[Bug] example rootfs incurs 5s DNS lookup delay

[hanwen-flow]

Describe the bug

Following the instructions at https://github.com/firecracker-microvm/firecracker/blob/main/docs/getting-started.md, I successfully booted up a FC VM, with enabled network.

However, all DNS lookups take 5 seconds,

root@ubuntu-fc-uvm:~# time curl -I http://google.com
HTTP/1.1 301 Moved Permanently
...
X-Frame-Options: SAMEORIGIN


real	0m5.105s

To Reproduce

1. Start Firecracker via the ubuntu-24.04 recipe listed on docs/getting-started.md. (including configuring 8.8.8.8 as resolver)
2. try ping google.com. Observe a long delay before results are printed.

Expected behaviour

immediate response

Environment

• firecracker v1.13.1
• Host kernel 6.8.0-87-generic , guest kernel 6.1.141
• Rootfs used: ubuntu-24.04
• Architecture: x64
• Any other relevant software versions:

Additional context

it makes my integration tests run slower

run a workflow that involves downloading things

I know that parallel ipv4 and ipv6 DNS lookups can cause problems if ipv6 isn't configured correctly. That would make it a problem of the example root image, but it might still be of interest to fix. I tried disabling ipv6 in the kernel, but it didn't help.

Checks

• [x ] Have you searched the Firecracker Issues database for similar problems?
• Have you read the existing relevant Firecracker documentation?
• Are you certain the bug being reported is a Firecracker issue?

[Manciukic]

Hey! Thanks for reporting the issue.
I think I've seen something similar in the past and the issue seemed to be ARP resolution between host and guest. Did you try to see how much time it took to ping 8.8.8.8 for the first time? Maybe the issue is the connection to the DNS server and not the configuration itself.
What fixed it for me was pinging the guest from the host (or viceversa, I don't exactly remember right now) right after boot and the problem seemed to magically go away for me.

[hanwen-flow]

thanks for the suggestions. I tried all of those, but it made no difference.

[Manciukic]

interesting. I don't have any issues when running the getting-started guide from my ubuntu laptop (6.8.0-85-generic). How long does it take to just ping the DNS server? What's the output of nslookup www.google.com (you may have to install this on the rootfs)?

[hanwen-flow]

I toyed a bit more with this, and adding

echo 'options single-request-reopen' >> /etc/resolv.conf

made the problem go away. I suppose it is some kind of ipv6 misconfiguration, but I lack the networking chops to diagnose this in depth.

[Manciukic]

Yeah, it's possible the firewall setup in the getting-started guide doesn't work well when the host is connected to an IPv6 network, as it's only configuring IPv4 for the VM.

Thanks for finding the fix! If you'd like to contribute it back to the getting-started guide feel free to open a PR!

[hanwen-flow]

Thanks for finding the fix! If you'd like to contribute it back to the getting-started guide feel free to open a PR!

i'll look into it, once I find some time.

have you considered baking in the network config into the image, so the setup doesn't have to be done on every run?

[Manciukic]

Hey @hanwen-flow, the reason we don't bake the network config in the image is because the image is for our intergration tests and we don't actually need internet access there. The setup would also depend on the specific use case, so we think it's best to just leave it plain and let users decide how to configure it/
However, it'd be ideal to indicate about this extra config being needed in the getting-started guide to save time for future new users!