Hi there, there's something I don't fully understand about docker networking and ipv6.
I have a dual-stack network where some containers are v4+v6 and some are v4 only.
I can see that when a dual-stack container revolves an ipv4-only, it gets ans ipv4 AND an ipv6 address from the resolver.
Looking at the interface in the ipv4-only container, I don't see any ipv6 address, so I don't understand how the resolver can get an ipv6 address for it, especially if specified as ipv6-disabled.
Please find below the reproduction steps.
I'm probably missing something...
Thanks.
# create dual stack network
docker network create \
--subnet 192.168.123.0/24 --gateway 192.168.123.1 --ip-range 192.168.123.128/26 \
--subnet="fde0:725c:19d8:9704::/64" --gateway="fde0:725c:19d8:9704::1" --ipv6 \
test-dual-stack-network
# start and ipv4-only and a dual-stack container
docker run -d --network test-dual-stack-network --name dual-stack node:19-alpine tail -f /dev/null
docker run -d --network test-dual-stack-network --name ipv4-only --sysctl net.ipv6.conf.all.disable_ipv6=1 node:19-alpine tail -f /dev/null
# check that dual-stack container has ipv4 + ipv6
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
136: eth0@if137: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 state UP
inet6 fde0:725c:19d8:9704::2/64 scope global flags 02
valid_lft forever preferred_lft forever
inet6 fe80::42:c0ff:fea8:7b80/64 scope link
valid_lft forever preferred_lft forever
# check that ipv4-only container has no ipv6
$ docker exec -ti ipv4-only ip -6 addr
(no output)
# resolve ipv4-only from dual-stack
$ docker exec -ti dual-stack nslookup ipv4-only
Server: 127.0.0.11
Address: 127.0.0.11:53
Non-authoritative answer:
Name: ipv4-only
Address: 192.168.123.129
Non-authoritative answer:
Name: ipv4-only
Address: fde0:725c:19d8:9704::3
$ docker inspect ipv4-only
[
{
"Id": "24ce3d7b171d825dc3d01cb8eee5370a3bedef539249cf476b98154fd052abb5",
"Created": "2024-01-10T15:06:21.784037625Z",
"Path": "docker-entrypoint.sh",
"Args": [
"tail",
"-f",
"/dev/null"
],
"State": {
"Status": "running",
"Running": true,
"Paused": false,
"Restarting": false,
"OOMKilled": false,
"Dead": false,
"Pid": 34415,
"ExitCode": 0,
"Error": "",
"StartedAt": "2024-01-10T15:06:21.972918417Z",
"FinishedAt": "0001-01-01T00:00:00Z"
},
"Image": "sha256:309fc9aaf0d7d138831483c33eae396be3e1b5bd83ac1e57e1b124f9300df1fc",
"ResolvConfPath": "/var/lib/docker/containers/24ce3d7b171d825dc3d01cb8eee5370a3bedef539249cf476b98154fd052abb5/resolv.conf",
"HostnamePath": "/var/lib/docker/containers/24ce3d7b171d825dc3d01cb8eee5370a3bedef539249cf476b98154fd052abb5/hostname",
"HostsPath": "/var/lib/docker/containers/24ce3d7b171d825dc3d01cb8eee5370a3bedef539249cf476b98154fd052abb5/hosts",
"LogPath": "/var/lib/docker/containers/24ce3d7b171d825dc3d01cb8eee5370a3bedef539249cf476b98154fd052abb5/24ce3d7b171d825dc3d01cb8eee5370a3bedef539249cf476b98154fd052abb5-json.log",
"Name": "/ipv4-only",
"RestartCount": 0,
"Driver": "overlay2",
"Platform": "linux",
"MountLabel": "",
"ProcessLabel": "",
"AppArmorProfile": "",
"ExecIDs": null,
"HostConfig": {
"Binds": null,
"ContainerIDFile": "",
"LogConfig": {
"Type": "json-file",
"Config": {}
},
"NetworkMode": "test-dual-stack-network",
"PortBindings": {},
"RestartPolicy": {
"Name": "no",
"MaximumRetryCount": 0
},
"AutoRemove": false,
"VolumeDriver": "",
"VolumesFrom": null,
"ConsoleSize": [
46,
187
],
"CapAdd": null,
"CapDrop": null,
"CgroupnsMode": "private",
"Dns": [],
"DnsOptions": [],
"DnsSearch": [],
"ExtraHosts": null,
"GroupAdd": null,
"IpcMode": "private",
"Cgroup": "",
"Links": null,
"OomScoreAdj": 0,
"PidMode": "",
"Privileged": false,
"PublishAllPorts": false,
"ReadonlyRootfs": false,
"SecurityOpt": null,
"UTSMode": "",
"UsernsMode": "",
"ShmSize": 67108864,
"Sysctls": {
"net.ipv6.conf.all.disable_ipv6": "1"
},
"Runtime": "runc",
"Isolation": "",
"CpuShares": 0,
"Memory": 0,
"NanoCpus": 0,
"CgroupParent": "",
"BlkioWeight": 0,
"BlkioWeightDevice": [],
"BlkioDeviceReadBps": [],
"BlkioDeviceWriteBps": [],
"BlkioDeviceReadIOps": [],
"BlkioDeviceWriteIOps": [],
"CpuPeriod": 0,
"CpuQuota": 0,
"CpuRealtimePeriod": 0,
