Docker 29 breaks policy routing

Docker Engine General
, ,
1

Hi!

After updating to Docker 29 my policy routing between my containers break.

I’ve two containers:

Container “A” in subnet: 10.250.250.0/30
Container “B” in subnet: 10.250.200.8/29

Every docker network is a user-defined bridge.

I’ve the following ip rule settings:

110:    from 10.250.250.0/24 to 172.25.55.0/24 lookup main proto static
111:    from 10.250.250.0/24 to 10.250.250.0/24 lookup main proto static
150:    from 10.250.250.0/24 lookup 11 proto static

In the table 11 i’ve only one default route:

$ ip r show table 11
default dev wg1 scope link

Every traffic from B goes through this interface. Except when I’d like to manage it from 172.25.55.0/24 and if an other container (like A) wants to reach it.
All traffic arriving from other containers appears in container A as if it were arriving from its own default gateway. This is why the ip rule 111 points to itself.

If I downgrade back to Docker 28 everything works fine!
Does anyone know of any changes that could have caused this?

2

There are a couple of networking related change in v29

https://docs.docker.com/engine/release-notes/29/#networking

but not sure which one is related to your issue

3

I read the changelog and none of those changes should have changed this. So I think this is a bug / error and not a correct new feature.

4

Please share the output of docker info, so we can see what docker distribution you are using. Not every docker installation uses vanilla Docker (as in docker-ce) oder Docker Desktop.

5

I installed it based on the official docker description, not from the Fedora repository.

$ docker info
Client: Docker Engine - Community
 Version:    29.0.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.29.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.40.3
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 9
  Running: 9
  Paused: 0
  Stopped: 0
 Images: 8
 Server Version: 29.0.0
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: fcd43222d6b07379a4be9786bda52438f0dd16a1
 runc version: v1.3.3-0-gd842d771
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.17.7-300.fc43.x86_64
 Operating System: Fedora Linux 43 (Server Edition)
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 62.48GiB
 Name: p.kinit.hu
 ID: 1e8e810e-ad91-4f89-8084-5e07fe058be9
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables+firewalld
  ReloadedAt: 2025-11-13T17:43:17+01:00
6

Your best bet is to raise an issue in the Moby repository:

Moby is the upstream project, vanilla Docker is build based on it.

7

Before reporting the issue, I recommend upgrading to 29.0.1

1 Like
8

It’s not working even with the latest version, so i opened the issue:

Thank you for your help anyways!

1 Like