Docker Community Forums

Share and learn in the Docker community.

Will docker inherit the host kernel parameters, such as tcp_tw_reuse/tcp_fin_timeout?

I am confused with whether docker will inherit the host’s kernel parameter.I have do some tests as below:
The kernel version:

$ uname -r
3.10.0-957.el7.x86_64
  1. I want to echo the ip_local_port_range parm and the command is :
$ sudo docker run --rm busybox cat /proc/sys/net/ipv4/ip_local_port_range

the output:

128

That is quite reasonable as ip_local_port_range is a namespaced parameter and I guess it inherits from the host.

  1. Test tcp_tw_reuse parameter:
sudo docker run --rm busybox cat /proc/sys/net/ipv4/tcp_tw_reuse

the output:

cat: can't open '/proc/sys/net/ipv4/tcp_tw_reuse': No such file or directory

That is reasonable too, as far as I know, in kernel 3.10 the tcp_tw_reuse is not namespaced and the docker does not have that file.
Now, I would like to know is, as the ‘/proc/sys/net/ipv4/tcp_tw_reuse’ file is not present in the container, will the container inherit its value from the host. Any help will be appreciated.

1 Like

Anyone have Any ideas?

try docker --sysctl net.ipv4.ip_local_port_range="1024 65535" image

Todays release of Docker 19.03 introduced sysctl for swarm deployments as well.

Thanks for your reply , and I know I could use sysctl to change kernel parameter in Docker .What confused me is will docker inherit the host kernel parameters, such as tcp_tw_reuse/tcp_fin_timeout?

So the question is: do namespaced kernel parameters inherit the general value? Why shouldn’t they?!

See: Configure namespaced kernel parameters (sysctls) at runtime

I do set “net.ipv4.tcp_keepalive_time=600” to get rid of the service vip timouts. Standalone container (docker run/docker-compse) do use this value, though you can create the container using different values for their namespace. With Docker 19.03 the support was introduced for Docker swarm as well.

The way you are trying to change the kernel parameter is wrong! You have to use the cli-parameter or add --privilged when you run/create your container.

docker --version
Docker version 19.03.12, build 48a66213fe

In any container running in Docker, I only can find out 6 files starting with “net.ipv4.tcp_”
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_keepalive_intvl = 75
net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_keepalive_time = 7200
net.ipv4.tcp_mem = 133614 178153 267228
net.ipv4.tcp_min_snd_mss = 48

The docker host is CentOS7 and it has 55 these kind of files.
root@7d929239742c:/# uname -a
Linux 7d929239742c 3.10.0-1127.18.2.el7.x86_64 #1 SMP Sun Jul 26 15:27:06 UTC 2020 x86_64 GNU/Linux

If a file exists in the container, I can modify it via --sysctl, such as net.ipv4.tcp_keepalive_time.
If the file doesn’t exist, I also encounter the same error “No such file or directory”, such as net.ipv4.tcp_tw_reuse. Then there is no way to modify it?

The vanilla 3.10 kernel was released in 2013. Namespacing of tcp_fin_timeout happened much later, in early 2016, and namespacing of tcp_tw_reuse happened even later.

In fact, these are the networking sysctls which are namespaced in vanilla 3.10:

int sysctl_icmp_echo_ignore_all;
int sysctl_icmp_echo_ignore_broadcasts;
int sysctl_icmp_ignore_bogus_error_responses;
int sysctl_icmp_ratelimit;
int sysctl_icmp_ratemask;
int sysctl_icmp_errors_use_inbound_ifaddr;

int sysctl_tcp_ecn;

kgid_t sysctl_ping_group_range[2];
long sysctl_tcp_mem[3];
Not so much. Other sysctls are globals, used disregarding what the caller’s network namespace is. This includes sysctls of your interest:

tcp_fin_timeout - definition, use;
tcp_tw_reuse - definition, use.
Note, that latest RHEL/CentOS versions of kernel 3.10 (which you seem to use) have some more sysctls namespaced - e.g. ip_local_port_range, mentioned by you, but this still does not include tcp_fin_timeout and tcp_tw_reuse.

So, finally answering your question: in kernel 3.10, these parameters are system-wide, and containerized processes use the same values of these sysctls as the host system.