Docker not working with a VPN due to network issues

Question

For some reason my VPN (NordVPN) is interfering with Docker:

make start
docker-compose -f docker-compose/docker-compose.base.yml -f docker-compose/docker-compose.dev.yml up -d
doCreating network "docker-compose_default" with the default driver
ERROR: could not find an available, non-overlapping IPv4 address pool among the defaults to assign to the network
cmake: *** [Makefile:59: up_dev] Error 1

The issue seems to be to do with networking. I'm not sure how to troubleshoot it or fix it, though. After disabling my VPN and running sudo systemctl restart docker, Docker works fine.

Environment

• Ubuntu 20.04 LTS
• Docker version 19.03.8, build afacb8b7f0
• NordVPN Version 3.7.4

Answer 1

TL;DR

The issue here is that docker/docker-compose is unable to find a suitable address range to assign a subnet to the a new internal network since the VPN adds routes for all IP addresses.

Solutions:

1. manually define the network and its address range in docker-compose.yml or use an existing one => requires changes in all your docker-compose.yml files which also may become hardly portable due to the hard coded addresses.
2. start docker/all your services before the VPN => probably not practicable in all cases
3. reconfigure the routing configuration of your VPN to exclude ranges to be used by docker => will add complexity to your VPN configuration and may leak traffic intended for VPN if done wrong

Explanation

By default docker-compose sets up a dedicated docker network for each project i.e. a virtual bridge device on the docker host.

To assign a subnet range and gateway address to the network docker tries to select a range from a pool of possible ranges. It checks that the selected range does not overlap with a range/route already bound to a connected network device to prevent issues with colliding address ranges in use by the host.

The VPN on the other hand may add its own routes in order to redirect all traffic through the VPN tunnel. Because of this docker will not be able to find a "unused" address range to assign to the new network.

For more on this see the answers to this question and the respective issue on GitHub

Answer 2

This worked for me. Stop the running container and try with

docker network prune

Note: use with caution