Container Not Starting because of ipv6 errors

[clarkie-dev]

Everything has been working for year now and today had things crash and trying to restart my docker container I am getting some odd ipv6 errors. I looked out there for some options but nothing out there fixed it all we options for openvpn directly.

Has anyone else seen these errors or may have a suggestion to a solution? I would love to just disable ipv6 since I am not using it on my local network nor is it setup on my home router.

2024-11-29 15:46:29 GDG6: remote_host_ipv6=n/a
2024-11-29 15:46:29 net_route_v6_best_gw query: dst ::
2024-11-29 15:46:29 sitnl_send: rtnl: generic error (-101): Network is unreachable
2024-11-29 15:46:29 ROUTE6: default_gateway=UNDEF
2024-11-29 15:46:29 ERROR: Cannot open TUN/TAP dev /dev/net/tun: Operation not permitted (errno=1)
2024-11-29 15:46:29 Exiting due to fatal error

[ghost]

ERROR: Cannot open TUN/TAP dev /dev/net/tun: Operation not permitted (errno=1)

Same error since today (PureVPN) without changing anything.

[jgonzo-gh]

This happened to me as well on a Debian 12.8 host. All was working until I performed an apt upgrade. I don't see upgrades to docker or openvpn but I see the kernel updated to Linux 6.1.0-28-amd64 x86_64. I neglected to create a snapshot before I upgrade (complacency) which seems to have bitten me. I haven't broken anything with an update is quite some time.

[ghost]

I'm also with Linux kernel version 6.1.0-28-amd64 x86_64 on OMV 7.

[EDIT]

My Transmission container works !

I add this lines on my Docker compose:

devices:
- /dev/net/tun:/dev/net/tun

and

environment:
- PRIVILEGED=true

or (at the place - PRIVILEGED=true)

environment:
- PUID=1000
- PGID=1000

[proitex]

same issue, added to portainer transmission, duplicate/edit > advance container setting > Runtime and resource > add device > under host /dev/net/tun and under container /dev/net/tun. and deploy container. Working great.

Thanks team :)

[DFC72]

I was able to get it running by just adding the priveleged: true statement - no need for me to add the tun device.

Now I'm trying to find out the RIGHT way to do it, as running with root-equivalency on a container open to the internet is making me sweat balls.

[jgonzo-gh]

I tried adding the tun device in my compose file (already had puid/pgid defined but this did not work. I am not willing to run a privileged container.

I found a different work around in qdm12/gluetun#2606. I downgraded my containerd.io from v1.7.24-1 (this version was installed along with the kernel upgrade) using the following command and restarted my container. It is working again.

sudo apt install containerd.io=1.7.23-1

[davezig]

sudo apt install containerd.io=1.7.23-1

Downgrading containerd.io worked for me as well. Thank you for the tip!

[josh-aliencode]

Running a Docker container in privileged mode basically grants it almost the same access as the host machine, including direct hardware access and root capabilities. This can open up a can of worms for security vulnerabilities, like allowing a rogue container to make system-wide changes, or even escape the container to access the host OS. So, it's best to avoid privileged mode unless you're absolutely sure about what you're doing and aware of the risks.

The best thing I think to do for now is..
sudo apt install containerd.io=1.7.23-1
sudo apt-mark hold containerd.io
sudo systemctl restart docker

The apt-mark hold will prevent the containerd.io from updating everytime you upgrade your system.

[josh-aliencode]

It won't upgrade even though it says it's upgradeable... You'd have to unmark it 1st with:
sudo apt-mark unhold containerd.io

[davezig]

Thank you for confirming!! I wanted to make sure before I updated. I just tested and it worked as expected :)

[josh-aliencode]

I care way too much about my system security to run a container open to the internet in privileged mode.. these other guys have balls of steel.

[davezig]

LOLOL yes, completely agree.

[ghost]

I care way too much about my system security to run a container open to the internet in privileged mode.. these other guys have balls of steel.

That works if you replace PRIVILEGED line by no admin user PUID and PGID lines.

the advantage of doing it like this is that you don't touch containerd.io

[cnossa]

It's a permission issue. "privileged: true" resolved it for me:

[mbourd25]

Adding "privileged: true" worked for me.

Thanks everyone