I removed firewall and I’ve switched to iptables-legacy already.
Yet, on a brand new docker install:
$ sudo apt-get install docker.io
[sudo] password for us:
Sorry, try again.
[sudo] password for us:
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
bridge-utils containerd dnsmasq-base pigz runc ubuntu-fan
Suggested packages:
ifupdown aufs-tools cgroupfs-mount | cgroup-lite debootstrap docker-doc rinse zfs-fuse | zfsutils
The following NEW packages will be installed:
bridge-utils containerd dnsmasq-base docker.io pigz runc ubuntu-fan
0 upgraded, 7 newly installed, 0 to remove and 4 not upgraded.
Need to get 0 B/66.8 MB of archives.
After this operation, 287 MB of additional disk space will be used.
Do you want to continue? [Y/n]
Preconfiguring packages ...
Selecting previously unselected package pigz.
(Reading database ... 126290 files and directories currently installed.)
Preparing to unpack .../0-pigz_2.6-1_amd64.deb ...
Unpacking pigz (2.6-1) ...
Selecting previously unselected package bridge-utils.
Preparing to unpack .../1-bridge-utils_1.7-1ubuntu3_amd64.deb ...
Unpacking bridge-utils (1.7-1ubuntu3) ...
Selecting previously unselected package runc.
Preparing to unpack .../2-runc_1.1.0-0ubuntu1.1_amd64.deb ...
Unpacking runc (1.1.0-0ubuntu1.1) ...
Selecting previously unselected package containerd.
Preparing to unpack .../3-containerd_1.5.9-0ubuntu3.1_amd64.deb ...
Unpacking containerd (1.5.9-0ubuntu3.1) ...
Selecting previously unselected package dnsmasq-base.
Preparing to unpack .../4-dnsmasq-base_2.86-1.1ubuntu0.1_amd64.deb ...
Unpacking dnsmasq-base (2.86-1.1ubuntu0.1) ...
Selecting previously unselected package docker.io.
Preparing to unpack .../5-docker.io_20.10.12-0ubuntu4_amd64.deb ...
Unpacking docker.io (20.10.12-0ubuntu4) ...
Selecting previously unselected package ubuntu-fan.
Preparing to unpack .../6-ubuntu-fan_0.12.16_all.deb ...
Unpacking ubuntu-fan (0.12.16) ...
Setting up dnsmasq-base (2.86-1.1ubuntu0.1) ...
Setting up runc (1.1.0-0ubuntu1.1) ...
Setting up bridge-utils (1.7-1ubuntu3) ...
Setting up pigz (2.6-1) ...
Setting up containerd (1.5.9-0ubuntu3.1) ...
Created symlink /etc/systemd/system/multi-user.target.wants/containerd.service → /lib/systemd/system/containerd.service.
Setting up ubuntu-fan (0.12.16) ...
Created symlink /etc/systemd/system/multi-user.target.wants/ubuntu-fan.service → /lib/systemd/system/ubuntu-fan.service.
Setting up docker.io (20.10.12-0ubuntu4) ...
Created symlink /etc/systemd/system/multi-user.target.wants/docker.service → /lib/systemd/system/docker.service.
Created symlink /etc/systemd/system/sockets.target.wants/docker.socket → /lib/systemd/system/docker.socket.
Processing triggers for dbus (1.12.20-2ubuntu4.1) ...
Processing triggers for man-db (2.10.2-1) ...
[us:seagoat:~]
$ docker run --rm --name nginx -p 8081:80 nginx:alpine
Unable to find image 'nginx:alpine' locally
alpine: Pulling from library/nginx
63b65145d645: Pull complete
8c7e1fd96380: Pull complete
86c5246c96db: Pull complete
b874033c43fb: Pull complete
dbe1551bd73f: Pull complete
0d4f6b3f3de6: Pull complete
2a41f256c40f: Pull complete
Digest: sha256:6f94b7f4208b5d5391246c83a96246ca204f15eaf7e636cefda4e6348c8f6101
Status: Downloaded newer image for nginx:alpine
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2023/02/11 14:21:42 [notice] 1#1: using the "epoll" event method
2023/02/11 14:21:42 [notice] 1#1: nginx/1.23.3
2023/02/11 14:21:42 [notice] 1#1: built by gcc 12.2.1 20220924 (Alpine 12.2.1_git20220924-r4)
2023/02/11 14:21:42 [notice] 1#1: OS: Linux 5.15.0-60-generic
2023/02/11 14:21:42 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2023/02/11 14:21:42 [notice] 1#1: start worker processes
2023/02/11 14:21:42 [notice] 1#1: start worker process 30
2023/02/11 14:21:42 [notice] 1#1: start worker process 31
2023/02/11 14:21:42 [notice] 1#1: start worker process 32
2023/02/11 14:21:42 [notice] 1#1: start worker process 33
I run curl on the same machine:
$ curl -v http://localhost:8081/
* Trying 127.0.0.1:8081...
* Connected to localhost (127.0.0.1) port 8081 (#0)
> GET / HTTP/1.1
> Host: localhost:8081
> User-Agent: curl/7.81.0
> Accept: */*
>
* Recv failure: Connection reset by peer
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer
I’ve no clue why, I’ve spent a day already looking at forums and help, to no avail. This is a completely fresh install, and it is the most basic thing possible, and it fails.
It seems to boil down to bridge failing: 172.17.0.1 is pingable (this is the local IP of the docker0 interface), but 172.17.0.2 is not (this is supposedly the IP of the running nginx container).
I took that as a “No” to my desktop-related question so I moved the topic under “DockerEngine”
docker.io should work too, but it is better to install Docker from the repository mentioned in the documentation. I have seen docker.io failing when docker-ce (from Docker’s repository) worked fine.
It also works all right if I switch to host networking:
docker run --rm --network host --name nginx nginx:alpine
So it seems like container bridging is b0rked somehow, but I can’t figure out where and why. There are no logs and no indication as to what might be wrong here.
After a long long trial and error, the issue has resolved by adjusting systemd-networkd config. I used it to configure DHCP for the ethernet adapter. However, I did it with this config file /etc/systemd/network/20-local-wired.network:
[Match]
Name=*
[Network]
DHCP=yes
Although this was a heat-of-the-moment quickie to simplify the netplan/networkmanager mess, worked all right until docker’s fancy per-container interfaces appeared.
I don’t know why, but systemd-networkd somehow silently and weirdly breaks docker with the above config.
I’ve changed the match to en*, like this:
[Match]
Name=en*
[Network]
DHCP=yes
and suddently docker started working by the book.
Leaving this here for future google hits.
Thanks for thinking along and being my rubber duck today!
Thanks for sharing your solution so I could learn a new way to break container networking
I used a similar approach only when I wanted to use netplan to manage some vlan interfaces, but not all, although I used the unmanaged-devices option of the NetworkManager and used /etc/netplan/network.yaml to define which interface should use DHCP and which shouldn’t. This is just another idea that could be useful sometime.
This is a level of networking which is not part of the official documentation so we have to deal with it using other sources. I am glad that you could figure it out. I don’t think I would have thought of that configuration.
When updating to 22.04, I’ve noticed that there are many ways to obtain IP via dhcp. I’ve noticed that systemd-networkd actually can do this, but it’s turned off by default. So I thought, let’s not complicate our lives, and removed both netplan.io and networkmanager, and simply enabled systemd-networkd to do its job. And it worked! Much less moving parts, just the way I like it.
