Proxmox 8 - Possible issue with DNS resolution and LXC

societus

New Member
Feb 19, 2023
7
1
3
Good evening guys,

I recently tried out Proxmox 8 on a couple spare machines before upgrading my production rigs, and may have discovered a possible issue, but cannot totally determine where the problem lies.

Issue: When host is connected to a Tailscale network, with or without accepting DNS, LXC containers created or started after it is connected fail to resolve DNS, and changes to DNS addresses from the Prox web-ui or resolv.conf in the LXC client are either not being recognized or otherwise ineffective.

Replication: Connected 3 nodes Proxmox 8 to a tailnet, both with the official Tailscale control server, or using a self hosted Headscale instance in the cloud. Debian 11,12, and Alpine Linux LXC containers fail to resolve DNS if they are started after the host is on the tailnet. The only resolution is to disable connection at startup and rebooting. While issue occurs, the host is still able to resolve DNS, and changes to resolv.conf and the web-ui for the host are accepted and register the changes correctly.

Additional changes attempted: Steps on guide for Tailscale in LXC were followed, all LXC containers intended to have Tailscale on directly have proper cgroup/tun access. Connecting a container to a tailnet while host is not seems to work okay, until the host is connected and DNS breaks immediately.

I have this setup on my production cluster using Prox 7, with hosts and containers separately connected as nodes in my tailnet, with no issues occurring to DNS. Not sure what else might help here, but hoping that this might bring attention to something that could be an issue, as I cannot risk this problem should I upgrade my main servers.

Thanks!
 
  • Like
Reactions: antonionardella
Hello @societus

I am having the same issue on Proxmox 8

Tailscale is not set up on the Proxmox host, but the LXC container stops DNS resolution as soon as tailscale is connected.

Did you find any solution to this?
 
Hello @societus

I am having the same issue on Proxmox 8

Tailscale is not set up on the Proxmox host, but the LXC container stops DNS resolution as soon as tailscale is connected.

Did you find any solution to this?

Not directly a solution, but I have found a procedural workaround. As of the latest update, I have been able to get a test environment working past the bug, but it requires that the host first be attached to the tailnet in userspace, accepting subnet routes on the subnets the interfaces for VM/LXC uses. Afterwards the LXC containers have working networking long enough to connect IT to the tailnet, and not consistently, but most of the time, networking still works after logging the proxmox host out of the tailnet. It leads me to believe it could be tied to the uid/gid changes as it registers /dev/tun devices in the kernel, since LXC is not really designed for networking changes and negotiating native networking with partially virtualized or convergent bridges (that is more of a fat containers thing)
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!