How to fix Could not resolve host: api.example.com in Docker

First, verify what DNS servers your container is using:

docker run --rm alpine cat /etc/resolv.conf

If you see nameserver 127.0.0.11 (Docker's embedded DNS) or valid external IPs, the issue may be elsewhere. If you see no nameservers or only localhost addresses, proceed with the fixes below.

Examine your host's DNS settings:

cat /etc/resolv.conf

If you see nameserver 127.0.0.53 (systemd-resolved) or nameserver 127.0.0.1 (dnsmasq), this is likely the cause. Docker filters these out, leaving containers without valid DNS.

On systems using systemd-resolved, change the resolv.conf symlink to point to the file with real DNS servers:

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Then restart Docker:

sudo systemctl restart docker

This exposes the actual upstream DNS servers to Docker instead of the local stub resolver.

Create or edit /etc/docker/daemon.json to specify DNS servers:

sudo nano /etc/docker/daemon.json

Add the following (adjust DNS servers as needed for your network):

{
  "dns": ["8.8.8.8", "8.8.4.4", "1.1.1.1"]
}

Restart Docker to apply:

sudo systemctl restart docker

Note: If you're behind a corporate firewall, use your internal DNS servers instead of public ones.

For a quick fix or testing, specify DNS directly when running containers:

docker run --dns 8.8.8.8 --dns 8.8.4.4 your-image

For Docker Compose, add to your service:

services:
  your-service:
    image: your-image
    dns:
      - 8.8.8.8
      - 8.8.4.4

As a workaround, you can use the host's network stack directly:

docker run --network host your-image

Or in Docker Compose:

services:
  your-service:
    image: your-image
    network_mode: host

Warning: This removes network isolation between container and host, which may not be suitable for production or multi-container setups.

Ensure your firewall allows DNS traffic from Docker's bridge network:

# For firewalld
sudo firewall-cmd --permanent --zone=trusted --add-interface=docker0
sudo firewall-cmd --reload

# For ufw
sudo ufw allow in on docker0

Also verify that outbound UDP port 53 is not blocked for Docker containers.