Skip to main content
Welcome to Virtru's support portal. As we work to make this page more accessible to screen readers, please contact us at support@virtru.com for technical support.

Host User, resolv.conf, and DNS Permission Checks

  • Updated

Overview

In certain scenarios, DNS failures may occur if there is a permission mismatch between the gateway host and the container. This mismatch can prevent the container from correctly accessing or resolving the DNS configuration file (/etc/resolv.conf).

When this happens, the Virtru Gateway may fail to relay messages to the next hop, especially if the gateway is configured to use a DNS entry (e.g., smtp.domain.com) instead of a direct IP address.

To mitigate this risk, it is important to:

  1. Verify host user permissions to ensure the container has the appropriate rights to access mounted directories.
  2. Confirm /etc/resolv.conf file permissions inside the container match the host.
  3. Validate DNS resolution from the perspective of the application user (gatewayuser) inside the container.

Performing these checks helps maintain reliable DNS resolution and ensures that the gateway can successfully route encrypted messages to the intended destination via DNS.

Note: These steps apply to both Docker and Podman environments.

 

1. Check Host User Permissions

  1. Confirm your host user account

    sudo su
cd /var/virtru/vg
id
    • Displays your UID, GID, and group memberships.
    • If your user is part of the docker or podman group, you can run container commands without sudo.

  2. Check file and directory ownership

    ls -ld /var/virtru/vg

    Example:

    drwxr-xr-x 2 root root 4096 Sep 29 10:00 /var/virtru/vg
    • The directory above is owned by root:root.
  3. Verify container user mapping

    • First, get the container ID:

      docker ps
# or
podman ps

    • Then inspect the container user:

      docker inspect -f '{{.Config.User}}' <container_id>
    • If the output is empty, the container defaults to root.
    • Matching UID/GID between host and container ensures smooth access to mounted volumes.

2. Check resolv.conf File Permissions

Inside the container, confirm ownership and permissions of /etc/resolv.conf.

  1. Enter the container

    docker exec -it <container_id> /bin/bash

  2. Check file permissions

    ls -l /etc/resolv.conf

    Example:

    -rw-r--r-- 1 root root 140 Oct  1 14:02 /etc/resolv.conf

    Breakdown:

    • rw- → owner (root) can read/write
    • r-- → group can read
    • r-- → others can read
    • Owner = root, Group = root

    File permissions and ownership should match between host and container.

  3. Compare file contents

    • Inside the container:

      cat /etc/resolv.conf

    • On the host:

      cat /run/systemd/resolve/resolv.conf

    Both files should contain similar DNS nameserver and search domain configurations.

3. Check DNS Configuration & Resolution

Run these checks as the gatewayuser to ensure DNS works in the same environment the Gateway process runs.

  1. Inspect DNS configuration

    podman exec -it --user gatewayuser <container_name> cat /etc/resolv.conf
  2. Test name resolution (choose one):

    • If nslookup is available:

      podman exec -it --user gatewayuser <container_id> nslookup api.virtru.com

    • If nslookup is not available, use getent:

      podman exec -it --user gatewayuser <container_id> getent hosts api.virtru.com

Running the commands as gatewayuser ensures they execute under the same conditions as the Gateway. Both nslookup and getent will resolve DNS in the same way as the Gateway process, which helps determine if the issue is related to permissions or environmental DNS.

Summary

By verifying:

  • Host user permissions
  • resolv.conf ownership and contents
  • DNS resolution as gatewayuser

…you can confirm whether DNS failures are caused by a permissions mismatch or an environmental issue, preventing message relay failures in the Virtru Self-Hosted Gateway.

The simplest resolution is to ensure both the container and host user permissions match. To achieve this, re-deploy the container using the same user as the host — for example, run sudo su before executing the setup script in:

/var/virtru/vg/scripts

Related articles