When using gvisor-tap-vsock on macOS (tested via Lima and Podman Machine), the internal DNS resolver correctly handles standard A and AAAA queries but fails to return records for SOA, SRV, and PTR queries.
These queries return a NOERROR status with ANSWER: 0 and an immediate response time (0 msec), suggesting the internal resolver is intercepting the request but failing to resolve it upstream, likely due to the state of /etc/resolv.conf on macOS hosts.
Environment:
- Host OS: Apple Silicon macOS Tahoe 26.1
- Runtime: Podman Machine(Applehv) / Lima(VZ driver)
Steps:
-
Start a VM using gvisor-tap-vsock networking.
-
Query an A record (Works):
# core@localhost:~$ dig google.com A
; <<>> DiG 9.18.38 <<>> google.com A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18550
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 0 IN A 142.251.221.110
;; Query time: 0 msec
;; SERVER: 192.168.127.1#53(192.168.127.1) (UDP)
;; WHEN: Wed Feb 18 16:38:00 IST 2026
;; MSG SIZE rcvd: 54
- Query an SOA record (Fails):
# core@localhost:~$ dig google.com soa
; <<>> DiG 9.18.38 <<>> google.com soa
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3828
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;google.com. IN SOA
;; Query time: 0 msec
;; SERVER: 192.168.127.1#53(192.168.127.1) (UDP)
;; WHEN: Wed Feb 18 16:38:06 IST 2026
;; MSG SIZE rcvd: 28
This issue breaks critical infrastructure tools running inside the VM, such as cert-manager (ACME DNS challenges rely on SOA).
Related to lima-vm/lima#4520
When using
gvisor-tap-vsockon macOS (tested via Lima and Podman Machine), the internal DNS resolver correctly handles standard A and AAAA queries but fails to return records for SOA, SRV, and PTR queries.These queries return a
NOERRORstatus withANSWER: 0and an immediate response time (0 msec), suggesting the internal resolver is intercepting the request but failing to resolve it upstream, likely due to the state of/etc/resolv.confon macOS hosts.Environment:
Steps:
Start a VM using
gvisor-tap-vsocknetworking.Query an A record (Works):
This issue breaks critical infrastructure tools running inside the VM, such as cert-manager (ACME DNS challenges rely on SOA).
Related to lima-vm/lima#4520