Possible deprecation of docker-ipv6nat

[robbertkl]

With the merge of moby/libnetwork#2572 we're finally 1 step closer to having IPv6 NAT built into Docker!

I'm creating this issue to track the release of this feature, and to figure out if there are any remaining use cases for this tool. If not, we can deprecate this tool in favor of the built-in functionality.

[bephinix]

@robbertkl I think we should keep it up until built-in IPv6 NAT is rolled out for most distributions.
In addition to this, it is required to check if built-in IPv6 NAT behaves the same way docker-ipv6nat does. 😉

[robbertkl]

Exactly, agree 100%! I wanted to use this issue to share findings on behavior of built-in IPv6 NAT. After confirming this tool is no longer needed, I wanted to deprecate it with a README message, but still keep it available until the built-in IPv6 NAT is widespread.

[bboehmke]

We should also track moby/moby#41622 because this is the requirement to enable the IPv6 NAT in the docker daemon.

Many thanks also for the great work on this project, it has made my work with IPv6 and docker much easier.

[J0WI]

Docker 20.10 with IPv6 NAT is out but it has some serious issues: moby/moby#41774

[johntdavis84]

I was actually coming here to open a ticket about this very thing. :)

The latest stable update on Manjaro included Docker 20.10, and I saw the new ipv6nat functionality--and read the long thread of people trying to figure out exactly how it should work, here: moby/moby#41622

It sounds like it's very much still experimental? I'm not sure how to check whether a feature is considered experimental or not?

In the meantime, if we've been using docker-ipv6nat without issue, can we just continue as we were, or will the new built-in tools break it? I'd prefer not to switch until it's had at least a few months for the most critical bugs to be worked out.

(It's also amazing to me--in a good way--that the official Docker release is implementing IPv6 NAT after months/years of philosophical pushback about that NAT'ing IPv6 being Wrong®. Maybe it is in most contexts, but it's clearly the best way to go in Docker, given how seamless v4 NAT'ing is with containers.

Thanks for all your work on this. I could never have used IPv6 before this point on docker without your work. :)

[robbertkl]

I have no intentions of pulling the plug until we can all agree Docker offers the same functionality (and stability). Of course, I'll be hesitant to add new features to docker-ipv6nat when it might be deprecated "soonish". We're keeping an eye on the development within Docker, and currently have no reason to think it will break docker-ipv6nat if you keep it disabled. Thanks for the support @johntdavis84 !

[bboehmke]

Finally with release 20.10.2 the upstream IPv6 NAT seems to work now.

If you want to give it a try simply add the following lines to the /etc/docker/daemon.json:

{
  "experimental": true,
  "ip6tables": true
}

and configure the IPv6 the same way as for this container (see https://github.com/robbertkl/docker-ipv6nat#docker-ipv6-configuration)

Note: The ipv6nat container should not be running if ip6tables in docker daemon is enabled

[J0WI]

There's a regression in 20.10.2:
moby/moby#41858
moby/libnetwork#2607

[johntdavis84]

I’m very pleased to see how aggressively this is being developed/bugs are being squished. If this is going to be part of docker’s core functionality, it needs to be rock solid. It’s especially nice to see given the previous resistance from some of the docker community to incorporating NAT-based IPv6. Robbert, are they collaborating with you at all or drawing from your codebase, or did they roll this from scratch? - JTD.

…

On Jan 6, 2021, at 11:07 AM, J0WI ***@***.***> wrote: There's a regression in 20.10.2: moby/moby#41858 <moby/moby#41858> moby/libnetwork#2607 <moby/libnetwork#2607> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#65 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGI5CYVQ3WI35USCHL5PQJTSYSKFTANCNFSM4UHVYYOQ>.

[robbertkl]

No collaborating, I think they rolled it from scratch. That makes most sense, as they can mirror the internal workings of the IPv4 NAT. Docker-ipv6nat is set up as an external listener, so doesn't make much sense to draw from this codebase.

I agree that it seems they're very much on top of things. Since the decision was made to make it part of Docker, they're taking it seriously.

[johntdavis84]

That makes sense. Thanks for taking the time to explain how these things work. I’m a relative Linux/networking newbie, and I feel like I’m starting to get a handle on the basics, but the intricacies of IPv6 especially, and how it is implemented across various systems, remains impenetrable deep magic. I understand why IPv6 is so important, but I am deeply concerned that it’s so difficult to use compared to IPv4. That’s fine for commercial/professional deployments, but the current tools available do not seem anywhere near as accessible to home networking prosumers as the IPv4 tool stack is. Docker-ipv6nat is one of the few “let’s make this easier” v6 tools I’ve found. - JTD.

…

On Jan 6, 2021, at 12:41 PM, Robbert Klarenbeek ***@***.***> wrote: No collaborating, I think they rolled it from scratch. That makes most sense, as they can mirror the internal workings of the IPv4 NAT. Docker-ipv6nat is set up as an external listener, so doesn't make much sense to draw from this codebase. I agree that it seems they're very much on top of things. Since the decision was made to make it part of Docker, they're taking it seriously. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#65 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGI5CYVGKJEVDMVKH33SDHDSYSVHBANCNFSM4UHVYYOQ>.

[fnkr]

Has anyone tried enabling IPv6 NAT for the default bridge network? In my case dockerd tries to execute a wrong command and crashes. Reported it here: moby/moby#41861