You are not logged in.

Pages: 1

Topic closed

#1 2018-08-08 02:40:11

gus9182
Member
Registered: 2018-08-08
Posts: 14

Docker can't connect to network

Hello all,

I am trying to use docker but I can't get it to connect to the internet.

$ docker run -it ubuntu apt update
Err:1 http://archive.ubuntu.com/ubuntu bionic InRelease                  
  Temporary failure resolving 'archive.ubuntu.com'
Err:2 http://security.ubuntu.com/ubuntu bionic-security InRelease        
  Temporary failure resolving 'security.ubuntu.com'
Err:3 http://archive.ubuntu.com/ubuntu bionic-updates InRelease          
  Temporary failure resolving 'archive.ubuntu.com'
Err:4 http://archive.ubuntu.com/ubuntu bionic-backports InRelease
  Temporary failure resolving 'archive.ubuntu.com'

I followed the instructions on https://wiki.archlinux.org/index.php/In … forwarding and enabled forwarding, however it didn't work

$ cat /etc/sysctl.d/30-ipforward.conf 
net.ipv4.ip_forward=1
net.ipv6.conf.default.forwarding=1
net.ipv6.conf.all.forwarding=1

If I pass the flag --net=host it works

$ docker run -it --net=host ubuntu apt update

Last edited by gus9182 (2018-08-08 02:43:43)

Offline

#2 2018-08-08 10:07:27

IAmRoot
Member
From: Germany
Registered: 2018-08-08
Posts: 3

Re: Docker can't connect to network

Hello gus9182,

maybe it is an DNS problem or are pings failing too?

If you are using dnsmasq with no further settings, Docker defaults to 8.8.8.8 and 8.8.4.4 in the resolf.conf, maybe this addresses are restricted in your network.

Offline

#3 2018-08-08 14:34:29

gus9182
Member
Registered: 2018-08-08
Posts: 14

Re: Docker can't connect to network

I tried to ping an ip directly but it also didn't work

$ docker run busybox ping -c 1 192.203.230.10
PING 192.203.230.10 (192.203.230.10): 56 data bytes

--- 192.203.230.10 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss

Offline

#4 2018-08-08 21:55:54

gjaltemba
Member
Registered: 2017-12-29
Posts: 26

Re: Docker can't connect to network

What is the output of

docker network inspect bridge
ip route
sysctl -a |grep forward

Offline

#5 2018-08-08 22:30:09

gus9182
Member
Registered: 2018-08-08
Posts: 14

Re: Docker can't connect to network

Output:

 $ docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "454b03f7fdf7254b65fdc3ebd3792360179d6e651956f8bda455e5c3e2d52d30",
        "Created": "2018-08-08T19:24:25.556372078-03:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
] 
$ ip route
default via 192.168.0.1 dev wlp2s0 proto dhcp metric 600 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
192.168.0.0/24 dev wlp2s0 proto kernel scope link src 192.168.0.20 metric 600  
$ sysctl -a |grep forward
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.docker0.forwarding = 1
net.ipv4.conf.docker0.mc_forwarding = 0
net.ipv4.conf.enp3s0f1.forwarding = 1
net.ipv4.conf.enp3s0f1.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.wlp2s0.forwarding = 1
net.ipv4.conf.wlp2s0.mc_forwarding = 0
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_use_pmtu = 0
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.mc_forwarding = 0
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.default.mc_forwarding = 0
net.ipv6.conf.docker0.forwarding = 1
net.ipv6.conf.docker0.mc_forwarding = 0
net.ipv6.conf.enp3s0f1.forwarding = 0
net.ipv6.conf.enp3s0f1.mc_forwarding = 0
net.ipv6.conf.lo.forwarding = 1
net.ipv6.conf.lo.mc_forwarding = 0
net.ipv6.conf.wlp2s0.forwarding = 0
net.ipv6.conf.wlp2s0.mc_forwarding = 0

Offline

#6 2018-08-09 00:47:46

gjaltemba
Member
Registered: 2017-12-29
Posts: 26

Re: Docker can't connect to network

172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown

docker0 is down. try restarting docker to bring docker0 up.

