Cannot connect to chocolatey.org or any other internet site from within container

Question

xpost from https://forums.docker.com/t/cannot-connect-to-chocolatey-org/38745

Expected behavior

I'm running Windows Server 2016 Datacenter (MSDN download) 64 bit - Version 1607 - Build 14393.1715

I'm using Docker For Windows and running Windows Containers.

I figure this is the easiest thing in the world, to do this:

reboot my host machine
docker run -it microsoft/windowsservercore
powershell
iex ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1'));

The expectation is for this to install chocolatey in the container.

I'm actually going to be doing this in a dockerfile, but I'm going for minimum working example to get help right now.

Here's an actual docker file that fails (it's not so creative, sadly)

FROM microsoft/windowsservercore

SHELL ["Powershell"]

ENV ChocolateyUseWindowsCompression false;
RUN iex ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1'));

Actual behavior

First things first: I'm running this in a Virtualbox VM. Everything else that I want to work works, including but not limited to: internal network connectivity and tests, sql server running, WCF services running against my docker-compose environment, data coming back correctly. All of the things I expect the system to do are working. This is the last-step, fingers crossed :D. The fact that I'm running this in VirtualBox shouldn't matter, since the Hyper-V is working and all my machines are working as expected. I just figure it's worth mentioning.

docker run -it microsoft/windowsservercore
powershell
PS C:\> iex ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1'))
Exception calling "DownloadString" with "1" argument(s): "The remote name could not be resolved: 'chocolatey.org'"
At line:1 char:1
+ iex ((new-object net.webclient).DownloadString('https://chocolatey.or ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : WebException

PS C:\> ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : 339189e8dd56
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : attlocal.net

Ethernet adapter vEthernet (Container NIC 6412b757):

   Connection-specific DNS Suffix  . : attlocal.net
   Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter #4
   Physical Address. . . . . . . . . : 00-15-5D-80-E9-2C
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::a51b:820e:e45d:fab6%29(Preferred)
   IPv4 Address. . . . . . . . . . . : 172.22.202.147(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.240.0
   Default Gateway . . . . . . . . . : 172.22.192.1
   DNS Servers . . . . . . . . . . . : 172.22.192.1
                                       10.0.2.2
   NetBIOS over Tcpip. . . . . . . . : Disabled

From my host OS (Server 2016) I have this information:

PS C:\docker> ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : WIN-CDPNLUMSTOE
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : attlocal.net

Ethernet adapter vEthernet (HNS Internal NIC) 2:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter #2
   Physical Address. . . . . . . . . : 00-15-5D-80-E5-17
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::5939:52e7:aaf3:5b70%9(Preferred)
   IPv4 Address. . . . . . . . . . . : 172.22.192.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.240.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 301995357
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-4E-0C-48-08-00-27-51-5F-6A
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter vEthernet (HNS Internal NIC) 3:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter #3
   Physical Address. . . . . . . . . : 00-15-5D-B6-45-8D
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::1de4:bff7:36fb:ee92%13(Preferred)
   IPv4 Address. . . . . . . . . . . : 172.23.128.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.240.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 570430813
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-4E-0C-48-08-00-27-51-5F-6A
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : attlocal.net
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Desktop Adapter
   Physical Address. . . . . . . . . : 08-00-27-51-5F-6A
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::10de:923b:b866:221d%4(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.0.2.15(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Friday, August 19, 1881 6:47:42 PM
   Lease Expires . . . . . . . . . . : Tuesday, September 26, 2017 11:15:59 PM
   Default Gateway . . . . . . . . . : 10.0.2.2
   DHCP Server . . . . . . . . . . . : 10.0.2.2
   DHCPv6 IAID . . . . . . . . . . . : 50855975
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-4E-0C-48-08-00-27-51-5F-6A
   DNS Servers . . . . . . . . . . . : 10.0.2.2
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{C420BD56-5715-49BF-9382-5EA99AA48563}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #5
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{70EA4F39-FE0F-4040-B718-ACAC00765808}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #6
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.attlocal.net:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : attlocal.net
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #7
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
PS C:\docker>

Information

DockerDebugInfo.ps1 output: https://gist.github.com/jcolebrand/170673e45bf8a659552f22f2071c30d6

System information

Running Windows Server Datacenter (MSDN download) 64 bit - Version 1607 - Build 14393.1715

