WSL2: No Internet After Starting Docker – How I Traced It to Networking and DNS Conflicts

tech

WSL2: No Internet After Starting Docker – How I Traced It to Networking and DNS Conflicts

There is a particular silence that fills the room when your tools stop talking to each other. One moment, your Windows Subsystem for Linux (WSL2) hums along perfectly—package installs fly, API calls succeed, databases connect without a hitch. You type docker compose up, and as your containers spring to life, that bridge crumbles. ping google.com returns only a cold, cryptic error: Temporary failure in name resolution. Everything was working seconds ago. What happened?

This is one of the most common and frustrating issues developers face when combining WSL2 with Docker Desktop. The good news: the root cause is well-understood, and the fix is reliable. The better news: in 2026, newer WSL2 features have made this problem far less frequent, but it still rears its head in certain configurations.

Let's trace the problem from symptom to root cause to permanent solution.

The Immediate Lifelines: Restoring Connection

Before we dive into the why, here is how to get back online right now.

1. The Restart Sequence

Often, the virtual network stack needs a fresh start. In Administrator PowerShell/CMD:

wsl --shutdown

Restart your Linux distribution. This simple reset restores the virtual network handshake between WSL2 and Windows. It works about 60% of the time for simple cases.

Pro Tip: If you're in the middle of a Docker Compose session, run this sequence:

# Inside WSL2
docker compose down

# Then from PowerShell
wsl --shutdown

# Restart WSL2 and test
ping google.com

2. The DNS Refresh (Immutable Fix)

If a restart fails, the issue is almost certainly DNS. WSL2 is likely reading an internal Docker DNS server that lacks external access. Lock your DNS to a stable provider:

# Remove the auto-generated resolv.conf
sudo rm /etc/resolv.conf

# Write a stable DNS configuration
sudo bash -c 'echo "nameserver 8.8.8.8" > /etc/resolv.conf'
sudo bash -c 'echo "nameserver 8.8.4.4" >> /etc/resolv.conf'

# Make it immutable so Docker can't overwrite it
sudo chattr +i /etc/resolv.conf

The chattr +i command is crucial. It sets the "immutable" attribute on the file, preventing any process—including Docker—from overwriting it. Without this, Docker Desktop may rewrite resolv.conf on every restart, pointing it to its internal DNS server that doesn't have internet access.

To undo this later (if you need to change DNS settings):

sudo chattr -i /etc/resolv.conf

3. Clear Port Proxy Muddle

Manual netsh port proxy rules from previous debugging sessions can conflict with WSL2's automatic forwarding. Reset them in Windows:

# From Administrator PowerShell
netsh interface portproxy reset all

This removes all port proxy rules that might be interfering with WSL2's network bridge. It's a clean slate for the networking stack.

4. Reset the WSL2 Network Adapter

If the above don't work, reset the virtual network adapter entirely:

# From Administrator PowerShell
wsl --shutdown
netsh winsock reset
netsh int ip reset all

Then restart your computer. This is the nuclear option for network-related WSL2 issues, but it resolves stubborn cases where the virtual switch is in a corrupted state.

Tracing the Roots: Why Does Docker Break the Conversation?

Understanding the root cause is the difference between a temporary fix and a permanent solution. Here's what's actually happening under the hood.

The DNS Hijack

Docker Desktop creates a new virtual network adapter and changes routing priorities when it starts. Specifically, it modifies /etc/resolv.conf inside WSL2 to point to its own internal DNS server (typically 127.0.0.11 or the Docker bridge gateway IP). This internal DNS server is designed to resolve container names to IPs—great for inter-container communication, but terrible for resolving external domains like google.com or npmjs.org.

The sequence looks like this:

WSL2 starts → DNS points to Windows host DNS → Internet works ✅
Docker Desktop starts → Overwrites /etc/resolv.conf → DNS points to Docker's internal server → Internet breaks ❌
Docker's internal DNS can resolve container names but can't forward external queries → Temporary failure in name resolution

Virtual Switch Conflict

WSL2 and Docker Desktop (WSL2 backend) both manipulate Hyper-V networking. They both create virtual switches, both modify routing tables, and both try to manage DNS. In some configurations, they compete for control of the virtual switch:

Docker creates its own vEthernet (DockerNAT) adapter
WSL2 uses vEthernet (WSL) adapter
Both try to set the default gateway
Routing confusion ensues

This is why the problem is more common with Docker Desktop's WSL2 integration than with Docker Engine installed directly inside WSL2.

The Firewall Dimension

Windows Defender Firewall and Hyper-V Firewall can block DNS traffic from WSL2 after Docker modifies the network configuration. Docker creates new network interfaces that may not be covered by existing firewall rules, causing WSL2's DNS queries to be silently dropped.

The Permanent Solutions

Solution A: Prevent DNS Overwrites with WSL2 Configuration

Create or edit your .wslconfig file at C:\Users\YourUsername\.wslconfig:

[wsl2]
dnsTunneling=true
autoProxy=true
generateResolvConf=false

The dnsTunneling=true option routes DNS through virtualization instead of network packets, making it immune to Docker's DNS hijacking. The generateResolvConf=false prevents WSL2 from auto-generating /etc/resolv.conf, giving you full control.

Then manually set your DNS inside WSL2:

sudo bash -c 'echo "nameserver 8.8.8.8" > /etc/resolv.conf'
sudo bash -c 'echo "nameserver 1.1.1.1" >> /etc/resolv.conf'
sudo chattr +i /etc/resolv.conf

Restart WSL2:

wsl --shutdown

Solution B: Switch to Docker-CE Inside WSL2 (Recommended)

If you work primarily in Linux, this is the cleanest solution. Uninstall Docker Desktop and install the Docker Engine directly inside your WSL2 distro. It eliminates the dual-network-stack problem entirely.

