cloudflare / cloudflare/cloudflared

Argo Killed itself after disabled ICMP proxy on docker container🐛

Open
#1,016 1 comment 0 reactions 0 assignees View on GitHub
Priority: Normal Type: Bug
Dominant language
Go
Stars
15.6k
Forks
1.4k
PR merge metrics
No merged PRs in 30d

Description

The minimal docker container file:

```dockerfile
FROM ubuntu:latest
ENV ARGO=https://github.com/cloudflare/cloudflared/releases/download/2023.6.1/cloudflared-linux-amd64
RUN sysctl net.ipv4.ping_group_range
RUN sysctl net.ipv4.ping_group_range='10000 10000'
RUN sysctl -p
RUN curl -fsSL "$ARGO" -o argo && chmod +x argo
RUN ./argo tunnel --protocol http2 --no-autoupdate --url http://127.0.0.1:7860
```

To be noted that, the docker container is not controled by the user, so no guaranteed parameters of `docker run` `xxxx`.

According to that the result of

```bash
--> RUN sysctl net.ipv4.ping_group_range
net.ipv4.ping_group_range = 1 0
DONE 0.0s

--> RUN sysctl net.ipv4.ping_group_range='10000 10000'
sysctl: setting key "net.ipv4.ping_group_range", ignoring: Read-only file system
DONE 0.0s
```

And for `argo tunnel` the log is:
```bash
--> RUN ./argo tunnel --protocol http2 --no-autoupdate --url http://127.0.0.1:7860
2023-07-05T20:47:27Z INF Thank you for trying Cloudflare Tunnel. Doing so, without a Cloudflare account, is a quick way to experiment and try it out. However, be aware that these account-less Tunnels have no uptime guarantee. If you intend to use Tunnels in production you should use a pre-created named tunnel by following: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
2023-07-05T20:47:27Z INF Requesting new quick Tunnel on trycloudflare.com...
2023-07-05T20:47:28Z INF +--------------------------------------------------------------------------------------------+
2023-07-05T20:47:28Z INF | Your quick Tunnel has been created! Visit it at (it may take some time to be reachable): |
2023-07-05T20:47:28Z INF | https://slim-venue-dozens-wayne.trycloudflare.com |
2023-07-05T20:47:28Z INF +--------------------------------------------------------------------------------------------+
2023-07-05T20:47:28Z INF Cannot determine default configuration path. No file [config.yml config.yaml] in [~/.cloudflared ~/.cloudflare-warp ~/cloudflare-warp /etc/cloudflared /usr/local/etc/cloudflared]
2023-07-05T20:47:28Z INF Version 2023.6.1
2023-07-05T20:47:28Z INF GOOS: linux, GOVersion: go1.19.6, GoArch: amd64
2023-07-05T20:47:28Z INF Settings: map[ha-connections:1 no-autoupdate:true p:http2 protocol:http2 url:http://127.0.0.1:7860]
2023-07-05T20:47:28Z INF Generated Connector ID: 1c615984-ecc1-4ac4-9664-ac1e248d95a7
2023-07-05T20:47:28Z INF Initial protocol http2
2023-07-05T20:47:28Z INF ICMP proxy will use 10.19.85.88 as source for IPv4
2023-07-05T20:47:28Z INF ICMP proxy will use fe80::543b:39ff:fe17:5e4c in zone eth0 as source for IPv6
2023-07-05T20:47:28Z WRN The user running cloudflared process has a GID (group ID) that is not within ping_group_range. You might need to add that user to a group within that range, or instead update the range to encompass a group the user is already in by modifying /proc/sys/net/ipv4/ping_group_range. Otherwise cloudflared will not be able to ping this network error="Group ID 1000 is not between ping group 1 to 0"
2023-07-05T20:47:28Z WRN ICMP proxy feature is disabled error="cannot create ICMPv4 proxy: Group ID 1000 is not between ping group 1 to 0 nor ICMPv6 proxy: socket: permission denied"
2023-07-05T20:47:28Z INF Starting metrics server on 127.0.0.1:46705/metrics
Killed
```

I searched two days on the internet, no legal solution for original `user` who has no such previlige to run the docker container to get the ICMP access inside the docker, but it should not be the reason to get `killed`, maybe fallback to `httping` is another option. 🤗

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.