# Self-Healing CI: Recovering Flaky DNS Inside a Service Container

> A name-resolution failure between containers in CI is usually a transient internal-DNS blip. See the manual fix and how self-healing CI retries it automatically.

Source: https://latchkey.dev/learn/self-healing-ci/self-healing-service-container-dns-flaky  
Updated: 2026-06-26

A container that briefly cannot resolve a sibling service by name hit an internal-DNS blip, not a wiring mistake -- the next lookup resolves fine.

## What makes a failure safely retryable

Automatic retry is only correct for failures that are genuinely transient. Retrying a deterministic failure wastes minutes and hides a real defect, so the classification matters more than the retry mechanism.

- Safe to retry: network timeouts, registry 5xx, transient DNS failures, a service container that was not ready, a spot instance reclaimed mid-run.
- Not safe to retry: assertion failures, compile errors, lint violations, anything that fails identically on every attempt.
- Ambiguous, and worth investigating rather than retrying: out-of-memory kills, disk exhaustion, and flaky tests. These repeat under load and a retry only hides the trend.
- Always record that a retry happened. A pipeline that silently retries is a pipeline whose real failure rate you do not know.

## FAQ

### What causes Self-Healing CI: recovering flaky DNS inside a service container?

A job that talks to a service container by hostname fails with could not resolve host for the service name. The container network and aliases are configured correctly; the embedded DNS that resolves service names had a brief hiccup. A human re-runs the job and the name resolves with no change.

### How do I fix Self-Healing CI: recovering flaky DNS inside a service container manually?

[object Object]

### Can Self-Healing CI: recovering flaky DNS inside a service container be fixed automatically?

An internal name-resolution failure has the same recognizable transient signature as any DNS blip, and the safe response is to wait briefly and retry the lookup. A self-healing CI pipeline detects the resolution failure, retries the step with backoff, and only escalates if the name stays unresolvable, which is the real signal of a

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt