mobi/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2025-07-29 07:21:35 +03:00
Code Activity

libnet/d/bridge: Don't set container's gateway when network is internal

Browse Source 
So far, internal networks were only isolated from the host by iptables
DROP rules. As a consequence, outbound connections from containers would
timeout instead of being "rejected" through an immediate ICMP dest/port
unreachable, a TCP RST or a failing `connect` syscall.

This was visible when internal containers were trying to resolve a
domain that don't match any container on the same network (be it a truly
"external" domain, or a container that don't exist/is dead). In that
case, the embedded resolver would try to forward DNS queries for the
different values of resolv.conf `search` option, making DNS resolution
slow to return an error, and the slowness being exacerbated by some libc
implementations.

This change makes `connect` syscall to return ENETUNREACH, and thus
solves the broader issue of failing fast when external connections are
attempted.

Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This commit is contained in:
Albin Kerouanton
2023-10-09 11:59:13 +02:00
parent f6fa56194f
commit cbc2a71c27
5 changed files with 31 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
integration-cli/docker_cli_network_unix_test.go
View File

@ -31,6 +31,7 @@ import (
"github.com/vishvananda/netlink"
"golang.org/x/sys/unix"
"gotest.tools/v3/assert"
is "gotest.tools/v3/assert/cmp"
"gotest.tools/v3/icmd"
)
@ -1611,7 +1612,7 @@ func (s *DockerCLINetworkSuite) TestDockerNetworkInternalMode(c *testing.T) {
assert.Assert(c, waitRun("second") == nil)
out, _, err := dockerCmdWithError("exec", "first", "ping", "-W", "4", "-c", "1", "8.8.8.8")
assert.ErrorContains(c, err, "")
assert.Assert(c, strings.Contains(out, "100% packet loss"))
assert.Assert(c, is.Contains(out, "Network is unreachable"))
_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
assert.NilError(c, err)
}