Enable IPv6 NAT (Cleaner commits)#2023
Conversation
Signed-off-by: Billy Ridgway <[email protected]>
Signed-off-by: Billy Ridgway <[email protected]>
Codecov Report
@@ Coverage Diff @@
## master #2023 +/- ##
=========================================
Coverage ? 38.83%
=========================================
Files ? 137
Lines ? 27552
Branches ? 0
=========================================
Hits ? 10700
Misses ? 15537
Partials ? 1315
Continue to review full report at Codecov.
|
|
I believe that is an important PR, could someone pls have a look at it. |
| var ( | ||
| defaultBindingIP = net.IPv4(0, 0, 0, 0) | ||
| defaultBindingIPV6 = net.ParseIP("::") | ||
| defaultBindingIPV6 = net.ParseIP("::1") |
There was a problem hiding this comment.
I think this change does the opposite of what the commit description says, changing the default from unspecified to localhost/loopback and not the other way around.
| logrus.Warn(err) | ||
| return err | ||
| } | ||
| if config.EnableIPv6 { |
There was a problem hiding this comment.
I wonder why this part has not been added to the existing setupIPForwarding function which does the same for IPv4.
There was a problem hiding this comment.
This seems to have been considered/solved in #2572.
|
Any news on this? |
|
@andryyy I'm not sure how to put this more on the Docker radar to get this merged in. This is my first pull request with Docker/libnetwork. |
|
ping @docker/core-libnetwork-maintainers |
|
@cpuguy83 How do I ping @docker/core-libnetwork-maintainers? |
|
@fcrisciani What is the procedure to getting a pull request looked at by Docker maintainers? |
|
@wrridgwa yes, thanks for the contribution and sorry if we don't have anyone yet following up on the review. The IPv6 support is definitely in the queue, but right now we don't have resources to dedicate directly to follow up. Be sure that remains in the radar, I hope to be able to come back soon on this and have a more defined plan to bring IPv6 support in parity with IPv4 |
|
@fcrisciani please don't forget us folks not running an orchestrator! Not everyone is using docker in a huge cloud, even though I guess you're getting most of your funding by people who do... |
|
Can't speak for @fcrisciani but for me, heard and very-much received. I definitely feel that IPv6 needs to be a first-class citizen. As Flavio was hinting, there are some deeper issues with IPv6 libnetwork support. These include the ways we handle preallocated networks and I suspect IPAM in general. Load balancing and port forwarding are clearly others. Hence the comment above about wanting a defined plan. Sorry for the silence thusfar. |
|
@ctelfer @fcrisciani what about getting this merged under some experimental option maybe? Until the other stuff you mention (load balancer etc) is figured out better. |
|
Just figured, this is really needed in AWS setups. If you run docker on an IPv6 enabled EC2 instance, AWS right now only forwards traffic to that instance for single registered IPv6s. |
ghost
mentioned this pull request
|
any progress? |
|
@HunterXuan I haven't heard anything from the Docker folks. I do need to resolve the conflicts that have been generated since this PR has been created. |
|
Any update? |
|
Did anyone managed to run IPv6 on docker swarm? Is it even possible? Anyone willing to share the hacks? |
|
As long as you don't publish ports, it works just fine.
( add "ipv6": true and fixed-cidr-v6 to /etc/docker/daemon.json )
I hope that publishing ports on the ingress network will be fixed soon too.
( issue #2293 )
Kind regards,
Ed
…On Sun, 2019-06-02 at 23:37 -0700, Chris Levi wrote:
Did anyone managed to run IPv6 on docker swarm? Is it even possible? Anyone willing to share the hacks?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.
|
I tried in any possible way, I hit a dead end.. my service isnt publishing but still no connectivty towards external ipv6 compononets. Asked @ moby slack channel bet yet to get any answers. would appriciate any help whatsoever. @kapiteined |
|
Ok, in order to get more info, could you:
- post the content of your daemon.json
- give some background of the docker host (AWS, hardware, vmware..)
- create a service: docker service create --name ubuntu01 ubuntu sleep 1h
- on the docker host where the container is running, do the following:
- post the output of ip a of that docker host
- CONTAINER=$( docker ps | grep ubuntu01 | awk '{ print $1 }' )
- docker exec $CONTAINER apt-get update
- docker exec $CONTAINER apt-get upgrade -y
- docker exec $CONTAINER apt-get install -y net-tools iproute2
iputils-ping
- docker exec $CONTAINER ip a
- docker exec $CONTAINER ip -f inet6 route show
- docker exec $CONTAINER ping -w2 -c2 <your container ipv6 default
gateway>
This should give a clear idea of what is and is not working.
