chore: allow DNS queries from Uncloud containers to the embedded DNS server

README.md

@@ -28,13 +28,17 @@ Deploy a highly available web app with automatic HTTPS across multiple regions a
 
 * **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment —
   regardless of location or provider.
+* **Docker Compose**: Familiar [Docker Compose](https://compose-spec.io/) format for defining services and volumes. No
+  need to learn a new bespoke DSL.
+* **Zero-downtime deployments**: Rolling updates without service interruption. Automatic rollback on failure is coming
+  soon.
+* **Service discovery**: Built-in DNS server resolves service names to container IPs.
+* **Persistent storage**: Run stateful services with Docker volumes managed across machines.
 * **Zero-config private network**: Automatic WireGuard mesh with peer discovery and NAT traversal. Containers get unique
   IPs for direct cross-machine communication.
 * **No control plane**: Fully decentralized design eliminates single points of failure and reduces operational overhead.
 * **Imperative over declarative**: Favoring imperative operations over state reconciliation simplifies both the mental
   model and troubleshooting.
-* **Zero-downtime deployments**: Rolling updates with health checks and automatic rollback on failure.
-* **Service discovery**: Built-in DNS server resolves service names to container IPs.
 * **Managed DNS**: Automatic DNS records `*.<id>.cluster.uncloud.run` for services with public access via managed
   [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service.
 * **Automatic HTTPS**: Built-in Caddy reverse proxy handles TLS certificate provisioning and renewal using Let's
@@ -44,11 +48,9 @@ Deploy a highly available web app with automatic HTTPS across multiple regions a
 
 Coming soon:
 
-* Infrastructure as Code using Docker Compose format
 * Project isolation through environments/namespaces
-* Persistent volumes and secrets management
+* Configs and secrets management using providers such as HashiCorp Vault and 1Password
 * Monitoring and log aggregation
-* Database deployment and management
 
 Here is a diagram of an Uncloud multi-provider cluster of 3 machines:
 
@@ -270,7 +272,7 @@ I'd love your input! Here's how you can contribute:
 * [Subscribe](https://uncloud.run/#subscribe) to my newsletter to follow the progress, get early insights into new
   features, and be the first to know when it's ready for production use.
 * Watch this repository for releases.
-* Follow [@psviderski](https://github.com/psviderski) on GitHub.
+* Follow [@psviderski](https://x.com/psviderski) on X/Twitter.
 
 ## ❤️ Contributors
 

internal/machine/dns/server.go

@@ -94,6 +94,11 @@ func NewServer(listenAddr netip.Addr, resolver Resolver, upstreams []netip.AddrP
 	}, nil
 }
 
+// ListenAddr returns the address the DNS server is listening on.
+func (s *Server) ListenAddr() netip.Addr {
+	return s.listenAddr
+}
+
 // Run starts the DNS server listening on both UDP and TCP ports. The server on TCP is not critical so it won't return
 // an error if it fails to start. The server will run until the context is canceled or an error occurs.
 func (s *Server) Run(ctx context.Context) error {

internal/machine/docker/manager.go

@@ -4,19 +4,19 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log/slog"
+	"time"
+
 	dockercontainer "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/events"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/client"
 	"github.com/psviderski/uncloud/internal/machine/store"
 	"github.com/psviderski/uncloud/pkg/api"
-	"log/slog"
-	"time"
 )
 
 const (
 	NetworkName = "uncloud"
-	UserChain   = "DOCKER-USER"
 	// EventsDebounceInterval defines how long to wait before processing the next Docker event. Multiple events
 	// occurring within this window will be processed together as a single event to prevent system overload.
 	EventsDebounceInterval = 100 * time.Millisecond

internal/machine/docker/manager_darwin.go

@@ -8,7 +8,7 @@ import (
 	"net/netip"
 )
 
-// EnsureUncloudNetwork is a stub for darwin.
+// EnsureUncloudNetwork is a stub for Darwin.
-func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix) error {
+func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix, dnsServer netip.Addr) error {
-	return fmt.Errorf("not supported on darwin")
+	return fmt.Errorf("not supported on Darwin")
 }

