libnetwork: no IPv6 for ingress sandbox on docker_gwbridge

Swarm ingress ports are published on the ingress sandbox's
docker_gwbridge endpoint. If docker_gwbridge has IPv6 enabled, that
endpoint got an IPv6 address, and host IPv6 traffic was DNATed to it.
The sandbox only forwards IPv4 (its fwmark/IPVS rules are IPv4-only),
so the connection was refused.

Create the ingress sandbox's docker_gwbridge endpoint without IPv6.
With no IPv6 gateway, the IPv4 gateway endpoint also serves IPv6, and
the userland proxy forwards host IPv6 traffic to its IPv4 address, as
it does when docker_gwbridge has no IPv6.

Signed-off-by: Felix Schnellert <felix.schnellert@skriptfabrik.com>

daemon/libnetwork/default_gateway.go

@@ -52,6 +52,14 @@ func (sb *Sandbox) setupDefaultGW() error {
 	// endpoint that needs the gateway.
 	createOptions := []EndpointOption{CreateOptionDisableResolution()}
 
+	// The ingress sandbox only forwards IPv4 (see configureFWMark), so don't give
+	// it an IPv6 address on docker_gwbridge. Its endpoint then serves as the IPv6
+	// gateway via its IPv4 address, and the userland proxy forwards host IPv6
+	// traffic to its published ports over IPv4.
+	if sb.ingress {
+		createOptions = append(createOptions, CreateOptionDisableIPv6())
+	}
+
 	var gwName string
 	if len(sb.containerID) <= gwEPlen {
 		gwName = "gateway_" + sb.containerID