Feel free to use pastebin to share the output of all the above commands.
Kind regards,
Ed
…On 6/4/19 3:33 AM, Chris Levi wrote:
As long as you don't publish ports, it works just fine. ( add
"ipv6": true and fixed-cidr-v6 to /etc/docker/daemon.json ) I hope
that publishing ports on the ingress network will be fixed soon
too. ( issue #2293
<#2293> ) Kind regards, Ed
… <#>
On Sun, 2019-06-02 at 23:37 -0700, Chris Levi wrote: Did anyone
managed to run IPv6 on docker swarm? Is it even possible? Anyone
willing to share the hacks? — You are receiving this because you
are subscribed to this thread. Reply to this email directly, view
it on GitHub, or mute the thread.
I tried in any possible way, I hit a dead end.. my service isnt
publishing but still no connectivty towards external ipv6 compononets.
Asked @ moby slack channel bet yet to get any answers. would
appriciate any help whatsoever. @kapiteined
<https://github.com/kapiteined>
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#2023>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/ABPTWE32ZEC5SKOVFNT3EG3PYXA67ANCNFSM4EFXW3LQ>.
|
|
Maybe you could open a post on the Docker forums instead of posting in this pull request and being kinda off topic? EDIT: And it's a known issue overlay network isn't compatible with IPv6. |
|
Fair point, lets do that.
https://forums.docker.com/t/testing-ipv6-inside-a-container/75848
Kind regards,
Ed
…On 6/4/19 9:44 AM, Emilien Devos wrote:
Maybe you could open a post on the Docker forums instead of posting in
this pull request and being kinda off topic?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#2023>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/ABPTWE2NH6K5F7HNGM7VIJDPYYMNZANCNFSM4EFXW3LQ>.
|
|
@wrridgwa thanks for raising this PR , looks like @jbrunink has also raised a similar PR We have been a little reluctant with IPv6 NAT, because IPv6 wasn't meant to be NATd, but due to limitations today such as a single IPv6 address from the cloud provider and the fact that we rely on NAT as a default firewall, I think such a feature is needed for desktop scenarios. I'd recommend making sure that Will start reviewing once the files have been rebased . cc: @thaJeztah @mavenugo |
|
Good to see some movement on this front! I hope it is not office but I'd like to clarify that in my PR I've implemented it as such that you have both NAT and non-NAT behaviour based on the IPv6 address. Any address allocated from the fd00::/8 (iirc) will be made a NAT rule for, anything else will just be filtered. |
|
What a pity that still no further progress. |
|
They must worry about something. It is indeed a huge change, I think. Would be nice to hear from the team. :) I know you they are probably busy with 3189515 other things. Just curious about the downsides of adding it. |
|
I'm pretty disillusioned with docker's way of doing "collaboration" at this point. A different issue of mine for docker compose was closed even though there was obvious demand from others, even when I offered to implement it entirely myself, which was just met with dead silence. Great. Now here somebody put in all the effort where there is even more demand, and nobody appears to care. It seems like docker would rather have us use alternate runtimes that actually care about listening to developers. Docker has to be one of the companies with the worst responses to people attempting to collaborate I have ever seen, and shame on them for it. 👎 (And yeah, I realize maybe others had a better experience. But this has been my subjective impression so far.) |
|
@etc0de @andryyy @HunterXuan , would really appreciate it if you could carry forward this PR, I will sign up as a reviewer |
|
Nice. I wonder if we can get @wrridgwa back on the table. 😄 It's been 2 1/2 years. |
|
2,5 years later and this is still not default behavior. What's the hold-up? |
Enable IPv6 NAT (rebase of #2023)
|
This has been merged in #2572. |
17 participants
This pull request addresses this open issue moby/moby#25407
Previously when IPv6 was enabled on Docker, ip6tables weren't manipulated to do Port Forwarding and IP masquerading. This PR addresses that in a way similar to the IPv4 implementation.
Relies on the following Moby PR to bring the EnableIPv6 flag through to libnetwork: moby/moby#35252
When combined with the Docker pull request, the fix can be verified after starting a container in bridge mode with port forwarding and IPv6 enabled:
Compare the iptables -t nat -L command with the ip6tables -t nat -L command
Compare iptables -t filter -L command with ip6tables -t filter -L command
Ping6 from within a running container to an outside device.
Note: This is the same as #1992 but cleaner commits.