0

I have a docker setup that tries to curl -s 169.254.169.254/latest/meta-data/local-hostname in its docker-entrypoint.sh but it hangs for about 2.5 minutes before continuing.

The IP is a non-routable private IP used to fetch metadata about Amazon instances. However, I'm not running the docker setup on an Amazon instance.

For other people the curl command quits immediately and the container then continues to start. So why doesn't mine?

I am suspecting that my PC is trying to route it even though it shouldn't. I am currently on a university network and so is my colleague who has no troubles running it. These are my routes:

0[14:15:56]lasse@nb-pro:~$ ip route
default via 10.68.64.4 dev wlp2s0 proto dhcp metric 600
10.68.64.0/18 dev wlp2s0 proto kernel scope link src 10.68.113.107 metric 600
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
172.18.0.0/16 dev br-8c353bdd00a2 proto kernel scope link src 172.18.0.1
172.19.0.0/16 dev br-e96e1b1fdd9b proto kernel scope link src 172.19.0.1 linkdown

Here are my firewall rules (all of them created by docker):

0[14:16:18]lasse@nb-pro:~$ sudo iptables -S
[sudo] password for lasse:
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o br-e96e1b1fdd9b -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-e96e1b1fdd9b -j DOCKER
-A FORWARD -i br-e96e1b1fdd9b ! -o br-e96e1b1fdd9b -j ACCEPT
-A FORWARD -i br-e96e1b1fdd9b -o br-e96e1b1fdd9b -j ACCEPT
-A FORWARD -i br-8c353bdd00a2 -o br-8c353bdd00a2 -j ACCEPT
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i br-e96e1b1fdd9b ! -o br-e96e1b1fdd9b -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 ! -s 172.18.0.0/16 -o br-8c353bdd00a2 -j DROP
-A DOCKER-ISOLATION-STAGE-1 ! -d 172.18.0.0/16 -i br-8c353bdd00a2 -j DROP
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o br-e96e1b1fdd9b -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN

I managed to create a null route like this: ip route add blackhole 169.254.0.0/16

This makes curl exit immediately in bash, but not when run inside a docker container.

It seems something is wrong with my network setup and I would like to fix it so that I can successfully run this docker setup. I am often running openvpn with a kill switch through iptables but these are both disabled right now to ease debugging.

Any help would be appreciated, thanks.

  • Have you tried using ip addr inside the container to see if there's actually a network interface with a 169.* address? Also, do a ip rule and look at the other tables, e.g. ip route list table local. – dirkt Mar 16 at 7:24
  • The ip command does not exist in this image – Lasse Halberg Haarbye Mar 18 at 13:48

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.