internal/machine/docker/manager_linux.go

@@ -3,24 +3,28 @@ package docker
 import (
 	"context"
 	"fmt"
+	"log/slog"
+	"net/netip"
+	"strconv"
+
 	dnetwork "github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
 	"github.com/docker/docker/libnetwork/iptables"
-	"log/slog"
+	"github.com/psviderski/uncloud/internal/machine/dns"
-	"net/netip"
+	"github.com/psviderski/uncloud/internal/machine/firewall"
 	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 // EnsureUncloudNetwork creates the Docker bridge network NetworkName with the provided machine subnet
 // if it doesn't exist. If the network exists but has a different subnet, it removes and recreates the network.
 // It also configures iptables to allow container access from the WireGuard network.
-func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix) error {
+func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix, dnsServer netip.Addr) error {
 	// Ensure the Docker network 'uncloud' is created with the correct subnet.
 	needsCreation := false
 	nw, err := m.client.NetworkInspect(ctx, NetworkName, dnetwork.InspectOptions{})
 	if err != nil {
 		if !client.IsErrNotFound(err) {
-			return fmt.Errorf("inspect Docker network %q: %w", NetworkName, err)
+			return fmt.Errorf("inspect Docker network '%s': %w", NetworkName, err)
 		}
 		needsCreation = true
 	} else if nw.IPAM.Config[0].Subnet != subnet.String() {
@@ -31,7 +35,7 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix)
 		)
 		if err = m.client.NetworkRemove(ctx, NetworkName); err != nil {
 			// It can still fail if the network is in use by a container. Leave it to the user to resolve the issue.
-			return fmt.Errorf("remove Docker network %q: %w", NetworkName, err)
+			return fmt.Errorf("remove Docker network '%s': %w", NetworkName, err)
 		}
 		needsCreation = true
 	}
@@ -50,12 +54,12 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix)
 				},
 			},
 		); err != nil {
-			return fmt.Errorf("create Docker network %q: %w", NetworkName, err)
+			return fmt.Errorf("create Docker network '%s': %w", NetworkName, err)
 		}
 		slog.Info("Docker network created.", "name", NetworkName, "subnet", subnet.String())
 
 		if nw, err = m.client.NetworkInspect(ctx, NetworkName, dnetwork.InspectOptions{}); err != nil {
-			return fmt.Errorf("inspect Docker network %q: %w", NetworkName, err)
+			return fmt.Errorf("inspect Docker network '%s': %w", NetworkName, err)
 		}
 	}
 
@@ -67,10 +71,36 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix)
 	// Bridge name doesn't seem to be documented but this is the source code where it is generated:
 	// https://github.com/moby/moby/blob/v27.2.1/libnetwork/drivers/bridge/bridge_linux.go#L664
 	bridgeName := "br-" + nw.ID[:12]
+
+	if err = configureIptables(bridgeName, dnsServer); err != nil {
+		return fmt.Errorf("configure iptables for Docker network '%s': %w", NetworkName, err)
+	}
+
+	return nil
+}
+
+// configureIptables configures iptables rules for the uncloud Docker network.
+func configureIptables(bridgeName string, dnsServer netip.Addr) error {
 	ipt := iptables.GetIptable(iptables.IPv4)
-	rule := []string{"--in-interface", network.WireGuardInterfaceName, "--out-interface", bridgeName, "-j", "ACCEPT"}
+	// Allow traffic from other machines and their containers through the WG mesh to the Uncloud containers
-	if err = ipt.ProgramRule(iptables.Filter, UserChain, iptables.Insert, rule); err != nil {
+	// on the machine.
+	wgRule := []string{"--in-interface", network.WireGuardInterfaceName, "--out-interface", bridgeName, "-j", "ACCEPT"}
+	if err := ipt.ProgramRule(iptables.Filter, firewall.DockerUserChain, iptables.Insert, wgRule); err != nil {
 		return fmt.Errorf("insert iptables rule: %w", err)
+	}
+
+	// Allow DNS queries from Uncloud containers to the embedded DNS server.
+	for _, proto := range []string{"udp", "tcp"} {
+		dnsRule := []string{
+			"--in-interface", bridgeName,
+			"--dst", dnsServer.String(),
+			"--protocol", proto,
+			"--dport", strconv.Itoa(dns.Port),
+			"-j", "ACCEPT",
+		}
+		if err := ipt.ProgramRule(iptables.Filter, firewall.UncloudInputChain, iptables.Insert, dnsRule); err != nil {
+			return fmt.Errorf("insert iptables rule: %w", err)
+		}
 	}
 
 	return nil

internal/machine/firewall/iptables_darwin.go

@@ -0,0 +1,8 @@
+package firewall
+
+import "fmt"
+
+// ConfigureIptablesChains is a stub for Darwin.
+func ConfigureIptablesChains() error {
+	return fmt.Errorf("not supported on Darwin")
+}

