03 / FIELD NOTES

Stop cloud-init from rewriting resolv.conf

Write resolvers, then make resolv.conf immutable so DHCP cannot overwrite them.

Why this way

Locking resolv.conf is a last resort on cloud images that keep stomping DNS. It is not the default advice: immutable files surprise the next person who edits the box. Write first, lock only when the rewrite already bit you.

When to use

DHCP or cloud-init keeps replacing the resolvers you just wrote.

When not to

Skip this if you rely on DHCP-managed DNS or systemd-resolved stub.

Prerequisites

root shell
e2fsprogs chattr available

Steps

Check who manages resolv.conf first

Read-only

readlink -f /etc/resolv.conf
systemctl is-active systemd-resolved

Expect: A path under /run/systemd/resolve, or "active", means systemd-resolved manages DNS. Stop here and set DNS in /etc/systemd/resolved.conf instead.

Write Cloudflare resolvers

Changes config

printf '%s\n' 'nameserver 1.1.1.1' 'nameserver 1.0.0.1' | tee /etc/resolv.conf

Expect: tee prints the two nameserver lines.

Make the file immutable

Changes config

chattr +i /etc/resolv.conf

Expect: Later writes fail until you run chattr -i /etc/resolv.conf.

What it changes

Makes /etc/resolv.conf immutable. Later writes fail until chattr -i /etc/resolv.conf. Run this in the root shell you get after a reinstall.

Let nala rank apt mirrors

{
  "slug": "chattr-resolv",
  "risk": "caution",
  "tags": [
    "dns",
    "chattr",
    "resolv.conf"
  ],
  "updated": "2026-10-28",
  "pathIndex": null,
  "why": "Locking resolv.conf is a last resort on cloud images that keep stomping DNS. It is not the default advice: immutable files surprise the next person who edits the box. Write first, lock only when the rewrite already bit you.",
  "steps": [
    {
      "command": "readlink -f /etc/resolv.conf\nsystemctl is-active systemd-resolved",
      "risk": "safe"
    },
    {
      "command": "printf '%s\\n' 'nameserver 1.1.1.1' 'nameserver 1.0.0.1' | tee /etc/resolv.conf",
      "risk": "caution"
    },
    {
      "command": "chattr +i /etc/resolv.conf",
      "risk": "caution"
    }
  ]
}