moby: Daemon won't start when ipv6 is set

As this was never really clarified and the “problem” people were having was never solved, here is the solution:

Docker IPv6 is working perfectly, it’s just the documentation that doesn’t tell people what to do in order to set it up correctly.

Docker will not do SLAAC (Stateless Address Autoconfiguration), nor will it use DHCPv6. As it also won’t do NATv6 (thank god!), you will have to assign ipv6 prefixes to your networks manually. The default bridge network has to be assigned a network, you can do this by adding the following to daemon.json:

{
"ipv6": true,
"fixed-cidr-v6": "2001:db8::/64",
}

For any other network you might have, you can decide wether or not it will be ipv6 capable. To create an IPv6 capable network, do the following: docker network create --ipv6 --subnet "2001:db8:1::/64" testnet

Also remember, that this is not NATv6 (thank god!). Therefor you will have to have a route from your router to your docker host!

what a headache

@aboch This hit me again, because I read on the IPv6 with Docker page that:

By default, containers that are created will only get a link-local IPv6 address. To assign globally routable IPv6 addresses to your containers you have to specify an IPv6 subnet to pick the addresses from. Set the IPv6 subnet via the --fixed-cidr-v6 parameter when starting Docker daemon

Which makes it sound like --ipv6 enables IPv6 with link-local addresses only, and that you can use --fixed-cidr-v6 or --subnet if you want to make them globally routable.

Since your comment indicates that you must specify a subnet with --ipv6, does that mean that it’s not / no longer possible to have IPv6 link-local addresses only?

Context: I’m simply trying to enable IPv6 in my containers to work around a EADDRNOTAVAIL error in Redis (it just fails when IPv6 is disabled), but I don’t want these addresses to be globally routable. Is there something like a “local-only IPv6 subnet”?

@aboch I too want link local IPv6 same as @jankeromnes. Is this still possible?

@MihaMarkic

@thaJeztah was in fact suggesting me we should mention it in the release note. We’ll take care of it. I am now thinking something on this line:

Docker 1.12.4 no longer allows user to start the daemon with --ipv6 option for the default bridge network, unless user also specifies the IPv6 subnet for the default bridge network via --fixed-cidr-v6. Otherwise daemon start would fail with the following message:

Error starting daemon: Error initializing network controller: Error creating default "bridge" network: failed to parse pool request for address space "LocalDefault" pool " subpool ": could not find an available, non-overlapping IPv6 address pool among the defaults to assign to the network

Similarly, network creation will fail if --ipv6 is passed but no IPv6 --subnet is specified and the default IPAM driver is used. Failure message will be:

$ docker network create --ipv6 incorrect_nw
Error response from daemon: failed to parse pool request for address space "LocalDefault" pool "" subpool "": could not find an available, non-overlapping IPv6 address pool among the defaults to assign to the network

Above command will instead succeed if an external IPAM driver which supports auto allocation of IPv6 address pool is used.

Before, even though --ipv6 was accepted, it was effectively a no-op.

@MihaMarkic

Before the fix for the issue @thaJeztah referenced, user was allowed to create a network , or start the daemon, without specifying the an IPv6 --subnet, or --fixed-cidr-v6 respectively, even when using the default builtin IPAM driver, which does not support auto allocation of IPv6 pools.

In other words that was an incorrect configurations, which had no effects on ipv6 stuff. It was a no-op.

The fix, cleared that so that docker will now correctly consult with the IPAM driver to acquire an IPv6 subnet for the bridge network, when user did not supply one.

If the IPAM driver in use is not able to provide one, network creation would fail (in this case the default bridge network).

So what you see now is the expected behavior. You need to remove the --ipv6 flag when you start the daemon, unless you pass a --fixed-cidr-v6 pool. We should probably clarify this somewhere.

Above command will instead succeed if an external IPAM driver which supports auto allocation of IPv6 address pool is used.

@aboch Is there a driver which supports that, found nothing while asking Google?