Docker apt-get update fails

Question

Can somebody help me get apt-get working in my docker container? Whenever I try running any apt-get command in my docker container, the command fails. I'm running Docker version 1.1.1, build bd609d2 on ubuntu 12.04.

When I do

$ sudo docker run -i -t ubuntu:14.04 /bin/bash
# apt-get update

I get errors saying

Could not resolve 'archive.ubuntu.com'

I tried uncommenting the line below in /etc/default/docker

DOCKER_OPTS="--dns 8.8.8.8 --dns 8.8.4.4"

but I still can't ping google.com

ping: unknown host

I confirmed that the container is using the dns servers 8.8.8.8 and 8.8.4.4

root@0baa87fc6322:/# cat /etc/resolv.conf

nameserver 8.8.8.8

nameserver 8.8.4.4

and I'm able to ping both servers so I'm pretty sure that a firewall isn't just dropping my packets.

Any help with this would be appreciated!

Thanks!

Answer 1

Thanks for all your help! I found out it was a dns problem and that it was because of a firewall. After searching some more I found this question that I wasn't able to find while searching 'docker apt-get fail'

Docker - Network calls fail during image build on corporate network

His problem was similar to mine and the solution helped me get it working. I've copied over his solution for anybody that finds this question in the future.

Those Google servers weren't accessible from behind our firewall, which is why we couldn't resolve any URLs.

The fix is to tell Docker which DNS servers to use. This fix depends on how you installed Docker: Ubuntu Package

If you have the Ubuntu package installed, edit /etc/default/docker and add the following line:

DOCKER_OPTS="--dns <your_dns_server_1> --dns <your_dns_server_2>"

You can add as many DNS servers as you want to this config. Once you've edited this file you'll want to restart your Docker service:

sudo service docker restart

Binaries

If you've installed Docker via the binaries method (i.e. no package), then you set the DNS servers when you start the Docker daemon:

sudo docker -d -D --dns --dns &

Answer 2

If you see an error like Could not resolve ..., it is likely a DNS configuration.

First thing to check is run cat /etc/resolv.conf in the docker container. If it has an invalid DNS server, such as nameserver 127.0.x.x, then the container will not be able to resolve the domain names into ip addresses, so ping google.com will fail.

Second thing to check is run cat /etc/resolv.conf on the host machine. Docker basically copies the host's /etc/resolv.conf to the container everytime a container is started. So if the host's /etc/resolv.conf is wrong, then so will the docker container.

If you have found that the host's /etc/resolv.conf is wrong, then you have 2 options:

1. Hardcode the DNS server in daemon.json. This is easy, but not ideal if you expect the DNS server to change.

2. Fix the hosts's /etc/resolv.conf. This is a little trickier, but it is generated dynamically, and you are not hardcoding the DNS server.

---

1. Hardcode DNS server in docker daemon.json

• Edit /etc/docker/daemon.json

  {
      "dns": ["10.1.2.3", "8.8.8.8"]
  }
  

• Restart the docker daemon for those changes to take effect:
  sudo systemctl restart docker

• Now when you run/start a container, docker will populate /etc/resolv.conf with the values from daemon.json.

---

2. Fix the hosts's /etc/resolv.conf

A. Ubuntu 16.04 and earlier

• For Ubuntu 16.04 and earlier, /etc/resolv.conf was dynamically generated by NetworkManager.

• Comment out the line dns=dnsmasq (with a #) in /etc/NetworkManager/NetworkManager.conf

• Restart the NetworkManager to regenerate /etc/resolv.conf :
  sudo systemctl restart network-manager

• Verify on the host: cat /etc/resolv.conf

B. Ubuntu 18.04 and later

• Ubuntu 18.04 changed to use systemd-resolved to generate /etc/resolv.conf. Now by default it uses a local DNS cache 127.0.0.53. That will not work inside a container, so Docker will default to Google's 8.8.8.8 DNS server, which may break for people behind a firewall.

• /etc/resolv.conf is actually a symlink (ls -l /etc/resolv.conf) which points to /run/systemd/resolve/stub-resolv.conf (127.0.0.53) by default in Ubuntu 18.04.

• Just change the symlink to point to /run/systemd/resolve/resolv.conf, which lists the real DNS servers:
  sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

• Verify on the host: cat /etc/resolv.conf

Now you should have a valid /etc/resolv.conf on the host for docker to copy into the containers.

Answer 3

$ sudo docker run -i -t --net=host ubuntu /bin/bash
# apt-get update

No errors! - Note the added --net=host.

---

Below I show how to reproduce the error.
I did the following on a clean machine having nothing but Ubuntu 18.04 installed on it.

First install docker. Copy-paste one line at a time and hit Enter after each line:

sudo apt update                         # took 11 seconds for me
sudo apt install -y apt-transport-https ca-certificates \
curl software-properties-common

The second of the two commands above (one command broken up on two lines) is optional and took ~20 seconds for me.

echo "cacert=/etc/ssl/certs/ca-certificates.crt" >> ~/.curlrc
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
| sudo apt-key add -

sudo add-apt-repository "deb [arch=amd64] https://\
download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

The command above took ~7 seconds for me.

sudo apt update                         # ~3 seconds this time
sudo apt install -y docker-ce           # ~1 minute for me

Optional -- if you don't like to prefix docker with sudo every time:

sudo usermod -aG docker ${USER}

Log out and back in.
Confirm that docker is now added to your groups:

id -nG

---

Now to the core part of interest:

$ sudo docker run -it ubuntu /bin/bash  # ~10 seconds for me
# apt update                            # first Err after ~1 minute
Err:1 http://archive.ubuntu.com/ubuntu focal InRelease
  Connection failed [IP: 91.189.88.152 80]
Err:2 http://security.ubuntu.com/ubuntu focal-security InRelease
  Connection failed [IP: 91.189.88.152 80]
Err:3 http://archive.ubuntu.com/ubuntu focal-updates InRelease
  Connection failed [IP: 91.189.88.152 80]
Err:4 http://archive.ubuntu.com/ubuntu focal-backports InRelease
  Connection failed [IP: 91.189.88.152 80]
...
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal/InRelease [...]
...
W: Some index files failed to download. They have been ignored, [...]

Note how I just recreated the error described by the OP!
The OP got Could not resolve 'archive.ubuntu.com',
while I got Failed to fetch http://archive.ubuntu.com.
But the root cause is the same: the docker container has no access to the internet.

I don't want to stay in this bad docker container so I hit Ctrl + D.
No wish to keep it either, so I do:

sudo docker container ps -a

which tells me that the CONTAINER ID in my case is c05ec98236f0.

I remove this container:

sudo docker container rm c05ec98236f0

Heads up for something that doesn't give me an error.

$ sudo docker run -it --net=host ubuntu bash
# apt update                            # ~7 seconds
Get:1 http://archive.ubuntu.com/ubuntu focal InRelease [265 kB]
...
Fetched 16.4 MB in 4s (4332 kB/s)
Reading package lists... Done
Building dependency tree
Reading state information... Done
3 packages can be upgraded. Run 'apt list --upgradable' to see them.

Voilà! No error!

References:
https://askubuntu.com/questions/1162163#1162198
https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-ubuntu-18-04
https://stackoverflow.com/questions/3160909#31424970
https://stackoverflow.com/questions/43316376#43317607

Answer 4

First check if you have connection, ping directly to ip 91.189.92.201 that archive.ubuntu.com is pointed to:

ping 91.189.92.201

If you still can't reach the host it's not a dns problem.

Also if you have internet connection, you can make a hack. Just put a row into /etc/hosts file and problem solved:

91.189.92.201 archive.ubuntu.com