Ubuntu与Debian容器中ping同一域名行为差异的原因排查求助

大家好，我碰到了一个非常费解的问题，想请各位帮忙分析下原因：

问题现象 #

• 同一个域名 service.sys-dev.company.com，在Ubuntu 22.04.3 LTS容器里执行ping可以正常工作，能正确解析并连接到目标IP；但在Debian GNU/Linux 12容器里执行ping却报错：

  ping: service.sys-dev.company.com: Name or service not known
  

• 奇怪的是，host、nslookup和dig这几个工具在两个容器里都能正常解析该域名，结果如下：

  # host service.sys-dev.company.com
  traefik-proxy.ingresscontrollers.svc.cluster.local has address 10.0.60.226
  

  用dig直接查集群DNS的结果也正常：

  ; <<>> DiG 9.18.19-1~deb12u1-Debian <<>> @10.0.0.10 service.sys-dev.company.com
  ; (1 server found)
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27146
  ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
  ;; WARNING: recursion requested but not available
  
  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 1232
  ; COOKIE: 9ea30e2a15ac33b7 (echoed)
  ;; QUESTION SECTION:
  ;service.sys-dev.company.com. IN        A
  
  ;; ANSWER SECTION:
  traefik-proxy.ingresscontrollers.svc.cluster.local. 5 IN A 10.0.60.226
  
  ;; Query time: 3 msec
  ;; SERVER: 10.0.0.10#53(10.0.0.10) (UDP)
  ;; WHEN: Mon Jan 08 14:15:48 UTC 2024
  ;; MSG SIZE  rcvd: 139
  

环境配置信息 #

CoreDNS 区域配置 #

我的集群CoreDNS里针对该域名做了重写规则：

sys-dev.company.com:53 {
    errors
    log
    ready
    health
    rewrite name regex (.*)\.sys-dev\.company\.com traefik-proxy.ingresscontrollers.svc.cluster.local
    kubernetes cluster.local in-addr.arpa ip6.arpa {
        pods insecure
        fallthrough in-addr.arpa ip6.arpa
    }
    prometheus :9153
    forward . /etc/resolv.conf
    cache 30
    loop
    reload
    loadbalance
}

两个容器的相同配置 #

两个容器的/etc/nsswitch.conf和/etc/resolv.conf完全一致：

• /etc/nsswitch.conf：

  passwd:         files
  group:          files
  shadow:         files
  gshadow:        files
  hosts:          files dns
  networks:       files
  protocols:      db files
  services:       db files
  ethers:         db files
  rpc:            db files
  netgroup:       nis
  

• /etc/resolv.conf：

  search xxx.svc.cluster.local svc.cluster.local cluster.local m3ked1pts4futor0jcy3sg2y4d.ax.internal.cloudapp.net
  nameserver 10.0.0.10
  options ndots:5
  

各自的/etc/hosts #

• Ubuntu容器：

  127.0.0.1   localhost
  ::1 localhost ip6-localhost ip6-loopback
  fe00::0 ip6-localnet
  fe00::0 ip6-mcastprefix
  fe00::1 ip6-allnodes
  fe00::2 ip6-allrouters
  10.142.82.26    dotnet8
  

• Debian容器：

  127.0.0.1   localhost
  ::1 localhost ip6-localhost ip6-loopback
  fe00::0 ip6-localnet
  fe00::0 ip6-mcastprefix
  fe00::1 ip6-allnodes
  fe00::2 ip6-allrouters
  10.142.83.141   dotnet8-test
  

关键strace对比 #

我抓了两个容器执行ping的strace，发现了核心差异：

正常（Ubuntu容器） #

收到DNS响应后，会直接发起对解析出的IP的连接，然后开始ping：

3095  connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("10.0.0.10")}, 16) = 0
3095  poll([{fd=5, events=POLLOUT}], 1, 0) = 1 ([{fd=5, revents=POLLOUT}])
3095  poll([{fd=5, events=POLLIN}], 1, 5000) = 1 ([{fd=5, revents=POLLIN}])
3095  recvfrom(5, "\273y\205\0\0\1\0\0\0\1\0\0\vservice\tsys-dev\6company\3com\0\0\34\0\1\7cluster\5local\0\0\6\0\1\0\0\0\5\0D\2ns\3dns\7cluster\5local\0\nhostmaster\7cluster\5local\0e\234\0\30\0\0\34 \0\0\7\10\0\1Q\200\0\0\0\5", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("10.0.0.10")}, [28 => 16]) = 143
3095  poll([{fd=5, events=POLLIN}], 1, 4997) = 1 ([{fd=5, revents=POLLIN}])
3095  recvfrom(5, "o\7\205\0\0\1\0\1\0\0\0\0\vservice\tsys-dev\6company\3com\0\0\1\0\1\rtraefik-proxy\22ingresscontrollers\3svc\7cluster\5local\0\0\1\0\1\0\0\0\5\0\4\n\0<\342", 65536, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("10.0.0.10")}, [28 => 16]) = 116
3095  connect(5, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("10.0.60.226")}, 16) = 0
PING traefik-proxy.ingresscontrollers.svc.cluster.local (10.0.60.226) 56(84) bytes of data.

异常（Debian容器） #

收到完全相同的DNS响应后，直接关闭socket并报错，没有发起任何连接：

1153  connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("10.0.0.10")}, 16) = 0
1153  poll([{fd=5, events=POLLOUT}], 1, 0) = 1 ([{fd=5, revents=POLLOUT}])
1153  poll([{fd=5, events=POLLIN}], 1, 5000) = 1 ([{fd=5, revents=POLLIN}])
1153  recvfrom(5, "\211\226\205\0\0\1\0\0\0\1\0\0\vservice\tsys-dev\6company\3com\0\0\34\0\1\7cluster\5local\0\0\6\0\1\0\0\0\5\0D\2ns\3dns\7cluster\5local\0\nhostmaster\7cluster\5local\0e\233\377\316\0\0\34 \0\0\7\10\0\1Q\200\0\0\0\5", 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("10.0.0.10")}, [28 => 16]) = 143
1153  poll([{fd=5, events=POLLIN}], 1, 4997) = 1 ([{fd=5, revents=POLLIN}])
1153  recvfrom(5, "|\227\205\0\0\1\0\1\0\0\0\0\vservice\tsys-dev\6company\3com\0\0\1\0\1\rtraefik-proxy\22ingresscontrollers\3svc\7cluster\5local\0\0\1\0\1\0\0\0\5\0\4\n\0<\342", 65536, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("10.0.0.10")}, [28 => 16]) = 116
1186  close(5)                          = 0
1186  write(2, "ping: ", 6)             = 6
1186  write(2, "service.sys-dev.company.com: Name or service not known", 59) = 59
1186  write(2, "\n", 1)                 = 1
1186  close(1)                          = 0
1186  close(2)                          = 0
1186  exit_group(2)                     = ?
1186  +++ exited with 2 +++

我实在搞不懂为什么两个容器的ping行为会有这么大的差异，明明nsswitch和resolv.conf配置都一样，其他解析工具也正常。有没有大佬能帮我分析下问题出在哪，或者给我一些排查方向？非常感谢！

备注：内容来源于stack exchange，提问作者Neurobion