DNS service not running on Raspberry Pi 4B

InstantDreams · January 4, 2022, 12:36am

Summary: Both web interface and shell report DNS service is not running.

Logs have been uploaded. Token is: POdxjQNr

System details:

$ hostnamectl
   Static hostname: pihole1
         Icon name: computer
  Operating System: Raspbian GNU/Linux 11 (bullseye)
            Kernel: Linux 5.10.63-v7l+
      Architecture: arm

Configuration summary:

Fresh install of Raspberry Pi OS Lite 5.10
Static IP assigned
Install Docker and Docker-Compose
Set up .env file for container variables in /srv/pihole/ as here:

# User ID and Group ID
PUID=1000
PGID=1000
# Timezone from https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
TZ=America/Edmonton
# Application Details
WEBPASSWORD=[password]
DIRECTORY_PIHOLE=/srv/pihole/etc-pihole/
DIRECTORY_DNSMASQ=/srv/pihole/etc-dnsmasq.d/

Set up docker-compose.yml in /srv/pihole as here:

version: "3"
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    hostname: pihole1
    cap_add:
      - NET_ADMIN
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
      - "8080:80/tcp"
    environment:
      TZ: ${TZ}
      WEBPASSWORD: ${WEBPASSWORD}
    volumes:
      - ${DIRECTORY_PIHOLE}:/etc/pihole/
      - ${DIRECTORY_DNSMASQ}:/etc/dnsmasq.d/
    restart: unless-stopped

Started container with sudo docker-compose up -d

When querying pihole in the docker container I can see that the DNS server won't stay up:

$ sudo docker exec -it pihole bash
root@id-pihole1:/# pihole status
  [✗] DNS service is NOT listening
root@id-pihole1:/# pihole restartdns
  [✓] Restarting DNS server
root@id-pihole1:/# pihole status
  [✗] DNS service is NOT listening

I expect this is because something else is listening on port 53 on the bare metal OS. Netstat indicates that 53 is just bound to docker, so I can't work out the issue:

$ sudo netstat -nltup | grep 'Proto\|:53 \|:67 \|:80 \|:471'
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      879/docker-proxy
tcp6       0      0 :::53                   :::*                    LISTEN      886/docker-proxy
udp        0      0 0.0.0.0:53              0.0.0.0:*                           900/docker-proxy
udp        0      0 0.0.0.0:67              0.0.0.0:*                           859/docker-proxy
udp6       0      0 :::53                   :::*                                908/docker-proxy
udp6       0      0 :::67                   :::*                                865/docker-proxy

I have done a lot of investigation into this and there isn't an easily found solution. I assume I need to disable DNS on my Raspberry Pi so port 53 can be made available to the docker container. According to the Github and Docker readme files, there is a documented method of disabling systemd-resolved but are the instructions here suitable for Raspberry Pi OS? I know both Ubuntu and RPiOS are Debian flavours, but...

Can the support crew have a look at the logs to confirm this, and if so is there a guide to disabling DNS for Raspbian bullseye?

InstantDreams · January 4, 2022, 5:50am

Here's something interesting:

$ netstat -a -t udp -n | grep -w 53
$ sudo docker-compose up -d
Creating network "pihole\_default" with the default driver
Creating pihole ... done 
$ netstat -a -t udp -n | grep -w 53
tcp        0      0 0.0.0.0:53              0.0.0.0:\*               LISTEN
tcp6       0      0 :::53                   :::\*                    LISTEN

So it isn't something on the OS stopping the DNS service port. Curiouser and curiouser.

nzrunner · January 4, 2022, 7:11am

I have the same issue. It appears to have started when I updated to the latest Docker build overnight.

There is an Enable menu option in the web interface. When I press it, the status changes to "Running". But as soon as I refresh the page, the status returns to "DNS is not running".

Mezanine · January 4, 2022, 10:36am

Same issue here, running on ubuntu server 20.04.03.

