Join Log in
Score:1
Kacper G. avatar Server

docker/podman container with public IPv6

br flag
Kacper G.

I have got a server with IPv4 address and IPv6 /64 subnet (let's say 2001:db8::/64), both public. Server itself has the following IPv6 address: 2001:db8::1/64. The gateway is fe80::1 (which causes problems with docker/podman, because it's not in the same subnet).

My goal is to create docker/podman container (WWW server, for example) with its own public IPv6 (let's say 2001:db8::2/64). From my understanding, such a setup needs macvlan network. So the setup would look as follows:

picture1

I managed to partially fulfill this setup using bridge network and the following command:
sudo podman network create --subnet 2001:db8::/64 --ipv6 mynet
Container within this network was accessiable from Internet via correct IP (2001:db8::2), but its public IP (for http, ping etc.) was wrong - it was 2001:db8::1, which is totally understandable when using bridge network.

Things get complicated when I tried using macvlan, first problem was the gateway which needs to be set to fe80::1. docker refused to create such network with error "no matching subnet for gateway fe80::1". podman successfully create network using the following command:
sudo podman network create -d macvlan --subnet 2001:db8::/64 --gateway fe80::1 --ipv6 -o parent=eth0 mynet
Unfortunately, a container inside this network has no connectivity in any direction, even though it has correct IP and gateway specified.

Server is working on Ubuntu, with enabled IP routing in kernel.

Any ideas how this setup could be made would be much appreciated. Thanks.

16
0 + 0
user1686 avatar
fr flag
user1686
[..which causes problems with docker/podman, because it's not in the same subnet] – It doesn't have to be in the _same_ subnet as long as it's in _any_ of your subnets (and every host is in the fe80::/64 subnet), so docker/podman ought to accept it. [..which is totally understandable when using bridge network] – That actually sounds _not like a bridge network at all_ to me. I don't know what a "bridge" means in Docker world, but that's not how normal bridges work; they are not supposed to NAT IP packets.
2
Reply
user1686 avatar
fr flag
user1686
Anyway: 1) Could your network provider assign you a routed prefix, e.g. a /56 routed to your host? 2) Do Docker&podman require a /64, or could you set up a container network with a longer prefix (e.g. a /96)? Instead of macvlans, Proxy-NDP using ndpresponder could make that work in general, but I don't know where to start with container tools.
2
Reply
Score:0
Kacper G. avatar Server
br flag
Kacper G.

Resolved. It seems that prefix size was a key. I have been using /64, but when I changed to longer ones like /112 everything started working. Furthermore, I didn't need to use macvlan, just simple bridge.

0 + 0
Ron Maupin avatar
us flag
Ron Maupin
Using network sizes other than `/64` can cause problems with IPv6. Yes, you should just bridge because all the devices are on the same network.
1
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.