Skip to content

[docker-29.x backport] Don't try to remove cleared docker_gwbridge endpoint#51538

Merged
thaJeztah merged 1 commit into
moby:docker-29.xfrom
thaJeztah:29.x_backport_dont-remove-removed-gateway
Nov 16, 2025
Merged

[docker-29.x backport] Don't try to remove cleared docker_gwbridge endpoint#51538
thaJeztah merged 1 commit into
moby:docker-29.xfrom
thaJeztah:29.x_backport_dont-remove-removed-gateway

Conversation

@thaJeztah

@thaJeztah thaJeztah commented Nov 14, 2025

Copy link
Copy Markdown
Member

- What I did

If a container is using a docker_gwbridge endpoint as its gateway, when it's connected to another network that provides a gateway, the docker_gwbridge endpoint is removed (in a recursive nightmare).

So, the "before" gateway for the container has been removed before the new gateway is updateExternalConnectivity'd, and an error is raised because it can't be removed again.

This will affect any container using docker_gwbridge - most won't ... the built-in ipvlan/macvlan drivers disable it, and non-internal bridge networks require IPv4 or IPv6. But I'm not sure if there's a way to provoke the error with Swarm.

- How I did it

Don't pass the old gateway to updateExternalConnectivity in that case, because the network driver's already forgotten about it.

- How to verify it

This needs a regression test - but wanted to get the fix in first (missed 29.0.1, but there will be a 29.0.2).

For now, manual repro ...

- Human readable description for the release notes

Fix an issue that could lead to an "endpoint not found" error when creating a container with multiple network connections, when one of the networks is non-internal but does not have its own external IP connectivity.

@thaJeztah thaJeztah added this to the 29.0.2 milestone Nov 14, 2025
@thaJeztah thaJeztah requested a review from robmry November 14, 2025 23:36
@github-actions github-actions Bot added the area/daemon Core Engine label Nov 14, 2025

@robmry robmry left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@thaJeztah

Copy link
Copy Markdown
Member Author

It's probably gonna bail out on this test and out of space;

--- PASS: TestBuildMultiStageLayerLeak (4.91s)
=== RUN   TestBuildWithHugeFile

If a container is using a docker_gwbridge endpoint as its gateway,
when it's connected to another network that provides a gateway, the
docker_gwbridge endpoint is removed when that endpoint is added (in
a recursive nightmare).

So, the "before" gateway for the container has been removed
before the new gateway is updateExternalConnectivity'd.

Don't pass the old gateway to updateExternalConnectivity in that
case, because the network driver's already forgotten about it.

Signed-off-by: Rob Murray <rob.murray@docker.com>
(cherry picked from commit 1731e9e)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah thaJeztah force-pushed the 29.x_backport_dont-remove-removed-gateway branch from a64af43 to 7faaa44 Compare November 16, 2025 14:16
@thaJeztah

Copy link
Copy Markdown
Member Author

Rebased after #51545 was merged to make CI a bit greener (validate-pr is still expected to fail)

@thaJeztah thaJeztah merged commit e9ff10b into moby:docker-29.x Nov 16, 2025
250 of 253 checks passed
@thaJeztah thaJeztah deleted the 29.x_backport_dont-remove-removed-gateway branch November 16, 2025 16:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants