Docker Swarm服务名DNS解析失败，虚拟IP/任务IP正常，如何排查？

简言之，在与nginx服务同栈的服务容器内执行以下操作：

nslookup nginx          # 返回nginx服务的虚拟IP
nslookup tasks.nginx    # 返回nginx容器的正确IP（10.0.17.20）
ping 10.0.17.20         # 此命令正常执行
ping nginx              # 执行失败
curl http://10.0.17.20  # 此命令正常执行
curl http://nginx       # 执行失败

但curl http://tasks.nginx可正常解析并访问。

在Docker Swarm环境中，容器内通过服务名进行DNS解析后无法访问对应服务，但直接使用服务虚拟IP或任务IP可正常访问。示例栈配置如下：

version: "3.9"

networks:
  elk7:
    name: elk7
    driver: overlay
    attachable: true
    ipam:
      driver: default
      config:
        - subnet: "10.0.17.0/24"

services:
  setup:
    ...
    networks:
      - elk7

  es01: # 部署在管理节点1
    ...
    networks:
      - elk7

  # ... es02/es03等服务

  nginx: # 部署在管理节点2
    ...
    networks:
      - elk7

执行docker network inspect elk7显示该节点存在es01服务的容器（推测仅能看到当前节点的容器）：

"9c1a019a5c83c466615819b5401bbb0e58c31f078a96f13ed4af3905c837d565": {
    "Name": "elk7_es01.1.meux9ctcmnfwdejiqmxftyeq8",
    "EndpointID": "e0b102827e93eb3d0439513778c308eeb1201cd1e8e252f1361692c2f9981cc5",
    "MacAddress": "02:42:0a:00:11:11",
    "IPv4Address": "10.0.17.17/24",
    "IPv6Address": ""
},

IPAM配置信息如下：

"IPAM": {
    "Driver": "default",
    "Options": null,
    "Config": [
        {
            "Subnet": "10.0.17.0/24",
            "Gateway": "10.0.17.1"
        }
    ]
},

进入Nginx容器（docker container exec -it <container id> bash）后，无法通过服务名es01访问该服务，但直接使用IP地址可正常访问：

root@2d6f42945a18:/# ping es01
PING es01 (10.0.17.16) 56(84) bytes of data.
From 2d6f42945a18 (10.0.17.20) icmp_seq=1 Destination Host Unreachable
From 2d6f42945a18 (10.0.17.20) icmp_seq=2 Destination Host Unreachable
From 2d6f42945a18 (10.0.17.20) icmp_seq=3 Destination Host Unreachable

--- es01 ping statistics ---
5 packets transmitted, 0 received, +3 errors, 100% packet loss, time 4090ms

对比：

root@2d6f42945a18:/# ping 10.0.17.17
PING 10.0.17.17 (10.0.17.17) 56(84) bytes of data.
64 bytes from 10.0.17.17: icmp_seq=1 ttl=64 time=0.220 ms
64 bytes from 10.0.17.17: icmp_seq=2 ttl=64 time=0.128 ms

--- 10.0.17.17 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1016ms
rtt min/avg/max/mdev = 0.128/0.174/0.220/0.046 ms

执行nslookup或dig可正常解析服务名es01：

root@2d6f42945a18:/# nslookup es01
Server:     127.0.0.11
Address:    127.0.0.11#53

Non-authoritative answer:
Name:   es01
Address: 10.0.17.16

============================================================

root@2d6f42945a18:/# dig es01

; <<>> DiG 9.18.24-1-Debian <<>> es01
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17322
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;es01.              IN  A

;; ANSWER SECTION:
es01.           600 IN  A   10.0.17.16

;; Query time: 0 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Tue Mar 26 07:10:16 UTC 2024
;; MSG SIZE  rcvd: 42

其中10.0.17.16是es01服务的虚拟IP，执行docker service inspect elk7_es01可查看：

...
"Endpoint": {
    "Spec": {
        "Mode": "vip"
    },
    "VirtualIPs": [
        {
            "NetworkID": "rdtgyz97aahhsrlwz8u2mm8fy",
            "Addr": "10.0.17.16/24"
        }
    ]
}

目前无法理解为何容器内可解析服务虚拟IP，却无法通过服务名访问服务任务（容器），但可通过任务IP正常访问。

可能的原因是什么？我的Swarm节点均为Proxmox 7.0.11配置的Ubuntu 20.04 LXC容器，主机IP段为10.8.66.0/24。

已参考Stack Overflow上的类似问题，但未解决当前问题。执行nslookup tasks.es01可返回正确的容器IP：

root@2d6f42945a18:/# nslookup tasks.es01
Server:     127.0.0.11
Address:    127.0.0.11#53

Non-authoritative answer:
Name:   tasks.es01
Address: 10.0.17.17

内容的提问来源于stack exchange，提问作者Zach Smith