From dabeff277774190d047155be6566da184b2b3e8f Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Fri, 7 Aug 2026 20:59:54 +0000 Subject: container: T7736: disable IPv6 DAD for netavark bridges to fix aardvark-dns race netavark assigns the IPv6 gateway address to a container "pod-*" bridge and immediately invokes aardvark-dns to bind its DNS listener to it. While the address is "tentative" during Duplicate Address Detection, that bind() fails with EADDRNOTAVAIL and container startup fails for any IPv6-enabled network. The kernel only skips DAD for an address if both "all" and the specific interface's own accept_dad are disabled at the moment the interface is created. A per-interface override is always either too late for a network's first-ever container - as the network can only be created in-time and not explicitly before starting the first container. --- src/etc/sysctl.d/32-vyos-podman.conf | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'src/etc') diff --git a/src/etc/sysctl.d/32-vyos-podman.conf b/src/etc/sysctl.d/32-vyos-podman.conf index 7068bf88d..7452d8f6c 100644 --- a/src/etc/sysctl.d/32-vyos-podman.conf +++ b/src/etc/sysctl.d/32-vyos-podman.conf @@ -3,3 +3,14 @@ fs.inotify.max_queued_events = 1048576 fs.inotify.max_user_instances = 1048576 fs.inotify.max_user_watches = 1048576 +# T7736: netavark assigns the IPv6 gateway address to a container "pod-*" +# bridge and immediately invokes aardvark-dns to bind its DNS listener to +# it; while the address is "tentative" during Duplicate Address Detection, +# that bind() fails with EADDRNOTAVAIL and container startup fails for any +# IPv6-enabled network. +# The kernel only skips DAD for an address if BOTH "all" and the specific +# interface's own accept_dad are disabled at the moment the interface is +# created. +net.ipv6.conf.all.accept_dad=0 +net.ipv6.conf.default.accept_dad=0 + -- cgit v1.2.3