Offline

#7 2018-08-09 01:15:41

gus9182
Member
Registered: 2018-08-08
Posts: 14

Re: Docker can't connect to network

I did:

 $ systemctl stop docker
 $ systemctl start docker

But ip route output still the same:

$ ip route
default via 192.168.0.1 dev wlp2s0 proto dhcp metric 600 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
192.168.0.0/24 dev wlp2s0 proto kernel scope link src 192.168.0.20 metric 600

UPDATE:

There was no container up, when I brought one up the output changed:

$ ip route
default via 192.168.0.1 dev wlp2s0 proto dhcp metric 600 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 
192.168.0.0/24 dev wlp2s0 proto kernel scope link src 192.168.0.20 metric 600
$ docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "9669cf29b4e892975864e7eb0cea35a875e4446e473e385ac1eb8348ee48728e",
        "Created": "2018-08-08T22:13:37.595968111-03:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "f0e3534275de78d44f9f8ab7c8cc56b43b9d86363a7e7dc62ef155a8b1afbb10": {
                "Name": "zealous_torvalds",
                "EndpointID": "ebb3878ad5d8a5abe044f62b2b465741805e1f825913b5e46deb79694b77e267",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

Last edited by gus9182 (2018-08-09 01:23:01)

Offline

#8 2018-08-09 02:43:13

gjaltemba
Member
Registered: 2017-12-29
Posts: 26

Re: Docker can't connect to network

When docker0 link is up, ping is still no go?

Try watch iptables while doing ping count of 100

in one terminal 

docker version 
watch iptables -t filter -nvL

in other

ip route
docker run busybox ping -c 100 192.203.230.10

Offline

#9 2018-08-09 17:23:07

gus9182
Member
Registered: 2018-08-08
Posts: 14

Re: Docker can't connect to network

gjaltemba wrote:

When docker0 link is up, ping is still no go?

Ping still doesn't work sad

terminal 1:

$ docker version
Client:
 Version:      18.05.0-ce
 API version:  1.37
 Go version:   go1.10.2
 Git commit:   f150324782
 Built:        Wed May 16 22:27:45 2018
 OS/Arch:      linux/amd64
 Experimental: false
 Orchestrator: swarm

Server:
 Engine:
  Version:      18.05.0-ce
  API version:  1.37 (minimum version 1.12)
  Go version:   go1.10.2
  Git commit:   f150324782
  Built:        Wed May 16 22:28:17 2018
  OS/Arch:      linux/amd64
  Experimental: false

Watching the output of iptables I noticed that number of packates and bytes altered, but I am not sure about what I can infer from that.

$ watch iptables -t filter -nvL
Chain INPUT (policy ACCEPT 14468 packets, 22M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  100  8400 DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  100  8400 DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0           
  100  8400 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 8256 packets, 1272K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain DOCKER (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  100  8400 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0           
  100  8400 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0           
  100  8400 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  100  8400 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

On terminal 2:

ip route befor docker run:

$ ip route
default via 150.162.53.254 dev enp3s0f1 proto dhcp metric 100 
default via 150.162.229.254 dev wlp2s0 proto dhcp metric 600 
150.162.53.0/24 dev enp3s0f1 proto kernel scope link src 150.162.53.91 metric 100 
150.162.228.0/23 dev wlp2s0 proto kernel scope link src 150.162.229.87 metric 600 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
$ docker run busybox ping -c 100 192.203.230.10
PING 192.203.230.10 (192.203.230.10): 56 data bytes

--- 192.203.230.10 ping statistics ---
100 packets transmitted, 0 packets received, 100% packet loss

ip route after docker run, docker0 is not there anymore

ip route
default via 150.162.53.254 dev enp3s0f1 proto dhcp metric 100 
default via 150.162.229.254 dev wlp2s0 proto dhcp metric 600 
150.162.53.0/24 dev enp3s0f1 proto kernel scope link src 150.162.53.91 metric 100 
150.162.228.0/23 dev wlp2s0 proto kernel scope link src 150.162.229.87 metric 600

