what could be blocking connection from docker container to external server

Question

I have an external server abc.internalcorp.com that I'm planning to connect from docker.

I tried to ping that server from host machine and it works.

ping abc.internalcorp.com
PING abc.internalcorp.com (172.xx.xx.xx) 56(84) bytes of data.
64 bytes from abc.internalcorp.com (172.xx.xx.xx): icmp_seq=1 ttl=47 time=32.6 ms
^C
--- abc.internalcorp.com ping statistics ---
2 packets transmitted, 1 received, 50% packet loss, time 999ms
rtt min/avg/max/mdev = 32.673/32.673/32.673/0.000 ms

But when I execute the same command from my docker container, I see no response. How could this be?

docker exec -ti docker-container bash
root@b7bdf44feb7f:/# ping abc.internalcorp.com
PING abc.internalcorp.com (172.xx.xx.xx) 56(84) bytes of data.
<No response>

This ping is just a test. abc.internalcorp.com is actually a database server and I'm unable to connect to it. I can connect to other database servers though.

Update: I changed bip in ~/.docker/daemon.json

{
  "bip": "193.168.1.5/24",
  "registry-mirrors": [],
  "insecure-registries": [],
  "debug": true,
  "experimental": false
}

But I still have the same ping issue

docker exec -ti docker-container bash
root@b7bdf44feb7f:/# ip addr show eth0
10: eth0@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:c1:a8:01:01 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 193.168.1.1/24 brd 193.168.1.255 scope global eth0
       valid_lft forever preferred_lft forever

Edit Figured out the issue. There were other networks in my docker that were having the same network subnets. Deleted them and works fine now

https://stackoverflow.com/questions/45509604/docker-container-can-not-ping-the-outside-world-iptables — error404, Jun 28 '19 at 16:44
I assume that you might have connected the container to bridge network. Have you tried pinging the server by connecting it to host network? — Mani, Jul 04 '19 at 12:33

score 1 · Accepted Answer · answered Jul 05 '19 at 03:24

Need to do two things.

change the network by editing daemon.json

{ "registry-mirrors": [], "insecure-registries": [], "debug": true, "experimental": false, "bip" : "12.12.0.1/24" }
Delete other networks in docker which might be conflicting with the ip. You check if any other network is in the same range using

docker inspect 'networkname'

score 0 · Answer 2 · answered Jun 25 '19 at 18:52

0

The range 172.x.x.x is the default range on the internal network in docker, if you are using that same range in your local network you need to specify a different one for the docker network.

https://docs.docker.com/v17.09/engine/userguide/networking/default_network/custom-docker0/

answered Jun 25 '19 at 18:52

wolmi

1,659
12
25

I changed my settings to the one given in link, but I still see the issue. I ran and see that it is still in 172.xx. Not changed. 10: eth0@if11: mtu 1500 qdisc noqueue state UP group default link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0 valid_lft forever preferred_lft forever – Ravi Jun 25 '19 at 19:31
daemon.json was not found in C:\ProgramData\docker\config\daemon.json. It was under /.docker folder. Now I can see the change in container, yet it still doesn't ping – Ravi Jun 25 '19 at 20:04
awarding bounty to this answer as it got me closer to figuring out the conflicting network – Ravi Jul 05 '19 at 03:24

score 0 · Answer 3 · answered Jul 03 '19 at 10:47

0

Find the DNS with resolves abc.internalcorp.com. Add it as a DNS to your docker container by updating the daemon.json as below. If x.x.x.x is the DNS.

{
    "dns": ["x.x.x.x"]
}

restart docker daemon. Then try ping from the container.

answered Jul 03 '19 at 10:47

Prakash Krishna

1,239
6
12

what could be blocking connection from docker container to external server

3 Answers3