Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Universal image: containers on a user-defined bridge network cannot reach each other

Aperta
  • Qualcosa non va?
#2,033 2 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

@v-Kaniska244 ci sta già lavorando.

Dal 5/10/2026.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
docker, docker-compose, shell
Ambito
devops, infrastructure, networking

Direzione di ricerca

Start by reproducing the failure with the supplied Docker Compose example in a fresh universal Codespace, then inspect the universal image setup associated with version 6.1.7 and its Docker networking initialization. Compare nftables and iptables-legacy state before and after startup; done means containers on user-defined bridge networks can communicate without applying the listed workaround.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

In a GitHub Codespace using the default universal image (no devcontainer.json), containers on a user-defined bridge network (e.g. the default network created by docker compose) cannot reach each other. The same compose file works on a regular Docker host.

Environment

Steps to reproduce

  1. Create a fresh Codespace with no devcontainer.json (example: https://github.com/mdmourao/docker-api-solved)
  2. Start any two services with docker compose up (e.g. postgres:17 + an app)
  3. From another container on the same network:
   docker run --rm --network <project>_default postgres:17 pg_isready -h db -p 5432

Expected: db:5432 - accepting connections
Actual: db:5432 - no response

Diagnosis

Two iptables backends are active. iptables (nft) shows Docker's rules with FORWARD ACCEPT, but also prints:

# Warning: iptables-legacy tables present, use iptables-legacy to see them

The legacy FORWARD chain has policy DROP and only allows docker0:

$ sudo iptables-legacy -S FORWARD
-P FORWARD DROP
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT

Docker 29 programs its rules via nftables, so user-defined bridges (br-*) have no allow rule in the legacy tables. Since net.bridge.bridge-nf-call-iptables = 1, intra-bridge traffic is also evaluated against the legacy FORWARD chain and hits the DROP policy. The default docker0 bridge is unaffected; only user-defined networks (including every compose project) break.

The legacy ruleset looks like one written by an older dockerd using the legacy backend (e.g. during image build or an earlier daemon start), which is then left behind when the current daemon uses nftables.

Workaround

sudo iptables-legacy -P FORWARD ACCEPT

or, more narrowly:

sudo iptables-legacy -I FORWARD -i br+ -o br+ -j ACCEPT

References

Same diagnosis reported in other projects, worked around locally and closed there, but apparently never reported upstream:

Lingua principale
Shell
Stelle
2.1k
Fork
971
Merge medio
3g 21h
PR unite (30g)
11

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

  • Nessun Dockerfile né file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di devcontainers/images

Tutte le issue di devcontainers/images

Issue simili

Altre issue su Shell/Bash

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.