docker的容器内无法解析dns,需要对宿主机的防火墙做设置

最新推荐文章于 2025-09-20 21:01:29 发布

原创最新推荐文章于 2025-09-20 21:01:29 发布 · 980 阅读

0 ·

CC 4.0 BY-SA版权

本文详细介绍了如何在生产环境中正确配置DNS并优化防火墙设置，通过开启伪装IP功能确保网络通信正常，同时避免了完全禁用防火墙带来的安全隐患。文章提供了具体的命令示例，包括firewall-cmd的使用、docker容器的启动与停止，以及ping测试验证网络连通性的方法。

生产环境下是绝对不可以禁用防火墙, 只需要开启伪装IP的功能即可以正常使用dns

[root@localhost liuhongdi]# firewall-cmd --zone=public --add-masquerade --permanent
success
[root@localhost liuhongdi]# firewall-cmd --reload
success
[root@localhost liuhongdi]# systemctl stop firewalld
[root@localhost liuhongdi]# systemctl start firewalld
[root@localhost liuhongdi]# systemctl stop docker
[root@localhost liuhongdi]# systemctl start docker
[root@localhost liuhongdi]# docker run --name tracker1 --privileged -v /usr/local/source:/usr/local/source -d -i -t 470671670cac /usr/sbin/init
914e7dcb12983cc27302a7becf05833abab07d8a765bf11326ca0c9ecfa12e6a
[root@localhost liuhongdi]# docker exec -it tracker1 /bin/bash
[root@914e7dcb1298 /]# ping www.sina.com.cn
PING spool.grid.sinaedge.com (120.192.83.125) 56(84) bytes of data.
64 bytes from 120.192.83.125 (120.192.83.125): icmp_seq=1 ttl=51 time=34.6 ms

^C
--- spool.grid.sinaedge.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 5ms
rtt min/avg/max/mdev = 20.664/27.730/34.566/5.679 ms