podman pull ends with error Temporary failure in name resolution

[LadislavPataki]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

On Windows I'm trying to use for instance podman pull alpine:latest, but I'm getting an error.

Steps to reproduce the issue:

1. Run podman pull alpine:latest

Describe the results you received:

Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/alpine:latest...
Error: initializing source docker://alpine:latest: pinging container registry registry-1.docker.io: Get "https://registry-1.docker.io/v2/": dial tcp: lookup registry-1.docker.io: Temporary failure in name resolution

Describe the results you expected:

Image downloaded

Additional information you deem important (e.g. issue happens only occasionally):

Output of podman version:

podman version
Client:       Podman Engine
Version:      4.3.0
API Version:  4.3.0
Go Version:   go1.18.7
Git Commit:   ad42af94903ce4f3c3cd0693e4e17e4286bf094b
Built:        Wed Oct 19 19:53:21 2022
OS/Arch:      windows/amd64

Server:       Podman Engine
Version:      4.3.1
API Version:  4.3.1
Go Version:   go1.18.7
Built:        Fri Nov 11 16:24:13 2022
OS/Arch:      linux/amd64

Output of podman info:

podman info
host:
  arch: amd64
  buildahVersion: 1.28.0
  cgroupControllers: []
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: conmon-2.1.5-1.fc36.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.5, commit: '
  cpuUtilization:
    idlePercent: 99.91
    systemPercent: 0.07
    userPercent: 0.02
  cpus: 8
  distribution:
    distribution: fedora
    variant: container
    version: "36"
  eventLogger: journald
  hostname: TAG-1302
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 5.10.102.1-microsoft-standard-WSL2
  linkmode: dynamic
  logDriver: journald
  memFree: 16110923776
  memTotal: 16641990656
  networkBackend: netavark
  ociRuntime:
    name: crun
    package: crun-1.7-1.fc36.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.7
      commit: 40d996ea8a827981895ce22886a9bac367f87264
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +WASM:wasmedge +YAJL
  os: linux
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.0-0.2.beta.0.fc36.x86_64
    version: |-
      slirp4netns version 1.2.0-beta.0
      commit: 477db14a24ff1a3de3a705e51ca2c4c1fe3dda64
      libslirp: 4.6.1
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.3
  swapFree: 4294967296
  swapTotal: 4294967296
  uptime: 1h 6m 57.00s (Approximately 0.04 days)
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /home/user/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/user/.local/share/containers/storage
  graphRootAllocated: 269490393088
  graphRootUsed: 391090176
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 0
  runRoot: /run/user/1000/containers
  volumePath: /home/user/.local/share/containers/storage/volumes
version:
  APIVersion: 4.3.1
  Built: 1668180253
  BuiltTime: Fri Nov 11 16:24:13 2022
  GitCommit: ""
  GoVersion: go1.18.7
  Os: linux
  OsArch: linux/amd64
  Version: 4.3.1

Package info (e.g. output of rpm -q podman or apt list podman or brew info podman):

(paste your output here)

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide?

Yes

Additional environment details (AWS, VirtualBox, physical, etc.):
latest Windows 11

[mheon]

Can you ping registry-1.docker.io from WSL?

[LadislavPataki]

When I run command $ ping I get -bash: ping: command not found. I'm using podman-machine-default. Can you help me with that? I've tried to install it, but I wasn't able to connect to internet. Could you help me with that?

[Ton-Pe]

Are you still struggling with this? I had the same problem with resoving the host name and it turned out that podman machine had it's local ip-address as a name server. This discussion https://superuser.com/a/1723529 helped me to solve this. Hope that will help you also, if you still have the problem.

[lleongl]

I fixed it using the following 4 commands:

• wsl -d podman-machine-default
• sudo tee /etc/wsl.conf << EOF
  [network]
  generateResolvConf = false
  EOF
• sudo rm -rf /etc/resolv.conf
• echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf

[shayegh]

How we could do this permanently? each time I restart my system I should run this again.

[mavaddat]

None of the WSL DNS patching methods worked for me. I finally had to resort to using https://github.com/sakai135/wsl-vpnkit to get my podman working.

Field	Value
WSL version	1.2.5.0
Kernel version	5.15.90.1
WSLg version	1.0.51
MSRDC version	1.2.3770
Direct3D version	1.608.2-61064218
DXCore version	10.0.25131.1002-220531-1700.rs-onecore-base2-hyp
Windows version	10.0.19044.2965
OS Name	Microsoft Windows 10 Enterprise
OS Version	10.0.19044 N/A Build 19044
OS Manufacturer	Microsoft Corporation
OS Configuration	Member Workstation
OS Build Type	Multiprocessor Free

[damanjitsingh]

This should be a bug. I still see this and the solution suggested above (about editing wsl.conf file) did not work for me.