internal/machine/firewall/iptables_linux.go

@@ -0,0 +1,74 @@
+package firewall
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/docker/docker/libnetwork/iptables"
+	"github.com/psviderski/uncloud/internal/machine/network"
+)
+
+const (
+	DockerUserChain   = "DOCKER-USER"
+	UncloudInputChain = "UNCLOUD-INPUT"
+)
+
+// ConfigureIptablesChains sets up custom iptables chains and initial firewall rules for Uncloud networking.
+func ConfigureIptablesChains() error {
+	// Ensure iptables UNCLOUD-INPUT chain with a RETURN rule exists. All existing rules are flushed.
+	ipt := iptables.GetIptable(iptables.IPv4)
+	if _, err := ipt.NewChain(UncloudInputChain, iptables.Filter); err != nil {
+		return fmt.Errorf("create iptables chain '%s': %w", UncloudInputChain, err)
+	}
+	if err := ipt.RawCombinedOutput("-t", string(iptables.Filter), "-F", UncloudInputChain); err != nil {
+		return fmt.Errorf("flush iptables chain '%s': %w", UncloudInputChain, err)
+	}
+	if err := ipt.AddReturnRule(UncloudInputChain); err != nil {
+		return fmt.Errorf("add the RETURN rule for iptables chain '%s': %w", UncloudInputChain, err)
+	}
+
+	// Ensure the main iptables INPUT chain has a jump rule to the UNCLOUD-INPUT chain before any DROP/REJECT rules.
+	jumpRule := []string{"-m", "comment", "--comment", "Uncloud-managed", "-j", UncloudInputChain}
+	if !ipt.Exists(iptables.Filter, "INPUT", jumpRule...) {
+		// Look for the first DROP/REJECT rule in the INPUT chain.
+		out, err := ipt.Raw("-t", string(iptables.Filter), "-L", "INPUT", "--line-numbers")
+		if err != nil {
+			return fmt.Errorf("get iptables rules for chain '%s': %w", UncloudInputChain, err)
+		}
+
+		firstRejectRuleNum := 0
+		for _, line := range strings.Split(string(out), "\n") {
+			fields := strings.Fields(line)
+			if len(fields) < 2 {
+				continue
+			}
+			if fields[1] == "DROP" || fields[1] == "REJECT" {
+				if ruleNum, err := strconv.Atoi(fields[0]); err == nil {
+					firstRejectRuleNum = ruleNum
+					break
+				}
+			}
+		}
+
+		var addJumpRule []string
+		if firstRejectRuleNum > 0 {
+			addJumpRule = append([]string{"-t", string(iptables.Filter), "-I", "INPUT", strconv.Itoa(firstRejectRuleNum)},
+				jumpRule...)
+		} else {
+			addJumpRule = append([]string{"-t", string(iptables.Filter), "-A", "INPUT"}, jumpRule...)
+		}
+		if err = ipt.RawCombinedOutput(addJumpRule...); err != nil {
+			return fmt.Errorf("add iptables rule '%s': %w", strings.Join(addJumpRule, " "), err)
+		}
+	}
+
+	// Allow WireGuard traffic to the machine.
+	acceptWireGuardRule := []string{"-p", "udp", "--dport", strconv.Itoa(network.WireGuardPort), "-j", "ACCEPT"}
+	err := ipt.ProgramRule(iptables.Filter, UncloudInputChain, iptables.Insert, acceptWireGuardRule)
+	if err != nil {
+		return fmt.Errorf("insert iptables rule '%s': %w", strings.Join(acceptWireGuardRule, " "), err)
+	}
+
+	return nil
+}

internal/machine/network.go

@@ -18,6 +18,7 @@ import (
 	"github.com/psviderski/uncloud/internal/machine/corroservice"
 	"github.com/psviderski/uncloud/internal/machine/dns"
 	"github.com/psviderski/uncloud/internal/machine/docker"
+	"github.com/psviderski/uncloud/internal/machine/firewall"
 	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/psviderski/uncloud/internal/machine/store"
 	"golang.org/x/sync/errgroup"
@@ -79,6 +80,10 @@ func newNetworkController(
 }
 
 func (nc *networkController) Run(ctx context.Context) error {
+	if err := firewall.ConfigureIptablesChains(); err != nil {
+		return fmt.Errorf("configure iptables chains: %w", err)
+	}
+
 	if err := nc.wgnet.Configure(*nc.state.Network); err != nil {
 		return fmt.Errorf("configure WireGuard network: %w", err)
 	}
@@ -215,7 +220,7 @@ func (nc *networkController) prepareAndWatchDocker(ctx context.Context) error {
 		return fmt.Errorf("wait for Docker daemon: %w", err)
 	}
 
-	if err := manager.EnsureUncloudNetwork(ctx, nc.state.Network.Subnet); err != nil {
+	if err := manager.EnsureUncloudNetwork(ctx, nc.state.Network.Subnet, nc.dnsServer.ListenAddr()); err != nil {
 		return fmt.Errorf("ensure Docker network: %w", err)
 	}
 	slog.Info("Docker network configured.")