resolver.conf, but the derivation should be fixed at the source.