0

I'm currently running NixOS-23.11, without any special configuration for docker, just the default install from nixpkgs.

I have the following Dockerfile definition:

FROM alpine:latest
COPY ./index.html /index.html
RUN apk update && apk add --no-cache python3 py3-pip
CMD ["python3",  "-m", "http.server", "8080", "-b", "0.0.0.0"]

I'm trying to trace the route of my requests:

curl localhost:80
curl localhost:8080

The docker image is built and ran with the following commands:

docker build -t test .
docker run -p 80:8080 test &
docker run -p 8080:8080 test &

My requests can reach my docker container without any issues, with the following logs on the servers:

172.17.0.1 - - [08/May/2024 08:48:43] "GET / HTTP/1.1" 200 -
172.17.0.1 - - [08/May/2024 08:49:00] "GET / HTTP/1.1" 200 -

I took a look at the iptables dump for DOCKER:


Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     6    --  !docker0 docker0  0.0.0.0/0            172.17.0.2           tcp dpt:8080
    0     0 ACCEPT     6    --  !docker0 docker0  0.0.0.0/0            172.17.0.3           tcp dpt:8080

And for the DNAT:

Chain PREROUTING (policy ACCEPT 1 packets, 344 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DOCKER     0    --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 2848 packets, 241K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DOCKER     0    --  *      *       0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 2848 packets, 241K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  0    --  *      !br-ba1da9a55510  172.18.0.0/16        0.0.0.0/0           
    0     0 MASQUERADE  6    --  *      *       172.17.0.2           172.17.0.2           tcp dpt:8080
    0     0 MASQUERADE  6    --  *      *       172.17.0.3           172.17.0.3           tcp dpt:8080

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     0    --  br-ba1da9a55510 *       0.0.0.0/0            0.0.0.0/0           
    0     0 DNAT       6    --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:172.17.0.2:8080
    0     0 DNAT       6    --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 to:172.17.0.3:8080

Even though there have been several requests made, it seems that the pkts and bytes count do not change.

But I do see other Chains updating instead, when I make these requests:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
13652 6032K nixos-fw   0    --  *      *       0.0.0.0/0            0.0.0.0/0           


Chain nixos-fw-accept (4 references)
 pkts bytes target     prot opt in     out     source               destination         
13652 6032K ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0

Why are the NAT tables for Docker not being hit? Is it a quirk of NixOS? Or is this expected behaviour due to some internal behaviour of Docker?

1
  • Do you see different behavior if you connect from somewhere other than localhost?
    – larsks
    Commented May 20 at 12:41

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.