From 402901eb33c0613d573097f2140f740357ab48cb Mon Sep 17 00:00:00 2001 From: Felix Schnellert Date: Wed, 14 Oct 2026 15:02:06 +0200 Subject: [PATCH] libnetwork: no IPv6 for ingress sandbox on docker_gwbridge Swarm ingress ports are published on the ingress sandbox's docker_gwbridge endpoint. If docker_gwbridge has IPv6 enabled, that endpoint got an IPv6 address, and host IPv6 traffic was DNATed to it. The sandbox only forwards IPv4 (its fwmark/IPVS rules are IPv4-only), so the connection was refused. Create the ingress sandbox's docker_gwbridge endpoint without IPv6. With no IPv6 gateway, the IPv4 gateway endpoint also serves IPv6, and the userland proxy forwards host IPv6 traffic to its IPv4 address, as it does when docker_gwbridge has no IPv6. Signed-off-by: Felix Schnellert --- daemon/libnetwork/default_gateway.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/daemon/libnetwork/default_gateway.go b/daemon/libnetwork/default_gateway.go index 070de23ba9..5700501425 100644 --- a/daemon/libnetwork/default_gateway.go +++ b/daemon/libnetwork/default_gateway.go @@ -52,6 +52,14 @@ func (sb *Sandbox) setupDefaultGW() error { // endpoint that needs the gateway. createOptions := []EndpointOption{CreateOptionDisableResolution()} + // The ingress sandbox only forwards IPv4 (see configureFWMark), so don't give + // it an IPv6 address on docker_gwbridge. Its endpoint then serves as the IPv6 + // gateway via its IPv4 address, and the userland proxy forwards host IPv6 + // traffic to its published ports over IPv4. + if sb.ingress { + createOptions = append(createOptions, CreateOptionDisableIPv6()) + } + var gwName string if len(sb.containerID) <= gwEPlen { gwName = "gateway_" + sb.containerID