FarisZR
22 فبراير 2025، 3:28م
1
صدر تحديث دوكر 28.0.0 قبل ثلاث ايام مع تغييرات عدة لطريقة عمل الشبكة, اهمها زيادة الحدود الامنية لطريقة عمل الشبكات.
اهمها اضافة قواعد اكثر صرامة امنيه داخل ملف قواعد FORWARD (Forward Chain).
sudo iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited
sudo iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
تطبيق التغييرات بشكل دائم:
sudo bash
iptables-save > /etc/iptables/rules.v4
(التعديلات فقط على ipv4 لان المشكلة فقط على IPv4)
يعمل فريق دوكر حاليا على نقل معظم قواعد شبكات دوكر الى ملف قواعد (Iptables Chain) منفصل.
مفتوحة 03:44AM - 20 Feb 25 UTC
kind/bug
area/networking
area/networking/firewalling
area/networking/d/bridge
version/28.0
### Description
I use tail scale to allow containers/services to communicate wi… th containers on different hosts.
Prior to 28, no changes where needed as docker would use /etc/resolv.conf which tailscale updates to point to itself as a resolver,
Running docker run --rm alpine cat /etc/resolv.conf on 27.5.1 shows
```
# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.
nameserver 100.100.100.100
search tail67b84.ts.net
# Based on host file: '/etc/resolv.conf'
```
Reading the change logs for 28, my understanding this should still happen?
### Reproduce
Update to docker engine 28
Containers talking to Tailscale computers will no longer work.
### Expected behavior
They continue to talk
### docker version
```bash
Client: Docker Engine - Community
Version: 27.5.1
API version: 1.47
Go version: go1.22.11
Git commit: 9f9e405
Built: Wed Jan 22 13:41:17 2025
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 27.5.1
API version: 1.47 (minimum version 1.24)
Go version: go1.22.11
Git commit: 4c9b3b0
Built: Wed Jan 22 13:41:17 2025
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.7.25
GitCommit: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
runc:
Version: 1.2.4
GitCommit: v1.2.4-0-g6c52b3f
docker-init:
Version: 0.19.0
GitCommit: de40ad0
```
### docker info
```bash
Client: Docker Engine - Community
Version: 27.5.1
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.21.0
Path: /usr/libexec/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.33.0
Path: /usr/libexec/docker/cli-plugins/docker-compose
Server:
Containers: 11
Running: 10
Paused: 0
Stopped: 1
Images: 11
Server Version: 27.5.1
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
runc version: v1.2.4-0-g6c52b3f
init version: de40ad0
Security Options:
apparmor
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.1.0-31-cloud-amd64
Operating System: Debian GNU/Linux 12 (bookworm)
OSType: linux
Architecture: x86_64
CPUs: 1
Total Memory: 1.886GiB
Name: SYD01
ID: 5420cb38-1a11-4c16-a531-d77bc7577948
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
Default Address Pools:
Base: 172.16.0.0/12, Size: 24
```
### Additional Info
I have rolled back to 27.5.1 which restores communication.
28.0.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
docker/cli, 28.0.0 milestone
moby/moby, 28.0.0 milestone
Deprecated and removed featur...
https://www.reddit.com/r/docker/comments/1itvg36/dockerce_update_breaking_networking/
مفتوحة 03:44AM - 20 Feb 25 UTC
kind/bug
area/networking
area/networking/firewalling
area/networking/d/bridge
version/28.0
### Description
I use tail scale to allow containers/services to communicate wi… th containers on different hosts.
Prior to 28, no changes where needed as docker would use /etc/resolv.conf which tailscale updates to point to itself as a resolver,
Running docker run --rm alpine cat /etc/resolv.conf on 27.5.1 shows
```
# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.
nameserver 100.100.100.100
search tail67b84.ts.net
# Based on host file: '/etc/resolv.conf'
```
Reading the change logs for 28, my understanding this should still happen?
### Reproduce
Update to docker engine 28
Containers talking to Tailscale computers will no longer work.
### Expected behavior
They continue to talk
### docker version
```bash
Client: Docker Engine - Community
Version: 27.5.1
API version: 1.47
Go version: go1.22.11
Git commit: 9f9e405
Built: Wed Jan 22 13:41:17 2025
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 27.5.1
API version: 1.47 (minimum version 1.24)
Go version: go1.22.11
Git commit: 4c9b3b0
Built: Wed Jan 22 13:41:17 2025
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.7.25
GitCommit: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
runc:
Version: 1.2.4
GitCommit: v1.2.4-0-g6c52b3f
docker-init:
Version: 0.19.0
GitCommit: de40ad0
```
### docker info
```bash
Client: Docker Engine - Community
Version: 27.5.1
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.21.0
Path: /usr/libexec/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.33.0
Path: /usr/libexec/docker/cli-plugins/docker-compose
Server:
Containers: 11
Running: 10
Paused: 0
Stopped: 1
Images: 11
Server Version: 27.5.1
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
runc version: v1.2.4-0-g6c52b3f
init version: de40ad0
Security Options:
apparmor
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.1.0-31-cloud-amd64
Operating System: Debian GNU/Linux 12 (bookworm)
OSType: linux
Architecture: x86_64
CPUs: 1
Total Memory: 1.886GiB
Name: SYD01
ID: 5420cb38-1a11-4c16-a531-d77bc7577948
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
Default Address Pools:
Base: 172.16.0.0/12, Size: 24
```
### Additional Info
I have rolled back to 27.5.1 which restores communication.
مفتوحة 08:43PM - 20 Feb 25 UTC
kind/bug
area/networking
area/networking/firewalling
area/networking/d/bridge
version/28.0
### Description
I have Docker installed using [this Ansible role](https://git.c… oop/webarch/docker) on Debian, this results in a `/etc/docker/daemon.json` containing:
```json
{
"dns": [
"81.95.52.10",
"81.95.52.53"
],
"log-driver": "syslog",
"storage-driver": "overlay2"
}
```
With 28.0.0 Discourse can be accessed from the `localhost` but not remotely.
### Reproduce
```bash
apt get upgrade
```
To fix:
```bash
service docker stop
apt purge docker-ce docker-ce-cli
apt install docker-ce=5:27.5.1-1~debian.12~bookworm
```
### Expected behavior
The Docker container should be accessible from the Internet.
### docker version
```bash
Client: Docker Engine - Community
Version: 28.0.0
API version: 1.48
Go version: go1.23.6
Git commit: f9ced58
Built: Wed Feb 19 22:10:43 2025
OS/Arch: linux/amd64
Context: default
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.48/version": dial unix /var/run/docker.sock: connect: permission denied
```
### docker info
```bash
Client: Docker Engine - Community
Version: 28.0.0
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.21.0
Path: /usr/libexec/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.33.0
Path: /usr/libexec/docker/cli-plugins/docker-compose
Server:
ERROR: permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.48/info": dial unix /var/run/docker.sock: connect: permission denied
errors pretty printing info
```
### Additional Info
The strange thing is that on a development server which broke with an upgrade, was downgraded and then upgraded again to reproduce the problem for this report is now working with 28.0.0 🤷 the firewall on the server in question:
```bash
iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER 0 -- 0.0.0.0/0 0.0.0.0/0
ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED
DOCKER-ISOLATION-STAGE-1 0 -- 0.0.0.0/0 0.0.0.0/0
DOCKER 0 -- 0.0.0.0/0 0.0.0.0/0 match-set docker-ext-bridges-v4 dst
ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (1 references)
target prot opt source destination
ACCEPT 6 -- 0.0.0.0/0 172.17.0.2 tcp dpt:443
ACCEPT 6 -- 0.0.0.0/0 172.17.0.2 tcp dpt:80
DROP 0 -- 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target prot opt source destination
DOCKER-ISOLATION-STAGE-2 0 -- 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target prot opt source destination
DROP 0 -- 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0
```
3 إعجابات