"CpuRealtimeRuntime": 0,
"CpusetCpus": "",
"CpusetMems": "",
"Devices": [],
"DeviceCgroupRules": null,
"DeviceRequests": null,
"MemoryReservation": 0,
"MemorySwap": 0,
"MemorySwappiness": null,
"OomKillDisable": null,
"PidsLimit": null,
"Ulimits": null,
"CpuCount": 0,
"CpuPercent": 0,
"IOMaximumIOps": 0,
"IOMaximumBandwidth": 0,
"MaskedPaths": [
"/proc/asound",
"/proc/acpi",
"/proc/kcore",
"/proc/keys",
"/proc/latency_stats",
"/proc/timer_list",
"/proc/timer_stats",
"/proc/sched_debug",
"/proc/scsi",
"/sys/firmware"
],
"ReadonlyPaths": [
"/proc/bus",
"/proc/fs",
"/proc/irq",
"/proc/sys",
"/proc/sysrq-trigger"
]
},
"GraphDriver": {
"Data": {
"LowerDir": "/var/lib/docker/overlay2/3cb2228c038a0ce0f19f1bd7a25c207fbac3e4e210a8feb4c6c1b97e14c2fc69-init/diff:/var/lib/docker/overlay2/551179578b1a8cc7cb5ef2d33912fbea4835946b83b14ef41d2bda84142ef175/diff:/var/lib/docker/overlay2/10a77529225f16c055942f8f3b7ad886e78d609f863db0adb7c0f2401d53b060/diff:/var/lib/docker/overlay2/3576624d09a3c441806ddb645291a31f9369d89815ffecde48d08dc1ba74d0ec/diff:/var/lib/docker/overlay2/382768c536559fb944f7131debd4748554762e32ac25fb6eebde1ae775dade8e/diff",
"MergedDir": "/var/lib/docker/overlay2/3cb2228c038a0ce0f19f1bd7a25c207fbac3e4e210a8feb4c6c1b97e14c2fc69/merged",
"UpperDir": "/var/lib/docker/overlay2/3cb2228c038a0ce0f19f1bd7a25c207fbac3e4e210a8feb4c6c1b97e14c2fc69/diff",
"WorkDir": "/var/lib/docker/overlay2/3cb2228c038a0ce0f19f1bd7a25c207fbac3e4e210a8feb4c6c1b97e14c2fc69/work"
},
"Name": "overlay2"
},
"Mounts": [],
"Config": {
"Hostname": "24ce3d7b171d",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"NODE_VERSION=19.7.0",
"YARN_VERSION=1.22.19"
],
"Cmd": [
"tail",
"-f",
"/dev/null"
],
"Image": "node:19-alpine",
"Volumes": null,
"WorkingDir": "",
"Entrypoint": [
"docker-entrypoint.sh"
],
"OnBuild": null,
"Labels": {}
},
"NetworkSettings": {
"Bridge": "",
"SandboxID": "bbd1bed273e5a723dbd70bfc00de376bb5d2a5c1ed32993b2a8376eb89f38cec",
"HairpinMode": false,
"LinkLocalIPv6Address": "",
"LinkLocalIPv6PrefixLen": 0,
"Ports": {},
"SandboxKey": "/var/run/docker/netns/bbd1bed273e5",
"SecondaryIPAddresses": null,
"SecondaryIPv6Addresses": null,
"EndpointID": "",
"Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "",
"IPPrefixLen": 0,
"IPv6Gateway": "",
"MacAddress": "",
"Networks": {
"test-dual-stack-network": {
"IPAMConfig": null,
"Links": null,
"Aliases": [
"24ce3d7b171d"
],
"NetworkID": "3529611cf1da65a490712c4866cee7ec16058e39362d2a1fcfe0320d7e7f10fc",
"EndpointID": "8865c25be193ce7e06e27284fa1f145afc798152add0f6817bf19d13259ccd3d",
"Gateway": "192.168.123.1",
"IPAddress": "192.168.123.129",
"IPPrefixLen": 24,
"IPv6Gateway": "fde0:725c:19d8:9704::1",
"GlobalIPv6Address": "fde0:725c:19d8:9704::3",
"GlobalIPv6PrefixLen": 64,
"MacAddress": "02:42:c0:a8:7b:81",
"DriverOpts": null
}
}
}
}
]
Description
Hi there, there's something I don't fully understand about docker networking and ipv6.
I have a dual-stack network where some containers are v4+v6 and some are v4 only.
I can see that when a dual-stack container revolves an ipv4-only, it gets ans ipv4 AND an ipv6 address from the resolver.
Looking at the interface in the ipv4-only container, I don't see any ipv6 address, so I don't understand how the resolver can get an ipv6 address for it, especially if specified as ipv6-disabled.
Please find below the reproduction steps.
I'm probably missing something...
Thanks.
Reproduce
Expected behavior
docker exec -ti dual-stack nslookup ipv4-onlyto return only ipv4.docker version
Client: Cloud integration: v1.0.35-desktop+001 Version: 24.0.5 API version: 1.43 Go version: go1.20.6 Git commit: ced0996 Built: Fri Jul 21 20:32:30 2023 OS/Arch: darwin/arm64 Context: desktop-linux Server: Docker Desktop 4.22.0 (117440) Engine: Version: 24.0.5 API version: 1.43 (minimum version 1.12) Go version: go1.20.6 Git commit: a61e2b4 Built: Fri Jul 21 20:35:38 2023 OS/Arch: linux/arm64 Experimental: false containerd: Version: 1.6.21 GitCommit: 3dce8eb055cbb6872793272b4f20ed16117344f8 runc: Version: 1.1.7 GitCommit: v1.1.7-0-g860f061 docker-init: Version: 0.19.0 GitCommit: de40ad0docker info
Additional Info