Docker Tag 2022.01 Pi-hole v5.7 FTL v5.12.1 Web Interface v5.9

Mezanine · January 4, 2022, 12:40pm

github.com/pi-hole/docker-pi-hole

ubuntu/debian: DNS is NOT listening but names are resolved

opened 07:16AM - 03 Jan 22 UTC

edgd1er

This is a: **RUN Issue** with a suggested solution and a workaround ## Details When running on ubuntu 20.04 LTS or debian 10/Buster hosts, `pihole status` returns `DNS is NOT listening`, though names are properly resolved. Only pihole status is improperly detected. ``` root@b5c283006144:/# pihole status [✗] DNS service is NOT listening root@b5c283006144:/# netstat -tplun Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:4711 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.11:35055 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN - tcp6 0 0 :::53 :::* LISTEN - udp 0 0 127.0.0.11:42081 0.0.0.0:* - udp 0 0 0.0.0.0:53 0.0.0.0:* - udp6 0 0 :::53 :::* - root@b5c283006144:/# lsof -Pni:53 root@b5c283006144:/# ``` ## Related Issues - [x] I have searched this repository/Pi-hole forums for existing issues and pull requests that look similar ## How to reproduce the issue 1. Environment data 2. docker-compose.yml contents, docker run shell command, or paste a screenshot of any UI based configuration of containers here use docker-compose-example.yml as exists in project. 3. any additional info to help reproduce open browser at admin page, up left, read dns status. ## These common fixes didn't work for my issue - [x] I have tried removing/destroying my container, and re-creating a new container - [x] I have tried fresh volume data by backing up and moving/removing the old volume data - [x] I have tried running the stock `docker run` example(s) in the readme (removing any customizations I added) - [x] I have tried a newer or older version of Docker Pi-hole (depending what version the issue started in for me) - [x] I have tried running without my volume data mounts to eliminate volumes as the cause If the above debugging / fixes revealed any new information note it here. Add any other debugging steps you've taken or theories on root cause that may help. pihole status is based on lsof -Pni:53's results. For latest os, app armor denies access to ptrace. hence the result of lsof is "". I've found the workaround reading theses: - https://unix.stackexchange.com/questions/136690/how-can-i-substitute-lsof-inside-a-docker-native-not-lxc-based - https://github.com/moby/moby/issues/7276 - https://docs.docker.com/engine/security/apparmor/ Suggestion: - use netstat (net-tools package) to detect opened ports.(may concern pi-hole/pi-hole project, but only needed for docker) Workaround: - start container with SYS_PTRACE capabilities. ``` root@88e3ca25d127:/# pihole status [✓] DNS service is listening [✓] UDP (IPv4) [✓] TCP (IPv4) [✓] UDP (IPv6) [✓] TCP (IPv6) [✓] Pi-hole blocking is enabled root@88e3ca25d127:/# netstat -tplun Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 500/pihole-FTL tcp 0 0 0.0.0.0:4711 0.0.0.0:* LISTEN 500/pihole-FTL tcp 0 0 127.0.0.11:38761 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 487/lighttpd tcp6 0 0 :::53 :::* LISTEN 500/pihole-FTL udp 0 0 127.0.0.11:54280 0.0.0.0:* - udp 0 0 0.0.0.0:53 0.0.0.0:* 500/pihole-FTL udp6 0 0 :::53 :::* 500/pihole-FTL root@88e3ca25d127:/# lsof -Pni:53 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME pihole-FT 500 pihole 4u IPv4 530645587 0t0 UDP *:53 pihole-FT 500 pihole 5u IPv4 530645588 0t0 TCP *:53 (LISTEN) pihole-FT 500 pihole 6u IPv6 530645589 0t0 UDP *:53 pihole-FT 500 pihole 7u IPv6 530645590 0t0 TCP *:53 (LISTEN) ```

Mezanine · January 4, 2022, 12:58pm

"start container with SYS_PTRACE capabilities."

hugalafutro · January 4, 2022, 12:59pm

But the issue is cosmetic only, right? The dns runs the api just isn't picking it up, so if I don't mind that I don't have to give it the sys_ptrace cap if I understand it correctly?

Mezanine · January 4, 2022, 1:02pm

As far as I can tell and on my setup, it's just cosmetic.

joshaspinall · January 4, 2022, 1:32pm

Seen this running on my setup as well (Docker Container). Again so far as I can figure out it is working but the interface is unhappy. Option to re-enable works, but shows as 'DNS service not running' on each page change/refresh.

