Build docker behind VPN

Question

At the project I am at now, we have Github Enterprise set up behind a VPN, so I use OpenVPN to connect with my desktop (Ubuntu 14.04 LTS), but when I try to build with Docker (using Centos6) I always get ssh: Could not resolve hostname github.xxx.xxx: Name or service not known.

I've looked at the Docker documentation, but it looks that it is only solving problem using Proxy or a Bridge, and Google only returns answers on how I can set up OpenVPN on a Docker image.

So then I turn to Stackoverflow and hope for an answer on how I can run sudo docker build image and get it to use my VPN to clone from Github.

Also, our Mac users have installed Boot2Docker, and have no problems building the image.

Between

Answer 1

I tried all kinds of things, in the end the simplest thins helped on Ubuntu 18.04. Stoping and starting docker deamon.

Prerequisites: VPN off

sudo systemctl stop docker

---> Start VPN

sudo systemctl start docker

Hope will help someone.

Beeswing

Answer 2

If I understood you correctly, you'd like to access an svn repository through the VPN during the build of the docker image, i.e. one of the instructions of the Dockerfile must resolve the hostname.

If your problem is related to the domain name resolution, you can use the --add-host option (see the doc) to docker-build to explicitly map the IP to the relevant hostname. Note that it might require a relatively high docker version.

docker build --add-host host_name:host_IP .

See the useful related post as well.

Marron

Answer 3

It's likely one of two issues:

1) DNS

2) Your desktop's routing table

My specific case (also Ubuntu 14.04) turned out to be routing tables. That's what I go through below.

To factor out if DNS is a problem, can you successfully ping an IP from inside your container?

docker run -i -t ubuntu:14.04 /bin/bash                                                
root@44445bfefc4e:/# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=54 time=76.1 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=54 time=75.6 ms

If that works and your containers still can't reach out while you're connected to the VPN, look at your routes.

Disconnect from the VPN and inspect your routes with route. Here's my output as an example:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         DD-WRT          0.0.0.0         UG    0      0        0 wlan0
172.17.0.0      *               255.255.0.0     U     0      0        0 docker0
192.168.1.0     *               255.255.255.0   U     9      0        0 wlan0
192.168.122.0   *               255.255.255.0   U     0      0        0 virbr0

In there, you'll see Docker's network (172.17.0.0).

Now, connect to your VPN and re-issue the command. Your mileage may vary, but what I found was a duplicate entry in the route table:

172.17.0.0      *               255.255.0.0     U     0      0        0 vpn0
172.17.0.0      *               255.255.0.0     U     0      0        0 docker0

The server was pushing a duplicate route!

In my case, I didn't need those routes to successfully navigate the VPN, so I found a way of disabling them. I use OpenVPN, so I drilled down in the settings in the dialog and checked the 'Ignore automatically obtained routes'.

That image is from this blog post.

Once I checked that and reconnected to the VPN, I no longer had the duplicate entry and my Docker containers were able to connect to the Internet and to hosts inside the VPN.

Kilbride

Sadly I didn't have any duplicates in my routes table, plus I forgot to mention that my Docker image is based on Centos6. – Between

Do you know if the problem is just DNS or are you unable to even use IPs to reach outside the container? – Kilbride

I'm able to ping "normal" site, such as google.com or 8.8.8.8, I just can't ping the site that is behind the VPN. I colleague thinks it may be that docker uses the wrong Gateway, but I don't have time to check on it before Monday. – Between

In a standard install, Docker goes through the bridge it sets up. It's possible that the gateway is misconfigured but I'm not sold on it. Can you ping hosts directly? For instance, your internal Github by its IP? I also remember having to work around a DNS problem in the past by editing /etc/defaults/docker.io to add DOCKER_OPTS=--dns <internal DNS server> – Kilbride

We solved it. I hadn't tried to just ping the IP from within the docker instance. So when I ping'd the IP it worked. Not sure what that means, but it's at least a step forward. – Between

So the problem is DNS. At least you can still reach out. Thanks for coming back to let us know. – Kilbride

@Kilbride what if I cannot ping the IP but there are no duplicate entries? – Tableau