diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-08-07 20:59:54 +0000 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-08-07 23:17:28 +0200 |
| commit | dabeff277774190d047155be6566da184b2b3e8f (patch) | |
| tree | f881d9e45f8d128bc329afcedb73a80ab2ae64c8 /src | |
| parent | 278fba204200f02bb461f786f889b40dc38a26f6 (diff) | |
| download | vyos-1x-dabeff277774190d047155be6566da184b2b3e8f.tar.gz vyos-1x-dabeff277774190d047155be6566da184b2b3e8f.zip | |
container: T7736: disable IPv6 DAD for netavark bridges to fix aardvark-dns race
netavark assigns the IPv6 gateway address to a container "pod-*" bridge
and immediately invokes aardvark-dns to bind its DNS listener to it. While
the address is "tentative" during Duplicate Address Detection, that bind()
fails with EADDRNOTAVAIL and container startup fails for any IPv6-enabled
network.
The kernel only skips DAD for an address if both "all" and the specific
interface's own accept_dad are disabled at the moment the interface is
created. A per-interface override is always either too late for a network's
first-ever container - as the network can only be created in-time and not
explicitly before starting the first container.
Diffstat (limited to 'src')
| -rwxr-xr-x | src/conf_mode/system_ipv6.py | 8 | ||||
| -rw-r--r-- | src/etc/sysctl.d/32-vyos-podman.conf | 11 |
2 files changed, 18 insertions, 1 deletions
diff --git a/src/conf_mode/system_ipv6.py b/src/conf_mode/system_ipv6.py index 80a7a386a..4e597b732 100755 --- a/src/conf_mode/system_ipv6.py +++ b/src/conf_mode/system_ipv6.py @@ -83,8 +83,14 @@ def apply(config_dict): sysctl_write(['net', 'ipv6', 'neigh', 'default', 'gc_thresh1'], size // 8) # configure IPv6 strict-dad + # T7736: DAD is off by default (see 32-vyos-podman.conf) so that + # interfaces outside VyOS's interface model (e.g. netavark's + # container bridges) skip it; VyOS-managed interface types always + # write their own explicit accept_dad on their own next commit + # regardless of what this sets here, so this only has a lasting + # effect on interfaces nothing else manages. tmp = dict_search('strict_dad', opt) - value = '2' if (tmp != None) else '1' + value = '2' if (tmp != None) else '0' for root, dirs, files in os.walk('/proc/sys/net/ipv6/conf'): for name in files: if name == 'accept_dad': diff --git a/src/etc/sysctl.d/32-vyos-podman.conf b/src/etc/sysctl.d/32-vyos-podman.conf index 7068bf88d..7452d8f6c 100644 --- a/src/etc/sysctl.d/32-vyos-podman.conf +++ b/src/etc/sysctl.d/32-vyos-podman.conf @@ -3,3 +3,14 @@ fs.inotify.max_queued_events = 1048576 fs.inotify.max_user_instances = 1048576 fs.inotify.max_user_watches = 1048576 +# T7736: netavark assigns the IPv6 gateway address to a container "pod-*" +# bridge and immediately invokes aardvark-dns to bind its DNS listener to +# it; while the address is "tentative" during Duplicate Address Detection, +# that bind() fails with EADDRNOTAVAIL and container startup fails for any +# IPv6-enabled network. +# The kernel only skips DAD for an address if BOTH "all" and the specific +# interface's own accept_dad are disabled at the moment the interface is +# created. +net.ipv6.conf.all.accept_dad=0 +net.ipv6.conf.default.accept_dad=0 + |