Docker Tag 2022.01
Pi-hole v5.7
FTL v5.12.1
Web Interface v5.9

Updated to add:

Pinning the docker container version back to 2021.12.1 has resolved the issue for me. I was using latest.

brianjw · January 4, 2022, 1:49pm

Same exact issue after last night's update.

Here is my debug token: TVr7LXhK

Edit: Same as others. Downgrading to 2021.12.1 resolves the issue.

Interloper · January 4, 2022, 9:35pm

First time installer and got the same thing here. Installed on Windows docker'd WSL. Everything seems to be running, but GUI says DNS Service is not running. Bash sudo service pihole-FTL status shows a proper uptime

InstantDreams · January 4, 2022, 9:47pm

This issue is solved by adding the environment variable "DNSMASQ_USER" with the value of "root".

Here is my working docker-compose.yml file as an example:

version: "3"
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    hostname: pihole1
    cap_add:
      - NET_ADMIN
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
      - "8080:80/tcp"
    environment:
      - TZ=${TZ}
      - WEBPASSWORD=${WEBPASSWORD}
      - DNSMASQ_USER=root
    volumes:
      - ${DIRECTORY_PIHOLE}:/etc/pihole/
      - ${DIRECTORY_DNSMASQ}:/etc/dnsmasq.d/
    restart: unless-stopped

I will follow up this post with details of what I did to set up the docker container.

InstantDreams · January 4, 2022, 10:10pm

After my attempt to fix this yesterday my Raspberry Pi 4B was left in an altered state (I had disabled and enabled some system daemons, and messed with some hosts files). I decided to quickly reinstall the image and performed the following steps:

Fresh install of Raspberry Pi OS Lite 5.10
Use sudo raspi-config to set initial configuration
Perform apt-get update and apt-get dist-upgrade
Assign the same static IP to ethernet and wireless adapters
Enable SSH access
Configure shared network folders
Install Docker and Docker-Compose and add user pi to docker admin group
Set up .env file for container variables in /srv/pihole/
Set up docker-compose.yml in /srv/pihole/
Started container with sudo docker-compose up -d

This resulted in the following output from docker-compose logs pihole:

$ docker-compose logs pihole
Attaching to pihole
pihole    | [s6-init] making user provided files available at /var/run/s6/etc...exited 0.
pihole    | [s6-init] ensuring user provided files have correct perms...exited 0.
pihole    | [fix-attrs.d] applying ownership & permissions fixes...
pihole    | [fix-attrs.d] 01-resolver-resolv: applying...
pihole    | [fix-attrs.d] 01-resolver-resolv: exited 1.
pihole    | [fix-attrs.d] done.
pihole    | [cont-init.d] executing container initialization scripts...
pihole    | [cont-init.d] 20-start.sh: executing...
pihole    |  ::: Starting docker specific checks & setup for docker pihole/pihole
pihole    |
pihole    |   [i] Installing configs from /etc/.pihole...
pihole    |   [i] Existing dnsmasq.conf found... it is not a Pi-hole file, leaving alone!
  [✓] Installed /etc/dnsmasq.d/01-pihole.conf
  [✓] Installed /etc/dnsmasq.d/06-rfc6761.conf
pihole    | Existing DNS servers detected in setupVars.conf. Leaving them alone
pihole    | ::: Pre existing WEBPASSWORD found
pihole    | DNSMasq binding to default interface: eth0
pihole    | Added ENV to php:
pihole    |                     "PIHOLE_DOCKER_TAG" => "2022.01",
pihole    |                     "PHP_ERROR_LOG" => "/var/log/lighttpd/error.log",
pihole    |                     "ServerIP" => "0.0.0.0",
pihole    |                     "CORS_HOSTS" => "",
pihole    |                     "VIRTUAL_HOST" => "0.0.0.0",
pihole    | Using IPv4 and IPv6
pihole    | ::: setup_blocklists now setting default blocklists up:
pihole    | ::: TIP: Use a docker volume for /etc/pihole/adlists.list if you want to customize for first boot
pihole    | ::: Blocklists (/etc/pihole/adlists.list) now set to:
pihole    | https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
pihole    | ::: Testing pihole-FTL DNS: FTL started!
pihole    | ::: Testing lighttpd config: Syntax OK
pihole    | ::: All config checks passed, cleared for startup ...
pihole    | ::: Enabling Query Logging
pihole    |   [i] Enabling logging...
  [✓] Logging has been enabled!
pihole    |  ::: Docker start setup complete
pihole    |   Checking if custom gravity.db is set in /etc/pihole/pihole-FTL.conf
pihole    |   Pi-hole version is v5.7 (Latest: v5.7)
pihole    |   AdminLTE version is v5.9 (Latest: v5.9)
pihole    |   FTL version is v5.12.1 (Latest: v5.12.1)
pihole    |   Container tag is: 2022.01
pihole    | [cont-init.d] 20-start.sh: exited 0.
pihole    | [cont-init.d] done.
pihole    | [services.d] starting services
pihole    | Starting lighttpd
pihole    | Starting crond
pihole    | [services.d] done.
pihole    | Starting pihole-FTL (no-daemon) as root

