container unbound unhealthy

I have the same problem. Reinstalled VM with Debian.
Some Docker containers don’t start because unbound is a requirement and unbound is started unhealthy.
The ./healthcheck.sh in the container says:
Maybe check your outbound firewall, as it needs to resolve DNS over TCP AND UDP!

nslookup mailcow.email 127.0.0.1 
;; connection timed out; no servers could be reached

./docker-entrypoint.sh 
Setting console permissions...
Receiving anchor key...
Receiving root hints...
############################################################# 100.0%
setup in directory /etc/unbound
removing artifacts
Setup success. Certificates created. Enable in unbound.conf file to use

I had the same issue. Searching my firewall-logs revealed, that mailcow (probably the unbound container) uses PING to check, if the public DNS resolver is reachable (in my case 1.1.1.1). This makes no sense for me. Instead, trying to resolve some names would make more sense, if you want to check if DNS works…

I usually only allow what is really necessary. I didn’t see any necessity to allow pings. I’ve just allowed Pings, now everything works. The unbound container switched to healthy again.

uniquegch

docker compose logs unbound-mailcow

You can connect to the unbound container and run the healthcheck.sh script to see what it’s complaining about:

docker compose exec unbound-mailcow /bin/bash 

728992fc9ee9:/# ./healthcheck.sh 
PING 1.1.1.1 (1.1.1.1): 56 data bytes

--- 1.1.1.1 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 5.749/5.795/5.857 ms
PING 8.8.8.8 (8.8.8.8): 56 data bytes

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 5.185/5.252/5.361 ms
PING 9.9.9.9 (9.9.9.9): 56 data bytes

--- 9.9.9.9 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 11.493/11.595/11.658 ms

Have a look at /var/log/healthcheck.log inside the unbound container

Hi, same problem here. I think one cause for confusion is the healthcheck script inside the container and docker calling the container “healthy” or not. This is what I get after docker up -d (PS: I use podman with docker-compose standalone inside a VM behind NAT and NAT6, heathcheck.sh runs without any problems.)

 ✘ Container mailcowdockerized-unbound-mailcow-1          Error                                                                                    3.1s 
[..]
dependency failed to start: container mailcowdockerized-unbound-mailcow-1 had unexpected health status ""

If you restart unbound-mailcow manual, postfix will not be running. I played a little bit around and using version 2023-05 had no problems whatsoever. Running docker-compose up unbound-mailcow -d ; docker-compose up -d on version 2023-10a yield this:

  Container mailcowdockerized-unbound-mailcow-1    Healthy                                                                                                    0.0s 

Without first starting unbound-mailcow in version 2023-10a, I get this:

 ✘ Container mailcowdockerized-unbound-mailcow-1          Error                                                                                                3.0s 

So my assumption is, that docker at startup checks if unbound-mailcow changes “started” to “healthy” status. If this does not happend within short time at boot, the container is switched from docker to error status even though you can connect to unbound, healthcheck.sh works find and unbound is resolving dns just fine.

I changed back to the latest mailcow and changed in docker-compose.yml the “condition: service_healthy” to “condition: service_started” everywhere I found it and now it runs without any problems. Unbound says at startup:

  Container mailcowdockerized-unbound-mailcow-1          Started                                                                                              3.0s 

I hope this helps finding a cure to this problem. thanks

@pozzo-balbi may you try to enter into the unbound container with:

docker compose exec unbound-mailcow /bin/bash

and then try to lookup any domain ?
by: nslookup mailcow.email for example ?
Are you able to resolve it ?
Do you have a firewall in front of your mailserver ?
If ye make sure that your mailserver is able to contact to the dns server you use (in your firewall or your own - not an external).

Please tell u more

PS: I fixed same problem because there was a firewall rule missing but i don’t know why that worked before ^^

@tardar The healthcheck script is never run but if I run it manually, it says that there are not network issues. IPv6, http, https, icmp and dns and the rest working. Changing the variable in mailcow.conf did not help. But changing “healthy” to “started” in docker-compose.yml fixed the problem.

It’s also the same problem. I tried what was indicated here. The error remains

yes. 0 packets is lost

lipunis and the file /var/log/healthcheck.log states that everything is OK?

5d9850aa648f:/# tail /var/log/healthcheck.log 
2024-02-13 09:14:08: Healthcheck: ALL CHECKS WERE SUCCESSFUL! Unbound is healthy!