Containers cannot communicate with each other when using an internal network about moby HOT 7 CLOSED

Hi @iam-Justin - thank you for reporting this.

I think it's probably a problem with duplicate MAC addresses, introduced in 25.0.0 - does the description here fit with what you've seen? ... #47211 (comment)

from moby.

Hi @robmry, thank you for replying.
No, It's not a duplicate mac address issue. And I forgot to mention that the docker version of openSUSE is 24.0.5.
Can you reproduce the problem using the example above? I'm going to test it again under Debian.

from moby.

Ah ok - thank you. I wasn't able to repro on Debian - but I just tried with openSUSE's docker 24.0.7, and the ping/curl commands failed.

For me, packets were dropped by firewalld. Because the network is 'internal', the bridge isn't added to firewalld's 'docker' zone.

I'm not yet sure why it's not added - manually adding it makes communication between the containers work, and external access is still blocked by the DOCKER-ISOLATION rules. So, I'm still investigating ...

from moby.

@thespad Did you try to recreate the network and re-connect containers to it?

from moby.

@thespad Did you try to recreate the network and re-connect containers to it?

Yes. it seems that anything internal in 172.19.0.0/16 fails to connect. Anything outside of that, say 172.20.1.128/28 or 172.22.0.32/29 is fine. I've even removed every docker network in that range, restarted the docker service, and recreated them. Same behaviour.

Edit: Actually it seems less consistent than that. I'm getting a slightly different issue in some other ranges where I can ping between containers but other traffic isn't being passed.

from moby.

Hi @thespad ... is this behaviour different to what you've seen in a previous release? Which release was that? Could you confirm you're using firewalld on your host, and describe your setup - which of these address ranges are subnets for 'internal' bridge networks?

It sounds like you might be seeing a different problem to the one demonstrated by the example in this ticket, so it'd probably be best to raise a new issue and describe it fully there. If you can construct an example that reproduces the issue, using standard images, that'll make it easier to investigate.

from moby.

Yeah I'll open a new issue to keep things tidy; it's different behaviour to previous releases as it broke a dozen containers that had been working fine on 24.x and older :)

from moby.