[damanjitsingh]

Yeah I am not running 4.6. Infact my version is 4.5.1. I will update and try the workaround. Thanks.

[danielrotaermel]

unfortunately podman machine init --user-mode-networking does not work when enterprise it blocks the windows store

[mavaddat]

@danielrotaermel The initialization can work if you have local admin rights. My IT blocks Windows Store on my work laptop and I was able.

Just use winget to automate an install from the Windows Store first (e.g., enable wsl and install Ubuntu).

Screenshots

[n1hility]

@danielrotaermel there is an option to the wsl command that you can use to pull outside of the windows store:

wsl --update --web-download

That said, in addition to the policy setting that disables usage of the store, there is another (less common but still sometimes used) setting that also disallows the running WSL store apps(even when fetched from a different channel). While the above option will workaround the policy disable fetching from the store, it won't address the policy setting that disables store apps altogether. If that latter one also happens you will need to contact your IT dept to get the runtime setting changed.

[danielrotaermel]

thanks for the quick response @mavaddat and @n1hility. I actually needed an option without admin rights. wsl --update --web-download works great!

[arifcse019]

I faced the same issue while using podman on Mac. The steps I took to resolve the problem are almost same as above with only one additional step.

`% podman machine ssh

$ sudo mv /etc/resolv.conf ./

$ echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf`

[n1hility]

This shouldn't be necessary on Mac since, barring some sort of bug, since DNS is forwarded to your Mac's DNS resolver as other mac processes would. For example, if your mac is using 1.1.1.1, podman machine will also route to 1.1.1.1 without a resolv conf setting.

[rodrigomeireles]

Even with wsl --update --web-download and then ´podman machine init --user-mode-networking, I still get the same error in Win11 WSL2.

[mavaddat]

@rodrigomeireles Are you trying from behind a corporate proxy? VPN? Are you able to apt update && apt upgrade -y from wsl? What else have you tried for podman?

[rodrigomeireles]

@rodrigomeireles Are you trying from behind a corporate proxy? VPN? Are you able to apt update && apt upgrade -y from wsl? What else have you tried for podman?

I am behind corporate proxy. I've managed to make it work by adding our proxy settings in the podman desktop app, specifically "Bypass proxy settings for these hosts and domains".

Edit: for completion, how can one bypass hosts/domains via CLI podman?

[n1hility]

Are you referring to using the CLI to start and stop your podman machine instances (e.g. podman machine start)? If so, podman machine start looks at the env vars on the current console session (HTTP_PROXY, HTTPS_PROXY, and NO_PROXY). NO_PROXY would map to the bypass hosts/domains settings value. So, for example, in powershell you would set HTTP proxy like so:

# Send all HTTP traffic to server running on myproxy.corp.domain on port 1234 using plain http
$Env:HTTP_PROXY="http://myproxy.corp.com:1234"
# Exclude every dns name from the proxy that ends with .corp.com
$Env:NO_PROXY=".corp.com"
podman machine start

Podman machine snapshots these values on start, for every occurrence, so to change them you need to stop then start, and they aren't present on a subsequent start it will run without a proxy config. In the Desktop app it manages this for you.

[arvinddubey]

I had same issue and after many search I found solution and ran podman command with --tls-verify=false option. Below is the example
podman run --tls-verify=false -dt -e ADV_HOST=127.0.0.1 landoop/fast-data-dev

[n1hility]

Note that as an alternative to disabling verification you can get certs that aren’t signed by a global trusted root CA (sometimes the case in Corp envs) to work by adding the respective Corp CA cert as a trusted cert on your machine instance. To do that you can podman machine ssh (or wsl -d podman-machine-default) and then follow the Fedora instructions for adding a cert.

[jodyhoonstarr]

We encountered this issue from within a Windows corporate environment where access to the microsoft apps store is disabled. A clever IT admin figured out that following the default WSL install steps (wsl --install --web-download) and podman windows apps resulted in the reported Temporary failure in name resolution issue here.

To make it function we needed the WSL Application that provides WSL Settings options:

Which provides the mirrored networking mode:

If you go into your start menu and the WSL icon is a black penguin then you'll want to figure out how to install the WSL app with the blue penguin. Once this app is installed the mirrored networking mode fixes the DNS issue.

Short version: In windows, if your wsl icon is a black penguin, figure out how to install this app in your corporate environment.