devcontainers / devcontainers/features
Load module ip6_tables to make docker --ipv6 networks work
- Dominant language
- Shell
- Stars
- 1.5k
- Forks
- 621
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 4
Description
Hi all - moby maintainer here ...
This is related to:
- https://github.com/devcontainers/features/issues/1023
- https://github.com/devcontainers/features/pull/1068
- https://github.com/moby/moby/issues/47895
In moby 27.0 we enabled `ip6tables` by default. So, to create a Docker network with `--ipv6` the `ip6_tables` kernel module is needed. But, in Codespaces it's not loaded on startup.
In the issue/PR linked above, [devcontainers option](https://github.com/devcontainers/features/tree/main/src/docker-in-docker#options) `disableIp6tables` was added to work around the problem by adding `--ip6tables=false` to docker's command line. That'll restore the pre-27.0 behaviour, so docker won't try to create ip6tables rules. But, docker bridge networks won't work properly without those rules (and users have to know to set the option, or they get a complicated-looking error from docker when trying to create a network with `--ipv6`).
The official Docker-in-Docker image tries to load modules on the host using this [unlikely-looking trick](https://github.com/docker-library/docker/blob/6ce7fe78a5a66dadf37e9226d8485e94e894814f/modprobe.sh) ... `ip link show ip6_tables` (as root). It produces an error about the link not existing but, in a Codespace, it does trigger the module load - then `ip6tables` works normally. So, if the module is loaded before dockerd starts, `--ipv6` networks should just-work.
Would it be possible to add that `ip link show` trick, probably to the `docker-init.sh` script? Then, in a lot of cases, there shouldn't be any need to disable docker's use of ip6tables.
Contributor guide
Assessment
This issue has not been assessed yet.