Bug: Healthchecks don't detect container provided DNS resolver errors
Author: gorgonzola5000Created Jan 6, 2026Updated Sep 11, 2026
LabelsCategory: DNS 📠Category: Healthcheck 🩺Status: 🗯️ Waiting for feedbackPopularity: ❤️ highStatus: 📌 Before next release
Is this urgent?
None
Host OS
Talos Linux
CPU arch
x86_64
VPN service provider
ProtonVPN
What are you using to run the container
Kubernetes
What is the version of Gluetun
Running version latest built on 2025-12-29T05:33:29.822Z (commit 9b9b723)
What's the problem
No healthcheck failure for 20 minutes even though DNS resolver is down. This is because ICMP takes precedence. fullPeriodicCheck probably doesn't fail because the record is cached and the TLS handshake happens. Probably the best way to handle this is to have another healthcheck just for the container provided DNS server. I'll try to open a PR later this week
# date && ping -c 1 1.1.1.1 && nslookup google.com 1.1.1.1 && nslookup google.com 127.0.0.1
Tue Jan 6 22:47:57 UTC 2026
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: seq=0 ttl=59 time=5.568 ms
--- 1.1.1.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 5.568/5.568/5.568 ms
Server: 1.1.1.1
Address: 1.1.1.1:53
Non-authoritative answer:
Name: google.com
Address: 2a00:1450:4025:804::64
Name: google.com
Address: 2a00:1450:4025:804::66
Name: google.com
Address: 2a00:1450:4025:804::8a
Name: google.com
Address: 2a00:1450:4025:804::65
Non-authoritative answer:
Name: google.com
Address: 142.250.130.138
Name: google.com
Address: 142.250.130.113
Name: google.com
Address: 142.250.130.101
Name: google.com
Address: 142.250.130.102
Name: google.com
Address: 142.250.130.139
Name: google.com
Address: 142.250.130.100
;; connection timed out; no servers could be reachedShare your logs (at least 10 lines)
2026-01-06T22:23:02Z INFO [dns] falling back on plaintext DNS at address 1.1.1.1
2026-01-06T22:23:02Z WARN [dns] DNS is not working: after 10 tries: lookup github.com on 127.0.0.1:53: read udp 127.0.0.1:39824->127.0.0.1:53: i/o timeout
2026-01-06T22:23:02Z INFO [dns] attempting restart in 20s
2026-01-06T22:23:04Z WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: all check tries failed: parallel attempt 1/2 failed: dialing: dial tcp4: lookup github.com: i/o timeout, parallel attempt 2/2 failed: dialing: dial tcp4: lookup cloudflare.com: i/o timeout
2026-01-06T22:23:04Z INFO [vpn] See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2026-01-06T22:23:04Z INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION
2026-01-06T22:23:04Z INFO [vpn] stopping
2026-01-06T22:23:04Z INFO [vpn] starting
2026-01-06T22:23:04Z INFO [firewall] allowing VPN connection...
2026-01-06T22:23:04Z INFO [wireguard] Using available kernelspace implementation
2026-01-06T22:23:04Z INFO [wireguard] Connecting to 79.127.186.165:51820
2026-01-06T22:23:05Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2026-01-06T22:23:05Z INFO [ip getter] Public IP address is 159.26.110.146 (Poland, Mazovia, Warsaw - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-01-06T22:23:05Z INFO [port forwarding] starting
2026-01-06T22:23:05Z INFO [port forwarding] gateway external IPv4 address is 159.26.110.146
2026-01-06T22:23:05Z INFO [port forwarding] port forwarded is 48242
2026-01-06T22:23:05Z INFO [firewall] setting allowed input port 48242 through interface tun0...
2026-01-06T22:23:05Z INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2026-01-06T22:23:05Z INFO [port forwarding] Success! Transmission peer-port updated to 48242
2026-01-06T22:23:22Z INFO [dns] downloading hostnames and IP block lists
2026-01-06T22:23:22Z INFO [dns] DNS server listening on [::]:53
2026-01-06T22:23:55Z INFO [dns] readyShare your configuration
Source: passteque/gluetun