MacOS Sequoia private relay broke custom local dns rules inside containers

[mickaelperrin]

Description

Hi,

I finally updated my mac to MacOS Sequoia (15.3.1) and I noticed since that custom DNS rules are not working anymore inside containers as soon as private relay is enabled. It takes me hours to find out the origin of the issue as it was working on Sonoma, and I totally forgot that privacy option of Apple.

What I call "custom DNS rules" are rules handled by a local DNS server (dnsmasq) that I configured to resolve mainly local containers virtual hosts ending with a custom TLD (.docker) to a loopback alias (10.2.3.4), and which is declared in mDNSResponder (/etc/resolver/docker file).

Reproduce

1. Create a loopback alias

sudo ifconfig lo0 alias 10.2.3.4

2. Install a local DNS server like dnsmasq

brew install dnsmasq

3. Configure dnsmasq

  port=19553
  domain-needed
  bogus-priv
  address=/.docker/10.2.3.4
  listen-address=127.0.0.1
  no-resolv
  no-hosts

4. Restart dnsmasq

brew services restart dnsmasq

5. Ensure that dnsmasq is working

 dig @127.0.0.1 +short -p 19553 test.docker
10.2.3.4

6. Register new dns server in mDNSResponder by creating the file cat /etc/resolver/docker

nameserver 127.0.0.1
port 19553
domain docker

7. Ensure that dnsmasq is properly registered on the host

ping test.docker                                                             
PING test.docker (10.2.3.4): 56 data bytes

9. Ensure that private relay is enabled in settings > icloud > private relay

10. Run DNS resolution test in docker container:

docker --rm busybox nslookup test.docker
Server:         192.168.65.7
Address:        192.168.65.7:53

Non-authoritative answer:

Non-authoritative answer:

Expected behavior

docker --rm busybox nslookup test.docker

Should display 10.2.3.4

Server:         192.168.65.7
Address:        192.168.65.7:53

Non-authoritative answer:
Name:   test.docker
Address: 10.2.3.4

docker version

Client:
 Version:           27.5.1
 API version:       1.47
 Go version:        go1.22.11
 Git commit:        9f9e405
 Built:             Wed Jan 22 13:37:19 2025
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.38.0 (181591)
 Engine:
  Version:          27.5.1
  API version:      1.47 (minimum version 1.24)
  Go version:       go1.22.11
  Git commit:       4c9b3b0
  Built:            Wed Jan 22 13:41:25 2025
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          1.7.25
  GitCommit:        bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e946
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client:
 Version:    27.5.1
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  ai: Ask Gordon - Docker Agent (Docker Inc.)
    Version:  v0.7.3
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-ai
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.20.1-desktop.2
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.32.4-desktop.1
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-compose
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.38
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-debug
  desktop: Docker Desktop commands (Beta) (Docker Inc.)
    Version:  v0.1.4
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-desktop
  dev: Docker Dev Environments (Docker Inc.)
    Version:  v0.1.2
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-dev
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.27
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-extension
  feedback: Provide feedback, right in your terminal! (Docker Inc.)
    Version:  v1.0.5
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-feedback
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.4.0
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-init
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-sbom
  scout: Docker Scout (Docker Inc.)
    Version:  v1.16.1
    Path:     /Users/mickaelperrin/.docker/cli-plugins/docker-scout

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 3
 Server Version: 27.5.1
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
 runc version: v1.1.12-0-g51d5e946
 init version: de40ad0
 Security Options:
  seccomp
   Profile: unconfined
  cgroupns
 Kernel Version: 6.12.5-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: aarch64
 CPUs: 12
 Total Memory: 7.653GiB
 Name: docker-desktop
 ID: 7e39466c-5d05-458a-bc03-c81d83a1b63f
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Labels:
  com.docker.desktop.address=unix:///Users/mickaelperrin/Library/Containers/com.docker.docker/Data/docker-cli.sock
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  127.0.0.0/8
 Live Restore Enabled: false

Diagnostics ID

0FC2C4C8-51D3-4632-81ED-89F5EB761692/20250217095803

Additional Info

No response