DNS resolving in network namespace works partially

Help
1

Hello,

I have a service that does the following:

  1. create network namespace called “connect”
  2. move eth1 to this namespace (to be used as LAN interface)
  3. creates Wireguard connection in main namespace, then moves it to “connect”. This Wireguard connection has default route via it. (to be used as WAN)

All good, but resolving in the namespace work partially. For example, nslookup google.com returns results, but curl google.com says the address can’t be resolved. ping can’t resolve as well. If I curl by IP address, for example curl 1.1.1.1. Strace shows lines likes this:

openat(AT_FDCWD, "/nix/store/vvxlkl1hjh8rc3rc6dp9p0pslsm4r9n1-libcap-2.77-lib/lib/glibc-hwcaps/x86-64-v4/libcap.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/nix/store/vvxlkl1hjh8rc3rc6dp9p0pslsm4r9n1-libcap-2.77-lib/lib/glibc-hwcaps/x86-64-v4/", 0x7fff0b34b0b0, 0) = -1 ENOENT (No such file or directory)

but ldd does not show missing files.

I tried same Wireguard config on Debian instance, again in a namespace, and everything is fine.

Anyone ran into this? NixOS 26.05.

Thanks in advance.

2

Further digging shows that curl is trying to use 127.0.0.3 as DNS server, even though /etc/resolv.conf in the namespace points to something else. Maybe inherited from nix-store overlay mount? How can I check this?

4

Thanks for the hint. The namespace has it’s own resolv.conf in /etc/netns/connect/resolv.conf. However, your words about nss made me thought, so I added these lines in the configuration file:

  services.nscd.enable = false;
  system.nssModules = lib.mkForce [];

And now it’s working;)

Thank you again.