moby / moby/vpnkit

Port <xxxx> for service <abc> is already opened by another service

Open
#576 0 comments 10 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
OCaml
Stars
1.2k
Forks
214
PR merge metrics
No merged PRs in 30d

Description

Getting this error every 30 seconds the moment I inject a service in my kubernetes cluster.
Using Docker Desktop on Windows 10, so vpnkit-controller is installed by the docker-desktop setup.
I've already reset the cluster several times and tried to reproduce this step by step.

Applying deployments to my cluster is no problem at all but the moment I apply a service to expose my pods to the cluster via NodePort I'm seeing these errors in the log of the vpnkit-controller pod. Port-forwarding still works and my services are available on my host machine but I'd like to understand what is going wrong here.

Plus I'm having an issue with outbound ports. When a pod issues a lot of external requests it randomly gets timeouts, apparently because tcp sockets are exhausted at some point. When looking in the resource monitor of windows I can see that vpnkit opens a lot of ports but it seems to keep them open. I'm not sure if both issues are connected but something is going on here and I'm not sure how to analyse it any further.

If you have an idea what could cause this - let me know. If you want to dig deeper and reproduce this, also let me know - I could provide a detailed example then.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the NodePort case on Docker Desktop for Windows 10 and inspect the vpnkit-controller pod logs for the repeated port-conflict error. Then investigate the outbound-request timeout and apparent TCP socket exhaustion using the Windows resource monitor. Done means determining whether the symptoms share a cause and documenting a reproducible diagnosis.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, kubernetes, ocaml
Domain
devops, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.