criticalIntermediateSymptom-first#networking#dns#bridge#iptables

Container has no internet access — DNS or network broken inside

ping: Temporary failure in name resolution inside the container

Likely source:connectivityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • ping: Temporary failure in name resolution inside the container
  • apt-get update or curl inside container times out
  • Container can reach some IPs but not resolve hostnames

Docker uses 127.0.0.11 as the embedded DNS resolver. If that fails, containers lose all name resolution even when upstream DNS is fine.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Container DNS config

    docker exec <CONTAINER> cat /etc/resolv.conf

  • Bridge network details

    docker network inspect bridge

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • docker exec nslookup fails but ping 8.8.8.8 works
  • resolv.conf points to a non-existent or wrong nameserver

Confirm before fixing

docker exec <CONTAINER> cat /etc/resolv.conf
READ

Read the container's DNS config

Fix

docker run --dns 8.8.8.8 <IMAGE>
CHANGE

Override DNS with a working resolver

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
docker exec <CONTAINER> nslookup google.com
READ

Confirm DNS is broken

2
docker exec <CONTAINER> ping -c2 8.8.8.8
READ

Isolate DNS vs IP connectivity

3
docker exec <CONTAINER> cat /etc/resolv.conf
READ

Read DNS config

4
docker run --rm --dns 8.8.8.8 alpine nslookup google.com
READ

Test with explicit DNS override

5
sudo systemctl restart docker
CHANGE

Recreate bridge and iptables rules

Prevention

  • Keep iptables and conntrack modules loaded; avoid disabling them in production.
  • Set reliable DNS servers in /etc/docker/daemon.json: {"dns": ["8.8.8.8", "8.8.4.4"]}.
  • Monitor docker0 bridge health and iptables rules with a post-reboot check.
  • Avoid --network=none unless explicitly needed for isolation.

Related runbooks

Same stack, same failure family — worth a skim.

DNS resolution failing inside pods — CoreDNS issuescritical

curl: Could not resolve host inside pods

KubernetesIntermediate2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.