Disable docker-proxy 15 seconds keepalives

[fgervais]

When starting a container listening on a port, the sockets created from a client connecting will have a 15 seconds keepalive.

In this screenshot, fd04:2240::10 is the server running the listening socket on a docker container.

I think those keepalives are coming from docker-proxy and are caused by golang/go#48622.

What would be the way to disable those 15 seconds keepalives?

[thaJeztah]

Not sure if it's a full solution, but depending on your situation, you may be able to configure your daemon to disable the userland-proxy (docker-proxy) by default (also see #14856). You can disable the default in the daemon configuration (either the --userland-proxy=false flag, or "userland-proxy": false" in the daemon.json configuration file; https://docs.docker.com/engine/reference/commandline/dockerd/

[fgervais]

I disabled the userland-proxy as proposed but now my ipv6 clients can't connect anymore. ipv4 is fine though.

Is there something more I need to do so ipv6 works again without the userland-proxy?

[fgervais]

Alright so I went down the ipv6 on docker hole, getting up to speed with all the quirks and bugs.

I'm here to report that it does work i.e. without the userland-proxy, I don't have the 15 seconds keepalives anymore 🎉.

So to possibly help others, here's what I ended up changing. Note that quite a fair chunk of what I changed is because I have ipv6 only clients.

diff --git a/daemon.json b/daemon.json
new file mode 100644
index 0000000..27afe59
--- /dev/null
+++ b/daemon.json
@@ -0,0 +1,32 @@
+{
+    "experimental" : true,
+    "ipv6": true,
+    "fixed-cidr-v6": "fd04:2240:0:d0ff::/64",
+    "ip6tables": true,
+    "userland-proxy": false,
+    "default-address-pools": [
+        { "base": "172.17.0.0/16", "size": 16 },
+        { "base": "172.18.0.0/16", "size": 16 },
+        { "base": "172.19.0.0/16", "size": 16 },
+        { "base": "172.20.0.0/14", "size": 16 },
+        { "base": "172.24.0.0/14", "size": 16 },
+        { "base": "172.28.0.0/14", "size": 16 },
+        { "base": "192.168.0.0/16", "size": 20 },
+        { "base": "fd04:2240:0:d000::/64", "size": 64 },
+        { "base": "fd04:2240:0:d001::/64", "size": 64 },
+        { "base": "fd04:2240:0:d002::/64", "size": 64 },
+        { "base": "fd04:2240:0:d003::/64", "size": 64 },
+        { "base": "fd04:2240:0:d004::/64", "size": 64 },
+        { "base": "fd04:2240:0:d005::/64", "size": 64 },
+        { "base": "fd04:2240:0:d006::/64", "size": 64 },
+        { "base": "fd04:2240:0:d007::/64", "size": 64 },
+        { "base": "fd04:2240:0:d008::/64", "size": 64 },
+        { "base": "fd04:2240:0:d009::/64", "size": 64 },
+        { "base": "fd04:2240:0:d00a::/64", "size": 64 },
+        { "base": "fd04:2240:0:d00b::/64", "size": 64 },
+        { "base": "fd04:2240:0:d00c::/64", "size": 64 },
+        { "base": "fd04:2240:0:d00d::/64", "size": 64 },
+        { "base": "fd04:2240:0:d00e::/64", "size": 64 },
+        { "base": "fd04:2240:0:d00f::/64", "size": 64 }
+    ]
+}

diff --git a/mosquitto/docker-compose.yml b/mosquitto/docker-compose.yml
index 5912bbd..9bf5328 100644
--- a/mosquitto/docker-compose.yml
+++ b/mosquitto/docker-compose.yml
@@ -14,3 +14,4 @@ services:
 networks:
   home:
     name: home
+    enable_ipv6: true

Some of these changes might seem weird or redundant but they are basically workarounds to the current docker ipv6 support state.

I'll try to list them here:

• On ipv4 you don't have to explicitly address the default docker0 bridge but in ipv6 you do hence the fixed-cidr-v6.
• Once you start defining default-address-pools, you loose the default ipv4 ones so you have to manually redefine them.
• Since I insist on having /64 ranges for my container (/64 is kind of the minimum size an ipv6 should have), I need to define them one at a time to work around splitNetwork and addIntToIP fails for IPv6 addresses on /64+ size pools #42801.
• I my heart I actually want this: { "base": "fd04:2240:0:d::/58", "size": 64 } 😁
• Notice that this would only make a reasonable 64 subnets to steer clear of IPv6 address pool subnet smaller than /80 causes dockerd to consume all available RAM #40275.

[thaJeztah]

Good to hear you managed to work around the issue!

Let me also ping @akerouanton - perhaps he has ideas on both the timeout, as well as the IPv6 hurdles you had to take