devcontainers / devcontainers/features

Load module ip6_tables to make docker --ipv6 networks work

Open
#1,206 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
1.5k
Forks
621
Avg merge
2d 11h
Merged PRs (30d)
4

Description

Hi all - moby maintainer here ...

This is related to:
- https://github.com/devcontainers/features/issues/1023
- https://github.com/devcontainers/features/pull/1068
- https://github.com/moby/moby/issues/47895

In moby 27.0 we enabled `ip6tables` by default. So, to create a Docker network with `--ipv6` the `ip6_tables` kernel module is needed. But, in Codespaces it's not loaded on startup.

In the issue/PR linked above, [devcontainers option](https://github.com/devcontainers/features/tree/main/src/docker-in-docker#options) `disableIp6tables` was added to work around the problem by adding `--ip6tables=false` to docker's command line. That'll restore the pre-27.0 behaviour, so docker won't try to create ip6tables rules. But, docker bridge networks won't work properly without those rules (and users have to know to set the option, or they get a complicated-looking error from docker when trying to create a network with `--ipv6`).

The official Docker-in-Docker image tries to load modules on the host using this [unlikely-looking trick](https://github.com/docker-library/docker/blob/6ce7fe78a5a66dadf37e9226d8485e94e894814f/modprobe.sh) ... `ip link show ip6_tables` (as root). It produces an error about the link not existing but, in a Codespace, it does trigger the module load - then `ip6tables` works normally. So, if the module is loaded before dockerd starts, `--ipv6` networks should just-work.

Would it be possible to add that `ip link show` trick, probably to the `docker-init.sh` script? Then, in a lot of cases, there shouldn't be any need to disable docker's use of ip6tables.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.