Newt container unable to make connections byound the docker host #844

New Issue

MrUnknownDE · 2026-04-05T17:52:29+02:00

MrUnknownDE commented

2026-04-05 17:52:29 +02:00

Originally created by @corvus-ch on 9/28/2025

I have a strange issue where the newt container is unable to make connections beyond the hosts' boundary.

The leading indicator is, that all DNS lookups fail. Doing some digging with ping, requests to the docker host are successful, while requests to the router are not. Using a different image on the same docker host, works just fine in terms of DNS lookup and network connectivity.

Content of docker-compose.yml:

services:
  newt:
    image: fosrl/newt
    container_name: newt
    restart: unless-stopped
    environment:
      - PANGOLIN_ENDPOINT=https://pangolin.example.com
      - NEWT_ID=…
      - NEWT_SECRET=…
      - DOCKER_SOCKET=/var/run/docker.sock
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

networks:
  default:
    driver: bridge
    name: pangolin

Output of docker-compose logs -f:

newt  | INFO: 2025/09/28 05:10:35 Newt version 1.5.0
newt  | ERROR: 2025/09/28 05:10:43 Error checking for updates: failed to fetch release info: Get "https://api.github.com/repos/fosrl/newt/releases/latest": dial tcp: lookup api.github.com on 127.0.0.11:53: server misbehaving
newt  | ERROR: 2025/09/28 05:10:51 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": dial tcp: lookup pangolin.example.com on 127.0.0.11:53: server misbehaving. Retrying in 3s...
…

Where the last line is repeating over and over again.

Output of docker-compose exec newt ip addr:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0@if27: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP
    link/ether 2a:1d:fd:f5:c9:0f brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0
       valid_lft forever preferred_lft forever

Output of docker-compose exec newt ping -c 1 172.18.0.1:

64 bytes from 172.18.0.1: seq=0 ttl=64 time=0.213 ms

--- 172.18.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.213/0.213/0.213 ms

Output of docker-compose exec newt ping -c 1 172.16.42.147 where 172.16.42.147 is the hosts IP address:

PING 172.16.42.147 (172.16.42.147): 56 data bytes
64 bytes from 172.16.42.147: seq=0 ttl=64 time=0.154 ms

--- 172.16.42.147 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.154/0.154/0.154 ms

Output of docker-compose exec newt ping -c 1 172.16.42.1 where 172.16.42.1 is the routers IP address:

PING 172.16.42.1 (172.16.42.1): 56 data bytes

--- 172.16.42.1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss

However, using another image, pinging the router or even an external site works quite fine.

Output of docker run --rm -it alpine ping -c 1 172.16.42.1

PING 172.16.42.1 (172.16.42.1): 56 data bytes
64 bytes from 172.16.42.1: seq=0 ttl=63 time=1004.398 ms

--- 172.16.42.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 1004.398/1004.398/1004.398 ms

Output of docker run --rm -it alpine ping -c 1 example.com

PING example.com (23.220.75.245): 56 data bytes
64 bytes from 23.220.75.245: seq=0 ttl=38 time=168.658 ms

--- example.com ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 168.658/168.658/168.658 ms

What is preventing the newt image from reaching network nodes beyond the docker host?

Images used:

REPOSITORY   TAG       DIGEST                                                                    IMAGE ID
fosrl/newt   latest    sha256:659c7cefac5e0678d0bf1e87c9b65d1f841ab0ac21e75f9507dfc67a42ef34da   015dfeed2246
alpine       latest    sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1   02f8efbefad6

*Originally created by @corvus-ch on 9/28/2025* I have a strange issue where the newt container is unable to make connections beyond the hosts' boundary. The leading indicator is, that all DNS lookups fail. Doing some digging with ping, requests to the docker host are successful, while requests to the router are not. Using a different image on the same docker host, works just fine in terms of DNS lookup and network connectivity. Content of `docker-compose.yml`: ```yaml services: newt: image: fosrl/newt container_name: newt restart: unless-stopped environment: - PANGOLIN_ENDPOINT=https://pangolin.example.com - NEWT_ID=… - NEWT_SECRET=… - DOCKER_SOCKET=/var/run/docker.sock volumes: - /var/run/docker.sock:/var/run/docker.sock networks: default: driver: bridge name: pangolin ``` Output of `docker-compose logs -f`: ``` newt | INFO: 2025/09/28 05:10:35 Newt version 1.5.0 newt | ERROR: 2025/09/28 05:10:43 Error checking for updates: failed to fetch release info: Get "https://api.github.com/repos/fosrl/newt/releases/latest": dial tcp: lookup api.github.com on 127.0.0.11:53: server misbehaving newt | ERROR: 2025/09/28 05:10:51 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": dial tcp: lookup pangolin.example.com on 127.0.0.11:53: server misbehaving. Retrying in 3s... … ``` Where the last line is repeating over and over again. Output of `docker-compose exec newt ip addr`: ``` 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0@if27: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP link/ether 2a:1d:fd:f5:c9:0f brd ff:ff:ff:ff:ff:ff inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0 valid_lft forever preferred_lft forever ``` Output of `docker-compose exec newt ping -c 1 172.18.0.1`: ```PING 172.18.0.1 (172.18.0.1): 56 data bytes 64 bytes from 172.18.0.1: seq=0 ttl=64 time=0.213 ms --- 172.18.0.1 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max = 0.213/0.213/0.213 ms ``` Output of `docker-compose exec newt ping -c 1 172.16.42.147` where `172.16.42.147` is the hosts IP address: ``` PING 172.16.42.147 (172.16.42.147): 56 data bytes 64 bytes from 172.16.42.147: seq=0 ttl=64 time=0.154 ms --- 172.16.42.147 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max = 0.154/0.154/0.154 ms ``` Output of `docker-compose exec newt ping -c 1 172.16.42.1` where `172.16.42.1` is the routers IP address: ``` PING 172.16.42.1 (172.16.42.1): 56 data bytes --- 172.16.42.1 ping statistics --- 1 packets transmitted, 0 packets received, 100% packet loss ``` However, using another image, pinging the router or even an external site works quite fine. Output of `docker run --rm -it alpine ping -c 1 172.16.42.1` ``` PING 172.16.42.1 (172.16.42.1): 56 data bytes 64 bytes from 172.16.42.1: seq=0 ttl=63 time=1004.398 ms --- 172.16.42.1 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max = 1004.398/1004.398/1004.398 ms ``` Output of `docker run --rm -it alpine ping -c 1 example.com` ``` PING example.com (23.220.75.245): 56 data bytes 64 bytes from 23.220.75.245: seq=0 ttl=38 time=168.658 ms --- example.com ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max = 168.658/168.658/168.658 ms ``` What is preventing the newt image from reaching network nodes beyond the docker host? Images used: ``` REPOSITORY TAG DIGEST IMAGE ID fosrl/newt latest sha256:659c7cefac5e0678d0bf1e87c9b65d1f841ab0ac21e75f9507dfc67a42ef34da 015dfeed2246 alpine latest sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1 02f8efbefad6 ```

MrUnknownDE closed this issue

2026-04-05 17:52:29 +02:00

MrUnknownDE added the stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale labels 2026-04-05 17:52:32 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#844