From 071e6472db32a34ed0f73f7166e0c2b405ae23a5 Mon Sep 17 00:00:00 2001 From: Rob Murray Date: Wed, 27 Aug 2025 16:37:00 +0100 Subject: [PATCH] Unmap IPv4 addresses loaded from store When a endpoint's net.IPNet is loaded from store and converted to a netip.Addr, unmap it so that iptables rules don't contain IPv4-mapped IPv6 addresses. Signed-off-by: Rob Murray --- daemon/libnetwork/drivers/bridge/bridge_linux.go | 1 + 1 file changed, 1 insertion(+) diff --git a/daemon/libnetwork/drivers/bridge/bridge_linux.go b/daemon/libnetwork/drivers/bridge/bridge_linux.go index 602d6e4d28..32f002e20d 100644 --- a/daemon/libnetwork/drivers/bridge/bridge_linux.go +++ b/daemon/libnetwork/drivers/bridge/bridge_linux.go @@ -1231,6 +1231,7 @@ func (d *driver) CreateEndpoint(ctx context.Context, nid, eid string, ifInfo dri func (ep *bridgeEndpoint) netipAddrs() (v4, v6 netip.Addr) { if ep.addr != nil { v4, _ = netip.AddrFromSlice(ep.addr.IP) + v4 = v4.Unmap() } if ep.addrv6 != nil { v6, _ = netip.AddrFromSlice(ep.addrv6.IP)