Swarm ingress ports are published on the ingress sandbox's
docker_gwbridge endpoint. If docker_gwbridge has IPv6 enabled, that
endpoint got an IPv6 address, and host IPv6 traffic was DNATed to it.
The sandbox only forwards IPv4 (its fwmark/IPVS rules are IPv4-only),
so the connection was refused.
Create the ingress sandbox's docker_gwbridge endpoint without IPv6.
With no IPv6 gateway, the IPv4 gateway endpoint also serves IPv6, and
the userland proxy forwards host IPv6 traffic to its IPv4 address, as
it does when docker_gwbridge has no IPv6.
Signed-off-by: Felix Schnellert <felix.schnellert@skriptfabrik.com>
Felix Schnellert
402901eb33