Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS resolution issue in Alpine Linux (2021)

christoph.luppri.ch

Post reply on HN
Print view View original

21–30 of 61 posts

Re: DNS resolution issue in Alpine Linux (2021)

#21

Post by rascul »

nwmcsween wrote: post #17
tptacek wrote: post #9

Earlier quoted context omitted.

They know about it! I could write the patch, but they're not going to accept it; there's something weird going on about this.

There isn't anything weird, I went on #musl asked the question, the functionality is desired but it should be worked with the community to ensure correctness.

The functionality was explicitly not added by the developer.

> My choice not to do TCP in musl's stub resolver was based on an interpretation that truncated results are not just acceptable but better ux - not only do you save major round-trip delays to DNS but you also get a reasonable upper bound on # of addrs in result.

https://twitter.com/RichFelker/status/994629795551031296

Maybe he is willing to consider it now, I don't know.

Re: DNS resolution issue in Alpine Linux (2021)

#22

Post by zamadatix »

34tlkjlaegrlk wrote: post #8
tptacek wrote: post #5

Earlier quoted context omitted.

It's not just "robustness". Not supporting TCP DNS breaks DNS if your responses are "large", for values of "large" that include numbers that are in fact very small.

largest safe size to use is ~548 bytes - anything more than that and you need tcp

Or, as the article says, EDNS.

Re: DNS resolution issue in Alpine Linux (2021)

#23

Post by tptacek »

nwmcsween wrote: post #17
tptacek wrote: post #9

Earlier quoted context omitted.

They know about it! I could write the patch, but they're not going to accept it; there's something weird going on about this.

There isn't anything weird, I went on #musl asked the question, the functionality is desired but it should be worked with the community to ensure correctness.

Yes, there is. I'm not just making this up. I've gotten takes from "musl people", including Rich Felker, that this was a deliberate choice, and that not only is musl's behavior of pretending that truncated UDP responses are valid acceptable, but that it's somehow better (maybe for performance?) --- that you can always serve "getaddrinfo" off of just the truncated UDP result. Which is, of course, false.

There is a weird thing going on; maybe you can relay this back to the #musl channel you're talking on, and they can keep discussing.

Re: DNS resolution issue in Alpine Linux (2021)

#24

Post by zamadatix »

blueflow wrote: post #3
rascul wrote: post #2

TLDR: The solution to an intentionally broken resolver is to use a third party library.

Its only broken if you dont consider robustness a feature.

Things can be broken in more than one way not just solely when the thing broken is robustness (for some value of robust).

Re: DNS resolution issue in Alpine Linux (2021)

#25

Post by cmeacham98 »

toast0 wrote: post #13
tptacek wrote: post #4

We're a somewhat popular hosting provider that runs Docker containers (as VMs) for our customers and does private networking over IPv6, which expands the size of our DNS requests, and we run into this all the time with Alpine. It's kind of baffling. TCP DNS is not hard. It's part of the spec. Normally, that argument doesn't mean much to me --- lots of things are parts of specs that I think are silly and not worth doi…

I mean sure, musl should add TCP DNS. But real world networking says if your DNS response is over the limit for basic UDP DNS, a meaningful proportion of clients won't get that response. Which I guess is okish if it's a TXT for mail servers, cause mail servers probably have a reasonable DNS setup; but if you wanted to return a lot of A records or AAAA records (or A records that a provider DNS64s into AAAA records), y…

This is literally the opposite of true. The OS-supplied resolver supports TCP DNS on all of the most popular desktop and mobile OSes and has for ages. I'd estimate a minimum of 90% of users have setups that support it, and I'm only hedging the 10% because I'm not sure how prevalent horribly misconfigured corporate firewalls are.

By not supporting TCP DNS you are the odd one out.

Re: DNS resolution issue in Alpine Linux (2021)

#26

Post by toast0 »

cmeacham98 wrote: post #25
toast0 wrote: post #13

Earlier quoted context omitted.

I mean sure, musl should add TCP DNS. But real world networking says if your DNS response is over the limit for basic UDP DNS, a meaningful proportion of clients won't get that response. Which I guess is okish if it's a TXT for mail servers, cause mail servers probably have a reasonable DNS setup; but if you wanted to return a lot of A records or AAAA records (or A records that a provider DNS64s into AAAA records), y…

This is literally the opposite of true. The OS-supplied resolver supports TCP DNS on all of the most popular desktop and mobile OSes and has for ages. I'd estimate a minimum of 90% of users have setups that support it, and I'm only hedging the 10% because I'm not sure how prevalent horribly misconfigured corporate firewalls are. By not supporting TCP DNS you are the odd one out.

The OS supplied resolver may support it, but many networks block TCP DNS.

Re: DNS resolution issue in Alpine Linux (2021)

#27

Post by qbasic_forever »

blueflow wrote: post #10
traceroute66 wrote: post #6

The moment I saw Alpine Linux in the title, my first guess was "I bet this is something to do with musl libc". Briefly looking through the blog, it looks like my gut feeling was correct. A while ago I evaluated Alpine Linux. I wanted to like it, I really did, it ticked so many boxes. But time and time again, I kept on running into issues with their adoption of musl libc. The last straw for me was when I discovered pa…

"you're on your own" is like, the expected thing when you are doing something different. Still, Alpine is on top of everyone else when it comes to Docker Images sizes. Thats why it will stick.

If you care about image size you need to switch to a distroless image base. It's incredibly easy nowadays with multi-stage builds. IMHO people use alpine not because they seek it out but because they're reading old guides and advice that hasn't been updated with the times.

Blindly switching to alpine to save space is opening yourself up to exactly these sorts of musl-libc quirks and issues--you better have solid test coverage and a plan to make sure there aren't unexpected edge cases.

Re: DNS resolution issue in Alpine Linux (2021)

#28

Post by tptacek »

toast0 wrote: post #26
cmeacham98 wrote: post #25

Earlier quoted context omitted.

This is literally the opposite of true. The OS-supplied resolver supports TCP DNS on all of the most popular desktop and mobile OSes and has for ages. I'd estimate a minimum of 90% of users have setups that support it, and I'm only hedging the 10% because I'm not sure how prevalent horribly misconfigured corporate firewalls are. By not supporting TCP DNS you are the odd one out.

The OS supplied resolver may support it, but many networks block TCP DNS.

Many networks also block AAAA DNS, because middleboxes are stupid. That doesn't mean it's OK for libc not to implement AAAA.

Re: DNS resolution issue in Alpine Linux (2021)

#29

Post by sciurus »

blueflow wrote: post #10
traceroute66 wrote: post #6

The moment I saw Alpine Linux in the title, my first guess was "I bet this is something to do with musl libc". Briefly looking through the blog, it looks like my gut feeling was correct. A while ago I evaluated Alpine Linux. I wanted to like it, I really did, it ticked so many boxes. But time and time again, I kept on running into issues with their adoption of musl libc. The last straw for me was when I discovered pa…

"you're on your own" is like, the expected thing when you are doing something different. Still, Alpine is on top of everyone else when it comes to Docker Images sizes. Thats why it will stick.

Are they still on to of everyone else in a meaningful way, though?

There was discussion yesterday [0] that pointed out that there are 29MB Debian [1] and Ubuntu [2] images.

[0] https://news.ycombinator.com/item?id=30633670

[1] https://hub.docker.com/layers/debian/library/debian/stable-s...

[2] https://ubuntu.com/blog/minimal-ubuntu-released

Post reply on HN