dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-08-10 17:15:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove the option to ignore failure to disable ipv6

Browse Source 
26.1.1 added env var DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE to make it
possible to create an IPv4-only network, even with a read-only
"/proc/sys/net" that meant IPv6 could not be disabled on an
interface.

In 27.0 it's easier to enable IPv6, just '--ipv6' when creating the
network - in particular, there's no need to allocate a subnet, because
a unique-local prefix will be assigned by default).

So, this change removes the env-var workaround. Now, the workarounds
are to enable IPv6, mount "/proc/sys/net" read-write, disable IPv6
by default in OS configuration, or remove support for IPv6 from the
kernel.

Signed-off-by: Rob Murray <rob.murray@docker.com>
This commit is contained in:
Rob Murray
2024-06-12 16:28:29 +01:00
parent 4fec999c11
commit b7f1036cd9
2 changed files with 5 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
integration/networking/bridge_test.go
View File

@@ -813,8 +813,7 @@ func TestSetInterfaceSysctl(t *testing.T) {
// With a read-only "/proc/sys/net" filesystem (simulated using env var
// DOCKER_TEST_RO_DISABLE_IPV6), check that if IPv6 can't be disabled on a
// container interface, container creation fails - unless the error is ignored by
// setting env var DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE=1.
// container interface, container creation fails.
// Regression test for https://github.com/moby/moby/issues/47751
func TestReadOnlySlashProc(t *testing.T) {
skip.If(t, testEnv.DaemonInfo.OSType == "windows")
@@ -830,18 +829,11 @@ func TestReadOnlySlashProc(t *testing.T) {
name: "Normality",
},
{
name: "Read only no workaround",
name: "Read only",
daemonEnv: []string{
"DOCKER_TEST_RO_DISABLE_IPV6=1",
},
expErr: "failed to disable IPv6 on container's interface eth0, set env var DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE=1 to ignore this error",
},
{
name: "Read only with workaround",
daemonEnv: []string{
"DOCKER_TEST_RO_DISABLE_IPV6=1",
"DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE=1",
},
expErr: "failed to disable IPv6 on container's interface eth0",
},
}

14
libnetwork/osl/namespace_linux.go
View File

@@ -671,20 +671,10 @@ func setIPv6(nspath, iface string, enable bool) error {
// The user asked for IPv6 on the interface, and we can't give it to them.
// But, in line with the IsNotExist case above, just log.
logger.Warn("Cannot enable IPv6 on container interface, continuing.")
} else if os.Getenv("DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE") == "1" {
// TODO(robmry) - remove this escape hatch for https://github.com/moby/moby/issues/47751
// If the "/proc" file exists but isn't writable, we can't disable IPv6, which is
// https://github.com/moby/moby/security/advisories/GHSA-x84c-p2g9-rqv9 ... so,
// the user is required to override the error (or configure IPv6, or disable IPv6
// by default in the OS, or make the "/proc" file writable). Once it's possible
// to enable IPv6 without having to configure IPAM etc, the env var should be
// removed. Then the user will have to explicitly enable IPv6 if it can't be
// disabled on the interface.
logger.Info("Cannot disable IPv6 on container interface but DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE=1, continuing.")
} else {
logger.Error("Cannot disable IPv6 on container interface. Set env var DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE=1 to ignore.")
logger.Error("Cannot disable IPv6 on container interface.")
errCh <- fmt.Errorf(
"failed to %s IPv6 on container's interface %s, set env var DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE=1 to ignore this error",
"failed to %s IPv6 on container's interface %s",
action, iface)
}
return