Docker: ipv6 NAT network not working

Maintainer: @G-M0N3Y-2503
Environment: OpenWrt 22.03 (aarch64_cortex-a53)

Description:

I modified the dockerd file:

--- a/dockerd
+++ b/dockerd
@@ -184,6 +184,8 @@
        config_get ip globals ip ""
        config_get fixed_cidr globals fixed_cidr ""
        config_get fixed_cidr_v6 globals fixed_cidr_v6 ""
+       config_get experimental globals experimental ""
+       config_get ip6tables globals ip6tables ""

        . /usr/share/libubox/jshn.sh
        json_init
@@ -205,6 +207,8 @@
        [ -z "${ip}" ] || json_add_string "ip" "${ip}"
        [ -z "${fixed_cidr}" ] || json_add_string "fixed-cidr" "${fixed_cidr}"
        [ -z "${fixed_cidr_v6}" ] || json_add_string "fixed-cidr-v6" "${fixed_cidr_v6}"
+       [ -z "${experimental}" ] || json_add_boolean "experimental" "${experimental}"
+       [ -z "${ip6tables}" ] || json_add_boolean "ip6tables" "${ip6tables}"
        json_dump > "${DOCKERD_CONF}"

        [ "${iptables}" -eq "1" ] && config_foreach iptables_add_blocking_rule firewall

and config:

option fixed_cidr_v6 'fc00:100:1::/80'
option ipv6 '1'
option experimental '1'
option ip6tables '1'

The daemon.json is like

{ "data-root": "\/opt\/docker\/", "log-level": "warn", "iptables": true, "ipv6": true, "fixed-cidr-v6": "fc00:100:1::\/80", "experimental": true, "ip6tables": true }

My new container has IPv6 address:

[
    {
        "Name": "bridge",
        "Id": "bdc1c7dc065d4bae95a43d3e9cd47be91422f527581f4062c94892252532600a",
        "Created": "2022-08-30T13:13:32.01903987+08:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": true,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                },
                {
                    "Subnet": "fc00:100:1::/80",
                    "Gateway": "fc00:100:1::1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "31b3d129e7bc60d753c431fe1fd2590303bca947cf5a8f69790cd9f96696268e": {
                "Name": "clash",
                "EndpointID": "acbf5741b3bbaa4709bb5f78e33641664cbecf36994eb550548d3ed891cab8ef",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": "fc00:100:1::242:ac11:2/80"
            }
        },
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

but I can't ping outside ipv6 address in the container.

Start with the package's dockerd init script, especially the configuration generation around fixed-cidr-v6, experimental, and ip6tables, and compare it with the reported daemon.json. Reproduce the OpenWrt 22.03 setup using the listed IPv6 bridge configuration and test external IPv6 connectivity from a container. Done means the documented configuration provides working IPv6 connectivity outside the container.