I/o timeout error when using Lets Encrypt

Drone Support
1

I’m trying to setup drone in docker on Ubuntu 16.04. Here is my docker-compose.yml

version: '3.2'

services:
  drone-server:
    image: drone/drone:latest

    ports:
      - 80:80
      - 443:443
      - 9000
    volumes:
      - drone:/var/lib/drone/
    restart: always
    environment:
      - DRONE_OPEN=${DRONE_OPEN}
      - DRONE_ORGS=${DRONE_ORGS}
      - DRONE_HOST=${DRONE_HOST}
      - DRONE_BITBUCKET=true
      - DRONE_BITBUCKET_CLIENT=${DRONE_BITBUCKET_CLIENT}
      - DRONE_BITBUCKET_SECRET=${DRONE_BITBUCKET_SECRET}
      - DRONE_SECRET=${DRONE_SECRET}
      - DRONE_LETS_ENCRYPT=true

  drone-agent-1:
    image: drone/agent:latest

    restart: always
    depends_on:
      - drone-server
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - DRONE_SERVER=drone-server:9000
      - DRONE_SECRET=${DRONE_SECRET}

volumes:
  drone:

I have DEFAULT_FORWARD_POLICY set to “ACCEPT”

> sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22                         LIMIT       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
Anywhere on docker0        ALLOW       Anywhere
22 (v6)                    LIMIT       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
443/tcp (v6)               ALLOW       Anywhere (v6)
Anywhere (v6) on docker0   ALLOW       Anywhere (v6)

After running compose I’m getting errors in logs:

http: TLS handshake error from 172.18.0.1:42750: Get https://acme-v01.api.letsencrypt.org/directory: dial tcp: lookup acme-v01.api.letsencrypt.org on 127.0.0.11:53: read udp 127.0.0.1:41823->127.0.0.11:53: i/o timeout
http: TLS handshake error from 172.18.0.1:42752: acme/autocert: missing certificate
http: TLS handshake error from 172.18.0.1:42754: acme/autocert: missing certificate

How can I fix the issue?

2

can you verify that https://acme-v01.api.letsencrypt.org/directory is accesible from your instance ?

3

Looks like you are getting i/o timeout errors which means there is a networking / dns issue with your docker setup. Specifically it appears that dns lookups are being routed to 127.0.0.11:53 and are hanging. I recommend triaging this as a Docker networking issue, and engaging Docker support if necessary, since this is outside my area of expertise.

4

Yes, it looks like docker issue

> docker run --network drone_ci_default  alpine ping example.com
ping: bad address 'example.com'