moby / moby/vpnkit

Idle port disconnection triggered for non-idle port

Open
#414 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
OCaml
Stars
1.2k
Forks
214
PR merge metrics
No merged PRs in 30d

Description

When running any container from https://github.com/jessfraz/dockerfiles (which uses X11 on the host system by sharing DISPLAY), vpnkit closes the connection after some idle timeout.

Example log message on macOS: com.docker.vpnkit[505]: TCP 192.168.65.3:39220 > 192.168.0.59:6000 closing flow due to idle port disconnection

However, this is not what is expected. In this specific example, the container sends TCP Keep Alive messages to the host (on port 6000 for X11 traffic). I would expect vpnkit to consider this a non-idle port and leave the connection intact.

Steps to reproduce (with Docker for Mac 18.06.1-ce-mac74 (26766)):

  1. Add "vpnKitPortMaxIdleTime" : 5 to ~/Library/Group\ Containers/group.com.docker/settings.json. This isn't strictly necessary but makes it faster to test
  2. Start XQuartz and enable "Allow connections from network clients" in its Preferences
  3. Run a Docker container that uses X11: docker run -it -e DISPLAY=$YOUR_IP_HERE:0 jess/atom:latest
  4. Run tcpdump, Wireshark or similar to observe TCP Keep Alives being sent to port 6000
  5. Observe the X11 is closed after ~5s. Docker/vpnkit log will show this was caused due to an idle port

Possibly related: https://github.com/docker/for-mac/issues/2406, https://github.com/mirage/mirage-tcpip/pull/338 (reverted by #389)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with vpnkitPortMaxIdleTime set to 5 and an X11-enabled container, while observing TCP keep-alives with tcpdump or Wireshark. Trace the idle-port handling described in the log and verify that a connection carrying TCP keep-alive traffic remains open instead of closing as idle.

Written by the indexing model from the issue text.

Assessment

Tech stack
ocaml
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.