PS C:\docker> docker version
Client:
 Version:      17.06.2-ce
 API version:  1.30
 Go version:   go1.8.3
 Git commit:   cec0b72
 Built:        Tue Sep  5 19:57:19 2017
 OS/Arch:      windows/amd64

Server:
 Version:      17.06.2-ce
 API version:  1.30 (minimum version 1.24)
 Go version:   go1.8.3
 Git commit:   cec0b72
 Built:        Tue Sep  5 19:59:47 2017
 OS/Arch:      windows/amd64
 Experimental: true

If, for any forsaken reason this is important, the host OS does need to be activated. I'm doing this in a one-shot dev environment so wasn't particularly worried about activating the VM just yet. I can't fathom how this is important. Especially since everything else "just works".

Answer 1

The problem appears to be that the Windows images configure DNS to first be the default gateway of the NAT interface, and then the DNS of the host machine. DNS lookups fail against that first resolver and external access.

Adding --dns 8.8.8.8 (or your local resolver) to the CLI seems to work around the problem.

Answer 2

At a command prompt run ipconfig /all and look for a DNS Servers line in the output with something that looks like an IPv4 address. That's your host machine's DNS server(s).

Edit C:\ProgramData\Docker\config\daemon.json and add a dns entry with that IPv4 address. For example, if your DNS Server is 192.10.0.2 and 8.8.8.8 is Google's DNS as a backup:

{
    "dns": ["192.10.0.2", "8.8.8.8"]
}

Now restart Docker Desktop and the remote URLs can be resolved by Docker, either at build or runtime.

This solution came from Faithful Anere at https://medium.com/@faithfulanere/solved-docker-build-could-not-resolve-archive-ubuntu-com-apt-get-fails-to-install-anything-9ea4dfdcdcf2

UPDATE 2024

You now need to open Docker Desktop and go to Settings > Docker Engine to update this setting. If you edit the file directly it gets overwritten when you restart Docker.

Answer 3

As comments are transient, here's some info for the next person trying to solve this problem. Please feel free to edit this answer to provide more details, unless you're a Docker for Windows pro, in which case please give a better answer :D

I went to demo the problem for my IT group after having changed my NIC on my VM to bridged and adding my thunderbolt adapter. As there are security systems in place, I realized I needed to add the security software to my VM, but as it isn't joined to the domain, that was a problem. Switching it back to NAT on the wifi adapter, and then going to demo the problem in my Windows 2016 VM somehow magically made it start working.

Same network. Same VM configuration. Same software and host, no changes to anything I can track.

Having checked Get-ContainerNetwork or Get-WinNat showing nothing, I really had been at my end of diagnostics. Changing that NIC adapter and then changing it back apparently caused something to reset. Good times.

So, I don't have a solid answer, but I have a good workaround for the next person stuck in my shoes, which, given my track record of StackExchange questions and answers, will be me. But I hope it helps you out too, random internet asker.

---

And an XKCD tax, for those impossible to solve problems.

Answer 4

I recently had this frustrating problem but I managed to fix it today.

What I did, is in the desktop app on Windows / Mac you can edit the Daemon file. Under Settings in the Docker App under Docker Engine, I added the line at the bottom of the file just above the last curly brace. "dns": [ "192.168.4.100", "8.8.8.8" ]

This then allows the Docker Containers all that you now build to use your host's DNS server. Technically if you can access: https://chocolatey.org/install.ps1 then you should be able to access the choco repository.

I have also built the image in https://github.com/jasric89/vsts-agent-docker/tree/master/windows/servercore/10.0.14393 and labeled it in the repo:

microsoft/windowsservercore:10.0.14393.1358

I then set: RUN choco feature enable --name allowGlobalConfirmation before my first Choco Install command, this enables choco to install all the files and not error.

With all that set my Docker File Ran and built the image. Well in my Test Env now testing in my prod env. :)

Links that helped me:

https://github.com/moby/moby/issues/24928 https://github.com/jasric89/vsts-agent-docker/blob/master/windows/servercore/10.0.14393/standard/VS2017/Dockerfile https://docs.chocolatey.org/en-us/troubleshooting https://github.com/moby/moby/issues/25537

Answer 5

Try installation instructions from https://chocolatey.org/install#completely-offline-install (section "Installing behind a proxy"):

    @powershell -NoProfile -ExecutionPolicy Bypass -Command "[System.Net.WebRequest]::DefaultWebProxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin