Containers can't access the web

6 months ago by nile_istic to c/docker

Full disclosure: I'm very new and very dumb. So. Bear that in mind.

I'm running Docker on Ubuntu Server 24.04 LTS. I installed it according to the official directions provided by Docker. The container example I'll refer to here is Beets, but same happens on Calibre Web Automated and a couple other containers I tried.

Basically, from within the container I can't ping google. This:

docker exec -it beets ping -c 3 google.com

returns:

PING google.com (142.250.113.138): 56 data bytes google.com ping statistics: 3 packets transmitted, 0 packets received, 100% packet loss

So, in Beets case, it can't access musicbrainz to do.. well, anything it's built to do, because it (and any other container I run) doesn't seem to be able to access the internet? Idk.

I've tried a whole bunch of stuff at this point (not really knowing what any of it means, mind you) and nothing has worked. I've checked /etc/resolved.conf, which just lists 127.0.0.53, which is apparently some sort of systemd DNS cache? Ngl, I don't really know what that means, but a potential solution I read was to override it by editing /etc/docker/daemon.json to include something like dns: [8.8.4.4, 8.8.8.8] (I don't recall the exact syntax, sorry). Anyway, that was even worse, because running the ping from inside the container then didn't resolve an IP for google at all and just said "bad address". I tried making a user-defined bridge, which output the exact same as above: 100% packet loss. I tried rebuilding the iptables, nothing. Directing containers to a network in the compose yml, restarting containers, restarting docker, rebooting. Idk.

Only thing that seems to work is adding network_mode: "host" to the container's compose yml, which... I mean, if that's the solution that works, that's what I'll do. But I'm wondering what exactly is going wrong otherwise, and if I can fix it.

Any help greatly appreciated.

moonpiedumplings 3 points 6 months ago path: 0 23033042, hotness: undefined, score: 3, children: 1
nile_istic 1 point 6 months ago

Tbh, I don't know what Incus or LXD are. If I'm using either of those, it's news to me. I'll look into it though, thanks.

path: 0 23033042 23077620, hotness: undefined, score: 1, children: 0
nek0d3r 1 point 6 months ago

Silly question, but is Ubuntu the host machine, or is it WSL or anything like that?

path: 0 23056957, hotness: undefined, score: 1, children: 1
nile_istic 1 point 6 months ago

Ubuntu is the host machine, yes.

path: 0 23056957 23077526, hotness: undefined, score: 1, children: 0
mcx808 1 point 6 months ago

If you’re using docker compose, it will create a default bridge network with a CIDR that could overlap with a real network routable to the host, which messes up network egress from the container.

If this is the case it’s useful to specify the bridge network CIDR in the compose file as something you don’t use.

path: 0 23107548, hotness: undefined, score: 1, children: 0
onlinepersona 1 point 6 months ago

It might be your network. See this post on the docker forums. Try using another WiFi network or your phone's hotspot for testing. If possible, and you're on a server, try using the LAN cable.

path: 0 23052437, hotness: undefined, score: 1, children: 1
nile_istic 1 point 6 months ago

My host is connected via Ethernet cable already.

path: 0 23052437 23077573, hotness: undefined, score: 1, children: 0
Rogue 1 point 6 months ago

Are you using wireguard or any other complex networking? If so you may need to reduce Docker's MTU

path: 0 23054547, hotness: undefined, score: 1, children: 1
nile_istic 1 point 6 months ago

To my knowledge no. The only networking related changes I made was using the netplan config to make my host IP static.

path: 0 23054547 23077561, hotness: undefined, score: 1, children: 0
ExperimentalGuy 1 point 6 months ago

Is your firewall preventing outbound requests from random ports on ur computer?

path: 0 23056104, hotness: undefined, score: 1, children: 1
nile_istic 1 point 6 months ago

I disabled ufw, and I cleared ipstables and let Docker choose its own rules. I think.

path: 0 23056104 23077535, hotness: undefined, score: 1, children: 0
docker
docker

@programming.dev

login for more options
1479
100
12

go to feed...