From 66b299a28e912bc2f8c2922b40292696c4f7d81a Mon Sep 17 00:00:00 2001
From: Offending Commit <offendingcommit@gmail.com>
Date: Tue, 2 Jun 2026 13:33:50 -0500
Subject: [PATCH] fix(docker): derive nginx resolver from container DNS

Hardcoded resolver 127.0.0.11 only exists on user-defined networks, so a plain
docker run on the default bridge 502'd (DNS connection refused). Render the
resolver from /etc/resolv.conf at start so per-request proxy_pass resolves on
both the default bridge (host DNS) and compose networks (embedded DNS).
---
 docker/40-openconcho-config.sh | 8 ++++++++
 docker/nginx.conf.template     | 5 +++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/docker/40-openconcho-config.sh b/docker/40-openconcho-config.sh
index 547b81d..88656ca 100644
--- a/docker/40-openconcho-config.sh
+++ b/docker/40-openconcho-config.sh
@@ -11,6 +11,14 @@ cat > /usr/share/nginx/html/config.js <<EOF
 window.__OPENCONCHO_DEFAULT_HONCHO_URL__ = "${OPENCONCHO_DEFAULT_HONCHO_URL:-}";
 EOF
 
+# Derive nginx's resolver from the container's own DNS so the runtime-variable
+# proxy_pass resolves on BOTH user-defined networks (Docker embedded DNS at
+# 127.0.0.11) and the default bridge (host nameservers from /etc/resolv.conf).
+# Hardcoding 127.0.0.11 breaks `docker run` on the default bridge (no embedded DNS).
+RESOLVERS=$(awk '/^nameserver/ { print $2 }' /etc/resolv.conf | tr '\n' ' ' | sed 's/ *$//')
+[ -z "$RESOLVERS" ] && RESOLVERS=127.0.0.11
+printf 'resolver %s ipv6=off valid=10s;\n' "$RESOLVERS" > /etc/nginx/conf.d/00-resolver.conf
+
 # Render the SSRF allowlist into an nginx map for $allow_upstream.
 # Unset/empty OPENCONCHO_UPSTREAM_ALLOWLIST → open (default 1), fine for the
 # localhost-bound default. Set it (comma-separated host globs) before exposing
diff --git a/docker/nginx.conf.template b/docker/nginx.conf.template
index 2dff4c3..04abd34 100644
--- a/docker/nginx.conf.template
+++ b/docker/nginx.conf.template
@@ -12,8 +12,9 @@ server {
     # Don't leak the nginx version.
     server_tokens off;
 
-    # Resolver required for per-request DNS when proxy_pass targets a runtime variable.
-    resolver 127.0.0.11 ipv6=off valid=10s;
+    # The resolver (required for per-request DNS with a runtime-variable proxy_pass)
+    # is rendered by the entrypoint into conf.d from the container's own DNS, so it
+    # works on both user-defined networks (127.0.0.11) and the default bridge.
 
     # Header-driven same-origin proxy: the browser names the Honcho upstream per
     # request via X-Honcho-Upstream, so the browser never makes a cross-origin call.