Olm in docker does not override DNS

[JobDoesburg]

Describe the Bug

I run Olm in docker on some of my machines with network_mode host. However, this doesnt properly override DNS

services:
  olm:
    image: fosrl/olm:1.2.0
    container_name: olm
    restart: unless-stopped
    network_mode: host
    environment:
      - PANGOLIN_ENDPOINT=${PANGOLIN_ENDPOINT}
      - OLM_ID=${OLM_ID}
      - OLM_SECRET=${OLM_SECRET}
      - OVERRIDE_DNS=true
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    devices:
      - /dev/net/tun:/dev/net/tun

Environment

• OS Type & Version: Ubuntu 22.04
• Pangolin Version: 1.13
• Gerbil Version: 1.3.0
• Traefik Version: v3.6.4
• Newt Version: 1.7.0
• Olm Version: 1.2.0

To Reproduce

Run olm in docker as shown above.
Then try to resolve an internal DNS alias on the host machine.

Expected Behavior

Resolving should work

[JobDoesburg]

I do get

INFO: 2025/12/12 09:43:38 DNS proxy started on 100.96.128.1:53
INFO: 2025/12/12 09:43:38 Detected DNS manager: file
INFO: 2025/12/12 09:43:38 Using file-based DNS configurator
INFO: 2025/12/12 09:43:38 Current DNS servers: [127.0.0.53]
INFO: 2025/12/12 09:43:38 Setting DNS servers to: [100.96.128.1]
INFO: 2025/12/12 09:43:38 Original DNS servers backed up: [127.0.0.53]

but still

; <<>> DiG 9.18.39-0ubuntu0.24.04.2-Ubuntu <<>> erasmus.nolai.internal
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 51330
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;erasmus.nolai.internal.		IN	A

;; AUTHORITY SECTION:
.			67674	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2025121200 1800 900 604800 86400

;; Query time: 1 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Fri Dec 12 11:36:58 UTC 2025
;; MSG SIZE  rcvd: 126

What does work is if I specify the internal DNS server directly

; <<>> DiG 9.18.39-0ubuntu0.24.04.2-Ubuntu <<>> @100.96.128.1 erasmus.nolai.internal
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17237
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;erasmus.nolai.internal.		IN	A

;; ANSWER SECTION:
erasmus.nolai.internal.	300	IN	A	100.96.128.8

;; Query time: 2 msec
;; SERVER: 100.96.128.1#53(100.96.128.1) (UDP)
;; WHEN: Fri Dec 12 11:38:04 UTC 2025
;; MSG SIZE  rcvd: 78

But I want the Olm container to override this for the host

[oschwartz10612]

Hi! Thanks for testing the new functionality! If you resolve the dns from within the container does it work? You could try apk add bind-tools dig erasmus.nolai.internal Also, what DNS service is running on the host? Is it resolvconf, systemd-resolved, or networkmanager?

[JobDoesburg]

Im using systemd-resolved...

Surprisingly, from within the container it also doesnt work

[JobDoesburg]

Nvm, if I run with OVERRIDE_DNS=true in the container it does resolve properly.
Now I'm struggling how to instruct my host to use the proper resolver by default too

[JobDoesburg]

I found a solution. I added a file to /etc/systemd/network/50-olm.network on the host containing

[Match]
Name=olm

[Link]
RequiredForOnline=no

[Network]
DNS=100.96.128.1
Domains=~nolai.internal
ConfigureWithoutCarrier=yes
KeepConfiguration=yes

Would be interesting to document this or give other instructions how to get this to work with olm in a docker container

[oschwartz10612]

Ahh damn I dont know my own software! Ha! Sorry I should have warned you about override dns. For olm thats off by default. I assume this has to do with docker isolating the resolve.conf from the host as well as it not detecting resolved inside of the container despite being in the host stack. I am not sure due to docker there is a great universal solution for this one. I can put some notes in the docs and include this for resolved.

[JobDoesburg]

👍 sounds like a solution

I have thought about running the olm container without network mode host, but on a specific docker network shared with another specific container that needed it. But I didnt get that to work. Anyhow, it would be nice to document the recommended use cases for Olm in a docker container, because there are some interesting docker networking quirks about it that you otherwise typically wouldn't come across.