Further confirmation is found by querying the status inside the docker container:

$ sudo docker exec -it pihole bash
root@pihole1:/# pihole status
  [✓] DNS service is listening
     [✓] UDP (IPv4)
     [✓] TCP (IPv4)
     [✓] UDP (IPv6)
     [✓] TCP (IPv6)

  [✓] Pi-hole blocking is enabled

Additionally, the web interface reports that the service is Active, and the "Enable" button disappears.

The use of DNSMASQ_USER fixes this problem but a further question remains - is this to be the expected approach in future and if so, should the docker documentation be updated to reflect this?

yubiuser · January 5, 2022, 5:49am

We are working on a fix already, see this comment:

github.com/pi-hole/docker-pi-hole

Dashboard header reports an incorrect status when running on docker

opened 04:44PM - 21 Dec 20 UTC

closed 09:02AM - 07 Jan 22 UTC

scara

### Versions Running docker tag image `v5.2.1`, `$ docker exec -it pihole pihol…e -v`: - Pi-hole version is v5.2.1 (Latest: v5.2.1) - AdminLTE version is v5.2.1 (Latest: v5.2.1) - FTL version is v5.3.2 (Latest: v5.3.2) ### Platform Running using docker tag image `v5.2.1`, - OS and version: Debian `10.5` - Platform: Docker on Raspberry Pi ### Expected behavior Status in the dashboard should show: "Active" ### Actual behavior / bug Status in the dashboard shows: "DNS service not running" ### Steps to reproduce Steps to reproduce the behavior: 1. Run the default image without adding any additional cap - no DHCP required 1. Point the browser to the web interface Asking for the `pihole status` shows: ```bash $ docker exec -it pihole pihole status [✗] DNS service is NOT listening ``` while if you add the following argument to the `docker run` command, `--cap-add=SYS_PTRACE`, you'll get: ```bash $ docker exec -it pihole pihole status [✓] DNS service is listening [✓] UDP (IPv4) [✓] TCP (IPv4) [✓] UDP (IPv6) [✓] TCP (IPv6) [✓] Pi-hole blocking is enabled ``` This is a regression added w/ https://github.com/pi-hole/pi-hole/commit/6009e869471f7f1da0593d91d82855340c8643b1 since `lsof` requires to read `/proc/*/stat`. See [ptrace(2)](https://man7.org/linux/man-pages/man2/ptrace.2.html). When the cap is there: ```bash $ docker exec -it pihole lsof -Pni:53 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME pihole-FT 835 pihole 4u IPv4 121563 0t0 UDP *:53 pihole-FT 835 pihole 5u IPv4 121564 0t0 TCP *:53 (LISTEN) pihole-FT 835 pihole 6u IPv6 121565 0t0 UDP *:53 pihole-FT 835 pihole 7u IPv6 121566 0t0 TCP *:53 (LISTEN) ``` Shortly: `lsof` is not Docker friendly unless using `CAP_SYS_PTRACE`. I'm not sure if the fix here is just to make a clear mention of the new cap requirement in the README or to find another way to provide that beautiful report. HTH, Matteo

InstantDreams · January 6, 2022, 2:11pm

Thank you for confirming this. I will remove the DNSMASQ_USER entry from my docker-compose file, pull the latest version, and see if it works.

InstantDreams · January 6, 2022, 2:15pm

Confirming that this fixed the issue, thank you Pi-hole team!