Drop "-o com.docker.network.enable_ipv[46]" if overridden

When a network is created with "-o com.docker.network.enable_ipv4'
(including via "default-network-opts" in daemon config), and
EnableIPv4 is present in the API request (including when CLI option
"--ipv4" is used) - the top-level API value is used and the '-o'
is ignored.

But, the "-o" still shows up in Options in inspect output, which is
confusing if the values are different.

So, drop the "-o" if the top-level API option is set. Ditto IPv6.

Signed-off-by: Rob Murray <rob.murray@docker.com>

Author: robmry

daemon/network.go

@@ -318,6 +318,9 @@ func (daemon *Daemon) createNetwork(ctx context.Context, cfg *config.Config, cre
 	enableIPv4 := true
 	if create.EnableIPv4 != nil {
 		enableIPv4 = *create.EnableIPv4
+		// Make sure there's no conflicting DefaultNetworkOpts value (it'd be ignored but
+		// would look wrong in inspect output).
+		delete(networkOptions, netlabel.EnableIPv4)
 	} else if v, ok := networkOptions[netlabel.EnableIPv4]; ok {
 		var err error
 		if enableIPv4, err = strconv.ParseBool(v); err != nil {
@@ -328,6 +331,9 @@ func (daemon *Daemon) createNetwork(ctx context.Context, cfg *config.Config, cre
 	var enableIPv6 bool
 	if create.EnableIPv6 != nil {
 		enableIPv6 = *create.EnableIPv6
+		// Make sure there's no conflicting DefaultNetworkOpts value (it'd be ignored but
+		// would look wrong in inspect output).
+		delete(networkOptions, netlabel.EnableIPv6)
 	} else if v, ok := networkOptions[netlabel.EnableIPv6]; ok {
 		var err error
 		if enableIPv6, err = strconv.ParseBool(v); err != nil {

integration/network/bridge/bridge_linux_test.go

@@ -104,6 +104,61 @@ func TestCreateWithIPv6WithoutEnableIPv6Flag(t *testing.T) {
 	t.Fatalf("Network %s has no ULA prefix, expected one.", nwName)
 }
 
+// TestDefaultIPvOptOverride checks that when default-network-opts set enable_ipv4 or
+// enable_ipv6, and those values are overridden for a network, the default option
+// values don't show up in network inspect output. (Because it's confusing if the
+// default shows up when it's been overridden with a different value.)
+func TestDefaultIPvOptOverride(t *testing.T) {
+	ctx := setupTest(t)
+	d := daemon.New(t)
+	const opt4 = "false"
+	const opt6 = "true"
+	d.StartWithBusybox(ctx, t,
+		"--default-network-opt=bridge=com.docker.network.enable_ipv4="+opt4,
+		"--default-network-opt=bridge=com.docker.network.enable_ipv6="+opt6,
+	)
+	defer d.Stop(t)
+	c := d.NewClientT(t)
+
+	t.Run("TestDefaultIPvOptOverride", func(t *testing.T) {
+		for _, override4 := range []bool{false, true} {
+			for _, override6 := range []bool{false, true} {
+				t.Run(fmt.Sprintf("override4=%v,override6=%v", override4, override6), func(t *testing.T) {
+					t.Parallel()
+					netName := fmt.Sprintf("tdioo-%v-%v", override4, override6)
+					var nopts []func(*networktypes.CreateOptions)
+					if override4 {
+						nopts = append(nopts, network.WithIPv4(true))
+					}
+					if override6 {
+						nopts = append(nopts, network.WithIPv6())
+					}
+					network.CreateNoError(ctx, t, c, netName, nopts...)
+					defer network.RemoveNoError(ctx, t, c, netName)
+
+					insp, err := c.NetworkInspect(ctx, netName, networktypes.InspectOptions{})
+					assert.NilError(t, err)
+					t.Log("override4", override4, "override6", override6, "->", insp.Options)
+
+					gotOpt4, have4 := insp.Options[netlabel.EnableIPv4]
+					assert.Check(t, is.Equal(have4, !override4))
+					assert.Check(t, is.Equal(insp.EnableIPv4, override4))
+					if have4 {
+						assert.Check(t, is.Equal(gotOpt4, opt4))
+					}
+
+					gotOpt6, have6 := insp.Options[netlabel.EnableIPv6]
+					assert.Check(t, is.Equal(have6, !override6))
+					assert.Check(t, is.Equal(insp.EnableIPv6, true))
+					if have6 {
+						assert.Check(t, is.Equal(gotOpt6, opt6))
+					}
+				})
+			}
+		}
+	})
+}
+
 // Check that it's possible to create IPv6 networks with a 64-bit ip-range,
 // in 64-bit and bigger subnets, with and without a gateway.
 func Test64BitIPRange(t *testing.T) {