Things I learned today about DNS

Docker copies DNS settings into containers

And they are inherrited once and for all, so if you start a container and connect to a vpn, the DNS configuration of the container is now stale.

Dig doesn’t resolve the same way as Python

python3 -c "import socket; socket.getaddrinfo(\"\", 9999)"

is quite different from


Python doesn’t resolve the same way as Python

It all depends on libc, and musl libc is really not the same as glibc:

NixOS + Network Manager + VPN can enjoy leaking DNS queries

On connecting to a vpn, NetworkManager might add new nameservers, and might not delete the existing ones, such as