Docker Community Forums

Share and learn in the Docker community.

How to set IPv6 network for connecting to remote host inside local docker container?

Note: The IPv6 address in this question isn’t the real IP.


There are two servers

  • node1(IPv6: 123a:a4b5:0102:t234:cd90:3:0:2)
  • node2(IPv6: 123a:a4b5:0102:t234:cd91:3:0:2)

On the node1, installed AWX by docker-compose, so the real application is in the container.

It can be connected from node1 to node2

[root@node1] ping6 123a:a4b5:0102:t234:cd91:3:0:2
PING 123a:a4b5:0102:t234:cd91:3:0:2(123a:a4b5:0102:t234:cd91:3:0:2) 56 data bytes
64 bytes from 123a:a4b5:0102:t234:cd91:3:0:2: icmp_seq=1 ttl=64 time=0.319 ms

Run ip -6 route on node1, found

default via 123a:a4b5:0102:t234::ffff dev lan0 metric 1 pref medium

Set 123a:a4b5:0102:t234 in the /etc/docker/daemon.json

{
  "ipv6": true,
  "fixed-cidr-v6": "123a:a4b5:0102:t234::ffff/64"
}

Restart docker. From docker network inspect bridge found

...
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": true,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                },
                {
                    "Subnet": "123a:a4b5:0102:t234::/64",
                    "Gateway": "123a:a4b5:0102:t234::1"
                }
            ]
        },
...

Connected awx_web to docker’s bridge network

docker network connect bridge awx_web

Login to awx_web container check ip, generated this IPv6

441: eth1@if442: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 123a:a4b5:0102:t234:0:242:ac11:2/64 scope global nodad
       valid_lft forever preferred_lft forever
    inet6 [secret]/64 scope link
       valid_lft forever preferred_lft forever

It can be ping by itself(123a:a4b5:0102:t234:0:242:ac11:2), but can’t ping the IPv6 on node2

sh-4.4# ping6 123a:a4b5:0102:t234:cd91:3:0:2
PING 123a:a4b5:0102:t234:cd91:3:0:2(123a:a4b5:0102:t234:cd91:3:0:2) 56 data bytes
From 123a:a4b5:0102:t234:cd91:3:0:2: icmp_seq=1 Destination unreachable: Address unreachable

How to config the network to let it work in this case?

Luckily, community members have stepped in an devised a solution that would just make published ports work with IPv6. First of all, you need to make sure that IPv6 is enabled on the network used by your containers. If you are using the default network, you would do it like this in docker-compose.yml:

version: “2.1”

networks:
default:
driver: bridge
enable_ipv6: true
ipam:
config:
- subnet: 172.20.0.0/16
- subnet: fd00:dead:beef::/48
And then you need to add ipv6nat as a privileged container that will take care of setting up the IPv6 forwarding rules:

services:
ipv6nat:
container_name: ipv6nat
restart: always
image: robbertkl/ipv6nat
privileged: true
network_mode: host
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- /lib/modules:/lib/modules:ro
There you go, it just works. Except that there is one more catch: don’t test your IPv6 setup on the ::1 address, it won’t work. The container will see a request coming from ::1 and will try sending a reply to it – meaning that it will send a reply to itself rather than the host. Using your external IPv6 address for testing will do.

Admin
Apps4rent

Thank you for your answer. I have tried this method. I think the important setting is here

- subnet: fd00:dead:beef::/48

If I have an IPv6 IP

301b:e0d0:401:0348:lk19:7:0:2

Configuration in the /etc/resolv.conf

domain my.domain

nameserver ::1

nameserver 301b:e0d0:401:0348:505:7:0:2
nameserver 301b:e0d0:401:0348:506:7:0:2

How to get its subnet? We can change the forth value start from right side. But keep other values the same.

I have tried to set the subnet to it in my network

- subnet: 301b:e0d0:401:0348::/64

But not work. Can’t use ping6 to other network in the container with this format

# ping6 301b:e0d0:401:0348:[DIFFERENT_VALUE_HERE]:7:0:2
unreachable