docker image not working with IPv6 disabled

[guigui42]

On my Docker host, I have IPv6 disabled completely.

So when starting Speedtest-tracker docker image, I get the following errors :

[16-Dec-2022 13:31:24] ERROR: FPM initialization failed
[16-Dec-2022 13:31:24] ERROR: FPM initialization failed
[16-Dec-2022 13:31:25] ERROR: failed to create new listening socket: socket(): Address family not supported by protocol (97)
[16-Dec-2022 13:31:25] ERROR: failed to create new listening socket: socket(): Address family not supported by protocol (97)

[alexjustesen]

Heads up in #37 we couldn't figure this issue out at the time. I did reach out to the base image owners though to see if they can assist.

[jaydrogers]

I can take a look into this.

Can you give me some replication steps? I will spin up a server on Vultr and test it out.

Let me know the host OS and the steps you used to disable IPv6 👍

[guigui42]

he steps

Sorry for late reply.

OS: Linuxmint 20 ulyana
Kernel: x86_64 Linux 5.4.0-135-generic

Steps to disable IPv6 :
Added in the following conf file : /etc/sysctl.conf

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1

and Reboot

As explained there https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/network-flow-analysis/21-2/installing/system-recommendations-and-requirements/linux-servers/disable-ipv6-networking-on-linux-servers.html

Thanks for the help.

[alexdelprete]

That is the correct way to disable IPv6, through sysctl only and in a separate config file (e.g. /etc/sysctl.d/disable-ipv6.conf).

Many users also disable it at kernel level, and that could lead to issues for some apps/environments. Did you also disable it there? I know because I had some issues with Proxmox disabling ipv6 module completely at kernel level:

[guigui42]

That is the correct way to disable IPv6, through sysctl only and in a separate config file (e.g. /etc/sysctl.d/disable-ipv6.conf).

Many users also disable it at kernel level, and that could lead to issues for some apps/environments. Did you also disable it there? I know because I had some issues with Proxmox disabling ipv6 module completely at kernel level:

good call, I had it disabled in Grub as well, but unfortunately, even after removing this and applying the changes, I still have the same issue in the Docker image.

[alexdelprete]

It means the configuration of FPM requires ipv6 enabled. That should not be the case.

[guigui42]

I also tried adding the following env variables to the docker-compose file :

      - DISABLE_IPV6=true
      - LISTEN_IPV6=false

But same errors again.

[jaydrogers]

Quick Update

From the base image perspective, I am not able to replicate this bug. For those not aware, I am the maintainer of the serversideup/php:8.1-fpm-nginx base image defined here:

speedtest-tracker/Dockerfile

Line 1 in ea5bda2

FROM serversideup/php:8.1-fpm-nginx

More details

To help isolate the issue, I performed these tests with my base image:

Deploy a server on basically any server host

I did not have access to Mint, but since Mint is based off of Ubuntu, I chose Ubuntu Server 22.04 to run these tests.

Confirm IPv6 is working

Once the new server is deployed, the first thing I did was make a request to "ipv6.icanhazip.com":

curl https://ipv6.icanhazip.com

✅ Result:
It returned my temporary server's IP address:

Disable IPv6

I disable IPv6:

echo "net.ipv6.conf.all.disable_ipv6 = 1" > /etc/sysctl.d/999-disable-ipv6.conf
echo "net.ipv6.conf.default.disable_ipv6 = 1" >> /etc/sysctl.d/999-disable-ipv6.conf
echo "net.ipv6.conf.lo.disable_ipv6 = 1" >> /etc/sysctl.d/999-disable-ipv6.conf
sysctl -p
systemctl restart procps

Confirm IPv6 is disabled

I run the command to check if IPv6 is disabled:

curl https://ipv6.icanhazip.com

✅ Result:
I can see I no longer can get to "ipv6.icanhazip.com"

Install Docker

I am following the Official Docker Documentation on how to install.

Install dependencies:

sudo apt-get update
sudo apt-get install \
    ca-certificates \
    curl \
    gnupg \
    lsb-release

Add GPG key:

sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

Configure Docker apt repository:

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Update apt packages:

sudo apt-get update

Install latest version of Docker:

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose-plugin

Clone my test repo

This is a simple test app to bring up my base container with a "PHP Info" page:

git clone https://github.com/jaydrogers/docker-php-test-app.git

Bring up the test app with Docker Compose

cd docker-php-test-app
docker compose up

✅ Result:
My container comes up fine:

Ensure "PHP Info" is loading

I then visit the IP address of my server to confirm PHP loads.

✅ Result:
My PHP info page loads fine:

Next Steps

1. Does anyone have any ideas what else would be causing this?
2. Is there anything in the project that would affect IPv6 functionality with PHP-FPM?

[alexdelprete]

1. Does anyone have any ideas what else would be causing this?

Jay, did you also test disabling ipv6 module at kernel level? That was my first hypothesis regarding this issue. Disabling the module creates weird issues in many environments.

[jaydrogers]

Disabling IPv6 with Grub causes container start failures

Good call @alexdelprete. Disabling IPv6 with Grub causes the container to not start properly.

More details

Here are my steps to reproduce:

Deploy a new server on Vultr

I chose Ubuntu 22.04.

Confirm IPv6 is working

Once the new server is deployed, the first thing I did was make a request to "ipv6.icanhazip.com":

curl https://ipv6.icanhazip.com

✅ Result:
It returned my temporary server's IP address:

Disable IPv6

I disable IPv6 at the kernel, following these steps:

nano /etc/default/grub

# Change from
GRUB_CMDLINE_LINUX_DEFAULT="vultr "

# Change to
GRUB_CMDLINE_LINUX_DEFAULT="vultr ipv6.disable=1"

# Save and apply changes
update-grub

#Reboot to be safe
reboot

Confirm IPv6 is disabled

I run the command to check if IPv6 is disabled:

curl https://ipv6.icanhazip.com

✅ Result:
I can see I no longer can get to "ipv6.icanhazip.com"

Install Docker

I am following the Official Docker Documentation on how to install.

Install dependencies:

sudo apt-get update
sudo apt-get install \
    ca-certificates \
    curl \
    gnupg \
    lsb-release

Add GPG key:

sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

Configure Docker apt repository:

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Update apt packages:

sudo apt-get update

Install latest version of Docker:

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose-plugin

Clone my test repo

This is a simple test app to bring up my base container with a "PHP Info" page:

git clone https://github.com/jaydrogers/docker-php-test-app.git

Bring up the test app with Docker Compose

cd docker-php-test-app
docker compose up

❌ Result:
Container fails to start:

Next steps

• Try resetting your Grub configuration and use the /etc/sysctl.d/999-disable-ipv6.conf method instead

[alexdelprete]

Good that you've been able to replicate the exact issue @jaydrogers. I asked @guigui42 if he was disabling ipv6 mod at kernel level and he confirmed, but after removing it, he said the problem was still there. I guess he didn't rebuild grub or in some way it kept being removed at kernel level.

[alexjustesen]

Hot damn, I go offline for a few days and y'all really get in the weeds.

[alexdelprete]

Hot damn, I go offline for a few days and y'all really get in the weeds.

And we almost got lost...

[johntdyer]

Seeing the same issue using sysctl and grub methods.... any progress?