Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Network unreachable inside docker container without --net=host parameter

Problem: there is no internet connection in the docker container.

Symptoms: ping 8.8.8.8 doesn't work. Wireshark from host system gives back:

 19 10.866212113   172.17.0.2 -> 8.8.8.8      ICMP 98 Echo (ping) request  id=0x0009, seq=0/0, ttl=64
 20 11.867231972   172.17.0.2 -> 8.8.8.8      ICMP 98 Echo (ping) request  id=0x0009, seq=1/256, ttl=64
 21 12.868331353   172.17.0.2 -> 8.8.8.8      ICMP 98 Echo (ping) request  id=0x0009, seq=2/512, ttl=64
 22 13.869400083   172.17.0.2 -> 8.8.8.8      ICMP 98 Echo (ping) request  id=0x0009, seq=3/768, ttl=64

But! If container was started with --net=host internet would work perfectly.

What I've tried so far:

  • altering DNS
  • adding --ip-masq=true to /etc/default/docker (with restart off)
  • enabling everything related to masquerade / ip_forward
  • altering default route
  • everything suggested here

Host config:

$ sudo route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.4.2.1      0.0.0.0         UG    0      0        0 eno1.3001
default         10.3.2.1      0.0.0.0         UG    100    0        0 eno2
10.3.2.0      *               255.255.254.0   U     100    0        0 eno2
10.4.2.0      *               255.255.254.0   U     0      0        0 eno1.3001
nerv8.i         10.3.2.1      255.255.255.255 UGH   100    0        0 eno2
172.17.0.0      *               255.255.0.0     U     0      0        0 docker0

sudo iptables -L, cat /etc/network/interfaces, ifconfig, iptables -t nat -L -nv

Everything is fine, forwarding is also enabled:

$ sudo sysctl net.ipv4.ip_forward 
net.ipv4.ip_forward = 1
like image 617
beyondfloatingpoint Avatar asked Jul 10 '16 19:07

beyondfloatingpoint


People also ask

How do I make my Docker container accessible from network?

To make a port available to services outside of Docker, or to Docker containers which are not connected to the container's network, use the --publish or -p flag. This creates a firewall rule which maps a container port to a port on the Docker host to the outside world.

How can I tell if my Docker is connected to Internet?

To verify the container is connected, use the docker network inspect command. Use docker network disconnect to remove a container from the network. Once connected in network, containers can communicate using only another container's IP address or name.

What IP is 172.17 0.1 Docker?

The bridge connection docker0 – with IP address 172.17. 0.1 – is created by Docker at installation time. Because the host and all containers are connected to that network, our application only needs to listen to it.

Can Docker containers access local network?

Your host can still be accessed from containers in the default bridge networking mode. You just need to reference it by its Docker network IP, instead of localhost or 127.0. 0.1 . Your host's Docker IP will be shown on the inet line.


1 Answers

This is the not full answer you are looking for. But I would like to give some explanation on why the internet is working

If container was started with --net=host internet would work perfectly.

Docker by default supports three networks. In this mode(HOST) container will share the host’s network stack and all interfaces from the host will be available to the container. The container’s host name will match the hostname on the host system

# docker run -it --net=host ubuntu:14.04 /bin/bash
root@labadmin-VirtualBox:/# hostname
labadmin-VirtualBox
Even the IP configuration is same as the host system's IP configuration
root@labadmin-VirtualBox:/# ip addr | grep -A 2 eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:b5:82:2f brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global eth0
       valid_lft forever preferred_lft forever
3: lxcbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default 
root@labadmin-VirtualBox:/# exit
exit

HOST SYSTEM IP CONFIGURATION

# ip addr | grep -A 2 eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:b5:82:2f brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global eth0
       valid_lft forever preferred_lft forever
3: lxcbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default 

Refer this for more information about docker networking.

like image 102
Here_2_learn Avatar answered Sep 22 '22 05:09

Here_2_learn