Help - containers not connecting to network

General
1

Hi !
I’ve been following along the container.training self-paced tutorials and can’t figure out why none of the containers I make can access WAN.

These are examples of the errors I get when trying to access the network :

user1@debian-me:~$ docker run -it ubuntu
root@a54f4f3e3926:/# apt-get update
Ign:1 http://security.ubuntu.com/ubuntu noble-security InRelease
Ign:2 http://archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://archive.ubuntu.com/ubuntu noble-updates InRelease
Ign:4 http://archive.ubuntu.com/ubuntu noble-backports InRelease
Ign:1 http://security.ubuntu.com/ubuntu noble-security InRelease
Ign:2 http://archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://archive.ubuntu.com/ubuntu noble-updates InRelease
Ign:4 http://archive.ubuntu.com/ubuntu noble-backports InRelease
Ign:1 http://security.ubuntu.com/ubuntu noble-security InRelease
Ign:2 http://archive.ubuntu.com/ubuntu noble InRelease
Ign:3 http://archive.ubuntu.com/ubuntu noble-updates InRelease
Ign:4 http://archive.ubuntu.com/ubuntu noble-backports InRelease
Err:1 http://security.ubuntu.com/ubuntu noble-security InRelease
  Could not connect to security.ubuntu.com:80 (91.189.91.83). - connect (101: Network is unreachable) Could not connect to security.ubuntu.com:80 (91.189.91.81). - connect (101: Network is unreachable) 
[...]
  Could not connect to security.ubuntu.com:80 (91.189.91.81). - connect (101: Network is unreachable) Could not connect to security.ubuntu.com:80 (185.125.190.81). - connect (101: Network is unreachable) Could not connect to security.ubuntu.com:80 (185.125.190.82), connection timed out Could not connect to security.ubuntu.com:80 (91.189.91.82), connection timed out Could not connect to security.ubuntu.com:80 (185.125.190.83), connection timed out
W: Some index files failed to download. They have been ignored, or old ones used instead.


[...]


user1@debian-me:~$ docker run busybox ping google.com

^CPING google.com (142.250.179.110): 56 data bytes

--- google.com ping statistics ---
57 packets transmitted, 0 packets received, 100% packet loss

Docker was installed following Debian | Docker Docs using the apt repository on a system running Debian 12
ping google.com works on host system
I’m accessing host system through local ssh connection

extra info :

user1@debian-me:~$ ip a show docker0
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:4a:cc:03:05 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
user1@debian-me:~$
user1@debian-me:~$
user1@debian-me:~$
user1@debian-me:~$ docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "f44be2b455b0bff3411c947a7ce94f6841b1c2cdd66e89c078e34d9687686af7",
        "Created": "2024-11-29T13:47:54.435106754+01:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]
user1@debian-me:~$
user1@debian-me:~$
user1@debian-me:~$
user1@debian-me:~$ docker info
Client: Docker Engine - Community
 Version:    27.3.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.17.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.29.7
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 13
  Running: 0
  Paused: 0
  Stopped: 13
 Images: 5
 Server Version: 27.3.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 57f17b0a6295a39009d861b89e3b3b87b005ca27
 runc version: v1.1.14-0-g2c9f560
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.1.0-28-amd64
 Operating System: Debian GNU/Linux 12 (bookworm)
 OSType: linux
 Architecture: x86_64
 CPUs: 12
 Total Memory: 15.4GiB
 Name: debian-horten
 ID: e4bf8380-43ff-43ff-b4ac-601ac0c40fd2
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled

Thank you for the help ^^

2

Seems those warnings, are the reason, why source nat for outgoing traffic doesn’t work.
See: Docker reports "WARNING: bridge-nf-call-iptables/ip6tables is disabled" at startup after upgrading to 27.3.1 · Issue #48664 · moby/moby · GitHub

1 Like
3

Hi !
Thank you for your timely response, however I was not able to extract a solution from:

See: Docker reports “WARNING: bridge-nf-call-iptables/ip6tables is disabled” at startup after upgrading to 27.3.1 · Issue #48664 · moby/moby · GitHub

As I am fairly inexperienced, could you give me a few more pointers ?

Additionally the folder /etc/docker/ is empty, is that normal ?

Thank you for your for your help and patience.
Regards,

Turkey.

4

Update:
It seams I messed up when I configured the host’s static ip…
The warnings still appear but my containers work properly.

Thank you for your time.

5

It is, unless you create the config file /etc/docker/daemon.json, or add ca-certifcates in /etc/docker/certs.d/ to pull images from a registry with self-signed certificates.

Glad it’s working now!

1 Like