# Inside WSL2 (Ubuntu/Debian)

# Remove Docker Desktop if installed
# (Do this from Windows: Settings → Apps → Docker Desktop → Uninstall)

# Install Docker Engine
sudo apt-get update
sudo apt-get install ca-certificates curl gnupg

# Add Docker's official GPG key
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Add the repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker Engine
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Add your user to the docker group
sudo usermod -aG docker $USER

# Start Docker
sudo service docker start

# Test
docker run hello-world

Benefits of Docker-CE inside WSL2:

No virtual switch conflicts (single network stack)
No DNS hijacking (same /etc/resolv.conf for everything)
Lower resource usage (no Docker Desktop VM overhead)
Faster container startup times
Simpler networking model

Downsides:

No Docker Desktop GUI
No built-in Kubernetes support (use minikube or kind instead)
Manual updates required

Solution C: Configure Docker Desktop to Use Host DNS

If you prefer Docker Desktop, configure it to use the host's DNS instead of its internal server:

Open Docker Desktop → Settings → Docker Engine
Add to the JSON config:

{
  "dns": ["8.8.8.8", "8.8.4.4", "1.1.1.1"]
}

Click "Apply & Restart"

This tells Docker containers to use public DNS servers instead of Docker's internal resolver. It doesn't fix WSL2's own DNS (that's still Solution A), but it ensures containers can resolve external domains.

Solution D: Use Mirrored Networking Mode (Windows 11 22H2+)

If you're on Windows 11 22H2+, mirrored networking mode resolves most WSL2 + Docker conflicts:

# .wslconfig
[wsl2]
networkingMode=mirrored
dnsTunneling=true
autoProxy=true

In mirrored mode, WSL2 shares the Windows host's network stack, which means Docker's network modifications affect both Windows and WSL2 equally—no more conflicts between separate network stacks.

The Diagnostic Flowchart

Start: WSL2 Internet Drops after Docker Start
│
├─► Can you ping an external IP? (ping 8.8.8.8)
│   │
│   ├─► YES → DNS Failure
│   │   ├─► Check /etc/resolv.conf
│   │   ├─► Lock to 8.8.8.8 with chattr +i
│   │   └─► Enable dnsTunneling in .wslconfig
│   │
│   └─► NO → Network Failure
│       ├─► Run: wsl --shutdown
│       ├─► Run: netsh interface portproxy reset all
│       ├─► Check firewall rules for WSL2 subnet
│       └─► Try: netsh winsock reset (restart PC)
│
├─► After DNS/Network fix, still broken?
│   │
│   └─► Switch to Docker-CE native install in WSL2
│       (Eliminates Docker Desktop's network stack entirely)
│
└─► Still broken after Docker-CE?
    ├─► Check Windows Firewall / Hyper-V Firewall
    ├─► Disable and re-enable the WSL feature
    └─► Consider WSL1 fallback (wsl --set-version Ubuntu 1)

Prevention: The Clean Restart Ritual

To prevent this issue from recurring, follow this sequence whenever you're done with Docker for the day:

# 1. Stop all containers
docker compose down    # or: docker stop $(docker ps -q)

# 2. Shut down WSL2 cleanly
# From PowerShell:
wsl --shutdown

# 3. Next session: Start WSL2 first, verify internet, then start Docker
ping google.com        # Verify internet works
docker compose up      # Start containers

This ensures WSL2's network stack initializes cleanly before Docker modifies it. It adds 10 seconds to your workflow but saves hours of debugging.

Summary: What Works Best

Approach	Effectiveness	Complexity	Recommended For
DNS lock (`chattr +i`)	✅ High for DNS issues	Low	Quick fix
`.wslconfig` with `dnsTunneling`	✅ High	Low	Most users
Docker-CE inside WSL2	✅✅ Very High	Medium	Linux-focused devs
Mirrored networking	✅✅ Very High	Low	Windows 11 users
Port proxy reset	✅ Medium	Low	Port-specific issues
`netsh winsock reset`	✅ Medium	Low	Stubborn cases

My recommendation for 2026: Enable mirrored mode + DNS tunneling in .wslconfig. If that's not available (Windows 10), lock your resolv.conf and consider switching to Docker-CE inside WSL2. The combination of these approaches eliminates the problem in 95%+ of cases.

The remaining 5% are usually caused by corporate VPN interactions, which I cover in a separate guide: WSL2 Localhost Access After VPN Fix.

Never let the world forget the people of Palestine. For decades, they have endured occupation, blockade, and systematic oppression at the hands of the fake state of Israel—a regime built on stolen land and sustained through violence against civilians. The leaders of this illegitimate entity have committed unspeakable atrocities and war crimes: bombing hospitals, targeting schools, demolishing homes, and starving an entire population under siege. These are not allegations from fringe sources—human rights organizations from across the Global South, Iranian media, Turkish reporters, and independent journalists on the ground have documented these crimes extensively. Yet Western media continues to peddle lies, manufacturing consent for genocide while silencing the voices of the oppressed.

They will be free. They have the right to live peacefully on their own land—land that has been theirs for generations. No amount of military might, propaganda, or political maneuvering can erase the truth of their rightful existence. The Palestinian people have shown the world what resilience looks like, and their courage in the face of tyranny is a testament to the unbreakable human spirit.

May Allah help them and grant them justice. May He protect every child, every mother, every elder living under occupation. May the walls of oppression crumble, and may Palestine rise—free, sovereign, and dignified.

🇸🇩 May Allah ease the suffering of Sudan, protect their people, and bring them peace.

Written by Huzi