I have a docker setup that tries to
curl -s 169.254.169.254/latest/meta-data/local-hostname in its docker-entrypoint.sh but it hangs for about 2.5 minutes before continuing.
The IP is a non-routable private IP used to fetch metadata about Amazon instances. However, I'm not running the docker setup on an Amazon instance.
For other people the curl command quits immediately and the container then continues to start. So why doesn't mine?
I am suspecting that my PC is trying to route it even though it shouldn't. I am currently on a university network and so is my colleague who has no troubles running it. These are my routes:
0[14:15:56]lasse@nb-pro:~$ ip route default via 10.68.64.4 dev wlp2s0 proto dhcp metric 600 10.68.64.0/18 dev wlp2s0 proto kernel scope link src 10.68.113.107 metric 600 172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 172.18.0.0/16 dev br-8c353bdd00a2 proto kernel scope link src 172.18.0.1 172.19.0.0/16 dev br-e96e1b1fdd9b proto kernel scope link src 172.19.0.1 linkdown
Here are my firewall rules (all of them created by docker):
0[14:16:18]lasse@nb-pro:~$ sudo iptables -S [sudo] password for lasse: -P INPUT ACCEPT -P FORWARD DROP -P OUTPUT ACCEPT -N DOCKER -N DOCKER-ISOLATION-STAGE-1 -N DOCKER-ISOLATION-STAGE-2 -N DOCKER-USER -A FORWARD -j DOCKER-USER -A FORWARD -j DOCKER-ISOLATION-STAGE-1 -A FORWARD -o br-e96e1b1fdd9b -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -o br-e96e1b1fdd9b -j DOCKER -A FORWARD -i br-e96e1b1fdd9b ! -o br-e96e1b1fdd9b -j ACCEPT -A FORWARD -i br-e96e1b1fdd9b -o br-e96e1b1fdd9b -j ACCEPT -A FORWARD -i br-8c353bdd00a2 -o br-8c353bdd00a2 -j ACCEPT -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -o docker0 -j DOCKER -A FORWARD -i docker0 ! -o docker0 -j ACCEPT -A FORWARD -i docker0 -o docker0 -j ACCEPT -A DOCKER-ISOLATION-STAGE-1 -i br-e96e1b1fdd9b ! -o br-e96e1b1fdd9b -j DOCKER-ISOLATION-STAGE-2 -A DOCKER-ISOLATION-STAGE-1 ! -s 172.18.0.0/16 -o br-8c353bdd00a2 -j DROP -A DOCKER-ISOLATION-STAGE-1 ! -d 172.18.0.0/16 -i br-8c353bdd00a2 -j DROP -A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2 -A DOCKER-ISOLATION-STAGE-1 -j RETURN -A DOCKER-ISOLATION-STAGE-2 -o br-e96e1b1fdd9b -j DROP -A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP -A DOCKER-ISOLATION-STAGE-2 -j RETURN -A DOCKER-USER -j RETURN
I managed to create a null route like this:
ip route add blackhole 169.254.0.0/16
This makes curl exit immediately in bash, but not when run inside a docker container.
It seems something is wrong with my network setup and I would like to fix it so that I can successfully run this docker setup. I am often running openvpn with a kill switch through iptables but these are both disabled right now to ease debugging.
Any help would be appreciated, thanks.