Offline

#10 2018-08-09 22:08:45

gjaltemba
Member
Registered: 2017-12-29
Posts: 26

Re: Docker can't connect to network

I have the same setup but unable to reproduce the error. In my installation, docker0 is up always.
Check iptables to see that DOCKER and DOCKER-USER in chain FORWARD is ACCEPT all -- anywhere anywhere.
Also a traceroute will probably end at 172.17.0.1.
Maybe setup a user-defined bridge on another subnet.

iptables -L
docker run busybox traceroute 192.203.230.10

Offline

#11 2018-08-10 19:54:35

gus9182
Member
Registered: 2018-08-08
Posts: 14

Re: Docker can't connect to network

gjaltemba wrote:

Check iptables to see that DOCKER and DOCKER-USER in chain FORWARD is ACCEPT all -- anywhere anywhere.

Yes it is like this


gjaltemba wrote:

Also a traceroute will probably end at 172.17.0.1.

It ended at 172.17.0.2

$ docker run busybox traceroute 192.203.230.10
traceroute to 192.203.230.10 (192.203.230.10), 30 hops max, 46 byte packets
 1  1d5898606894 (172.17.0.2)  3037.288 ms !H  3040.124 ms !H  3040.070 ms !H

Tried again and:

traceroute to 192.203.230.10 (192.203.230.10), 30 hops max, 46 byte packets
 1  172.17.0.1 (172.17.0.1)  0.005 ms  0.142 ms  0.003 ms
 2  *  *  *
 3  *  *  *
 4  *  *  *
 5  *  *  *
 6  *  *  *
 7  *  *  *
 8  *  *  *
 9  *  *  *
10  *  *  *
11  *  *  *
12  *  *  *
13  *  *  *
14  *  *  *
15  *  *  *
16  *  *  *
17  *  *  *
18  *  *  *
19  *  *  *
20  *  *  *
21  *  *  *
22  *  *  *
23  *  *  *
24  *  *  *
25  *  *  *
26  *  *  *
27  *  *  *
28  *  *  *
29  *  *  *
30  *  *  *
gjaltemba wrote:

Maybe setup a user-defined bridge on another subnet.

I will take a look into this.

I saw this other forum post where this guy said he had a problem with /etc/hosts and after he fixed it everything worked, can you check if mine is correct please?

# Static table lookup for hostnames.
# See hosts(5) for details.
127.0.0.1	localhost
::1		localhost
127.0.1.1	acer.localdomain	acer localhost

Last edited by gus9182 (2018-08-10 20:23:25)

Offline

#12 2018-08-11 13:59:06

gjaltemba
Member
Registered: 2017-12-29
Posts: 26

Re: Docker can't connect to network

cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

Offline

#13 2018-10-26 10:52:03

Fritzendgltig
Member
Registered: 2016-06-15
Posts: 9

Re: Docker can't connect to network

I'm having the same issue. My system has the exact same settings according to the prints from the commands you executed along in this thread.
Have you resolved the problem? I can't get it working...

I'm using systemd-networkd and systemd-resolved though.

Last edited by Fritzendgltig (2018-10-26 10:52:48)

Offline

#14 2020-07-03 02:27:48

Mdeveloper
Member
Registered: 2020-07-03
Posts: 1

Re: Docker can't connect to network

I had the same problem and solved by this solution:

# trust the docker interface
firewall-cmd --permanent --zone=trusted --change-interface=docker0
# accept IPv4 traffic
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 4 -i docker0 -j ACCEPT
# any ports on the host you want to access from the containers (strapi port 1337 here)
firewall-cmd --permanent --zone=trusted --add-port=1337/tcp
firewall-cmd --reload
service docker restart

source: docker-ce-on-centos-7

Offline

#15 2020-07-03 07:56:10

V1del
Forum Moderator
Registered: 2012-10-16
Posts: 25,373

Re: Docker can't connect to network

Thanks for sharing, however I'll take the opportunity to close this old thread. It's also quite unlikely that a cent OS solution is directly applicable on Arch

Closing.

Offline

Pages: 1

Topic closed

Board footer

Powered by FluxBB