docker - Docker 容器中的 Pihole 和 Unbound - Unbound 不接收请求

我正在尝试在 Raspberry pi 3 上运行 2 个 Docker 容器，一个用于 Unbound，另一个用于 Pihole。这个想法是 Pihole 将在使用 Unbound 作为其 DNS 服务器之前首先阻止任何请求。我一直在关注 Pihole 的文档以使其运行，发现 here 并已启动两个容器，并且 pihole 工作。但是，当运行 docker exec pihole dig pi-hole.net @127.0.0.1 -p 5333 或 -p 5354 时，我得到了响应

; <<>> DiG 9.10.3-P4-Debian <<>> pi-hole.net @127.0.0.1 -p 5354
;; global options: +cmd
;; connection timed out; no servers could be reached

我推测这可能与 pihole 容器无法通过 localhost 与 Unbound 容器通信有关，因此更新了我的 docker-compose 以尝试使用 netowkr 桥更正此问题。但是在那之后，无论我尝试什么端口，我仍然遇到相同的错误。我是新的 Docker 和 Unbound，所以这已经有点深入了!我的 docker-compose.yml 和 unbound.conf 在下面。

docker-compose.yml

version: "3.7"

services:
  unbound:
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    container_name: unbound
    image: masnathan/unbound-arm
    ports:
      - 8953:8953/tcp
      - 5354:53/udp
      - 5354:53/tcp
      - 5333:5333/udp
      - 5333:5333/tcp
    volumes:
      - ./config/unbound.conf:/etc/unbound/unbound.conf
      - ./config/root.hints:/var/unbound/etc/root.hints
    restart: always
    networks:
      - unbound-pihole
  pihole:
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - 53:53/udp
      - 53:53/tcp
      - 67:67/udp
      - 80:80
      - 443:443
    volumes:
      - ./config/pihole/:/etc/pihole/
    environment:
      - ServerIP=10.0.0.20
      - TZ=UTC
      - WEBPASSWORD=random
      - DNS1=127.0.0.1#5333
      - DNS2=no
    restart: always
    networks:
      - unbound-pihole

networks:
  unbound-pihole:
    driver: bridge

未绑定(bind)配置文件

server:
# If no logfile is specified, syslog is used
# logfile: "/var/log/unbound/unbound.log"
verbosity: 0

port: 5333
do-ip4: yes
do-udp: yes
do-tcp: yes

# May be set to yes if you have IPv6 connectivity
do-ip6: no

# Use this only when you downloaded the list of primary root servers!
root-hints: "/var/unbound/etc/root.hints"

# Trust glue only if it is within the servers authority
harden-glue: yes

# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
harden-dnssec-stripped: yes

# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
use-caps-for-id: no

# Reduce EDNS reassembly buffer size.
# Suggested by the unbound man page to reduce fragmentation reassembly problems
edns-buffer-size: 1472

# TTL bounds for cache
cache-min-ttl: 3600
cache-max-ttl: 86400

# Perform prefetching of close to expired message cache entries
# This only applies to domains that have been frequently queried
prefetch: yes

# One thread should be sufficient, can be increased on beefy machines
num-threads: 1

# Ensure kernel buffer is large enough to not loose messages in traffic spikes
so-rcvbuf: 1m

# Ensure privacy of local IP ranges
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10

谢谢!

最佳答案

来自 access-control section 下的文档 https://nlnetlabs.nl/documentation/unbound/unbound.conf/ :

  By default only localhost is allowed, the rest is refused.   The
  is  refused, because that is protocol-friendly. The DNS
  protocol is not designed to handle dropped packets due  to  pol-
  icy,  and  dropping  may  result in (possibly excessive) retried
  queries.

未绑定(bind)的服务器，默认情况下仅监听来自 localhost 的连接。在这种情况下，可以允许从未绑定(bind)运行的 docker 容器内部接受对 DNS 服务器的请求。

因此，为了让 docker-compose 中的 unbound 能够解析 DNS，在 unbound.conf 中添加以下内容

server:
   access-control: 0.0.0.0/0 allow

关于docker - Docker 容器中的 Pihole 和 Unbound - Unbound 不接收请求，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/54066522/