FULL AI ANALYSIS

Docker containers lose DNS resolution after laptop resume on Ubuntu 22.04 due to systemd-resolved stub resolver change

Generated Oct 3, 2026, 12:35:03 AM

Analysis summary

Containers rely on the host's stub resolver at 127.0.0.53. After suspend/resume, systemd-resolved appears to rebind or recreate its stub listener; the ephemeral listener state breaks the socket that containers previously used (their /etc/resolv.conf still points to the prior listener, which now refuses connections). Restarting systemd-resolved restores listener; restarting Docker updates container resolv.conf indirectly. Root causes include systemd-resolved re-registering listeners on resume, network interface reconfiguration (VPN) that triggers listener rebinds, and containers caching or keeping old socket endpoints. The safe solution is to avoid containers depending on host-local stub listener socket address, or ensure resolv.conf in containers points to a stable resolver.

Possible causes

systemd-resolved rebinds its stub listener during resume, invalidating connections used by containers that reference 127.0.0.53.

95%

NetworkManager/VPN reconfiguration on resume causes systemd-resolved to cycle listeners and transiently refuse connections used by containers.

85%

Docker created container /etc/resolv.conf entries before resume and they reference a transient listener socket that later becomes unreachable.

40%

Firewall/iptables rules applied on resume block loopback or 127.0.0.53:53 for container network namespaces.

10%

Suggested fixes

Diagnostic step 1

Avoid pointing containers at the host stub resolver. Configure Docker daemon to use stable DNS servers for containers (edit /etc/docker/daemon.json and add "dns": ["127.0.0.1"] is not sufficient here; instead provide one or more resolvers reachable from containers, e.g., internal resolver IP on LAN). After changing daemon.json, restart docker.service.

Diagnostic step 2

As a VPN/split-DNS requirement: run a small DNS forwarder (dnsmasq or unbound) bound to a stable host IP (not 127.0.0.53) reachable by containers; configure Docker daemon 'dns' to that IP so container resolv.conf uses a stable endpoint.

Diagnostic step 3

If you must continue using systemd-resolved, add a resume hook to restart systemd-resolved (sudo systemctl restart systemd-resolved) or to reconfigure Docker containers' /etc/resolv.conf after resume (create a systemd unit in /etc/systemd/system that runs after sleep.target to run 'systemctl restart docker' or execute a script to update container resolv.conf). This is a workaround; restarting Docker will briefly disrupt containers.

Diagnostic step 4

Inspect NetworkManager / VPN resume hooks and set them to notify systemd-resolved correctly (nm-dispatcher scripts) so the stub listener rebind is handled gracefully. Enable systemd-resolved debug logs during one resume to capture the exact sequence.

Diagnostic step 5

If firewall rules are modified on resume, ensure loopback traffic between container namespaces and host 127.0.0.53 is not blocked.

Contact • Help • API Docs • Careers • Terms • Privacy • Cookies • Ads