Improve DNS verification by exposing port 53 to host

[aidankhogg]

Summary

This PR improves DNS service verification and diagnostics by exposing the CoreDNS container's port 53/UDP to the host via localhost, enabling the orchestrator to verify DNS functionality from the host machine rather than requiring access to the internal core network.

Key Changes

• Port Exposure: Configure CoreDNS container to expose port 53/UDP to 127.0.0.1:53 on the host, allowing DNS queries from the orchestrator without requiring core network access
• Query Target Update: Change DNS verification queries from the internal root IP (10.0.0.2 → 10.10.0.2) to 127.0.0.1:53 (localhost), improving accessibility and reliability
• Enhanced Diagnostics: Add comprehensive logging of container network settings and port mappings when DNS verification fails, including:
  • Network interface IPs
  • Port binding information
  • Helpful error messages for common failure scenarios (port already in use, CoreDNS startup issues, malformed zones)
• Better Error Handling: Improve exception handling in _query_soa() with:
  • Specific detection of "Permission denied" errors (port 53 already in use)
  • Helpful guidance on how to diagnose port conflicts
  • More granular logging for different failure modes (timeout, connection refused, etc.)
• Documentation: Add comprehensive docstring to _query_soa() method explaining parameters and return value

Implementation Details

• The port binding uses 127.0.0.1 to restrict DNS access to the host machine only, maintaining security
• Diagnostic logging captures container inspection data to help troubleshoot network and port binding issues
• Error messages now provide actionable guidance (e.g., suggesting lsof or netstat commands to check port usage)
• Logging levels adjusted to use debug for transient failures and error for persistent issues

https://claude.ai/code/session_01J3G1MWM7E94xwcYRKZgKuL