3 ms·
Alpine's DNS resolver behaves differently than glibc (in particular it ignores the `ndots` option) which can lead to DNS query amplification. In Kubernetes clus
by otterley 6y ago
Alpine's DNS resolver behaves differently than glibc (in particular it ignores the `ndots` option) which can lead to DNS query amplification. In Kubernetes clusters this can be taxing on the kube-dns service and lead to cluster reliability issues around DNS lookups.
- efrecon 6y agoThat sounds like a bug that should be reported to the alpine docker image maintainers. If not already that is...
- otterley 6y agoCorrecting myself above: This is not the problem; the problem is that musl-libc (1) does parallel queries which can be problematic under certain circumstances; and (2) handles NXDOMAIN/NODATA responses differently than glibc does which can lead to DNS resolution failures that wouldn't happen otherwise. There's a workaround to set `ndots:1` but that causes other problems with musl since it doesn't append search domains on retries. It's just a big mess. There's big discussion of it here: https://github.com/kubernetes/kubernetes/issues/33554 https://github.com/kubernetes/kubernetes/issues/33554