Containers suddenly stopped working since move to core20 snap - No more IP's assigned

[tomp (Thomas Parrott)]

Ah docker. See

Lxd bridge doesn't work with IPv4 and UFW with nftables

As you can see getting the various firewall implementations to play nicely together is a non-trivial task. In the meantime these commands seems to suffice to allow traffic from lxdbr0 interface to the LXD host and for traffic from lxdbr0 to be routed to the external network without allowing all external inbound traffic: sudo ufw allow in on lxdbr0 sudo ufw route allow in on lxdbr0 sudo ufw route allow out on lxdbr0 See our page in the docs about this also:

and

LXD and Docker Firewall Redux - How to deal with FORWARD policy set to drop

It looks like something (docker perhaps) has refreshed the firewall rules and removed the ones LXD added. Assuming your LXD bridge is lxdbr0 then you’re missing these lines: -A FORWARD -o lxdbr0 -m comment --comment "generated for LXD network lxdbr0" -j ACCEPT -A FORWARD -i lxdbr0 -m comment --comment "generated for LXD network lxdbr0" -j ACCEPT before the line: -A FORWARD -j DOCKER-USER

[Skyrider]

Not sure if the first UFW rules did it… But containers are getting an IP again!

[tomp (Thomas Parrott)]

Basically docker modifies the iptables rules so that it prevents container’s DHCP requests. But depending on the start up order of docker vs LXD it may work or not without rule modification.

But if you then reload LXD it wipes its own rules and re-adds them which can then cause the docker rules to take effect.

[Skyrider]

I assume this is in combination with dnsmasq? As it worked fine for many weeks/months before.

[tomp (Thomas Parrott)]

Its a well known historical issue (search the forums for docker), its firewall rules prevent containers reaching dnsmasq’s DHCP service. But as I explained it depends on ordering, which can be unpredictable and variable on different systems.

[tomp (Thomas Parrott)]

So its been confirmed that its the raw.dnsmasq auth-zone=lxd setting that is causing the problem. See dnsmask process exited prematurely if raw.dnsmasq auth-zone set when using core20 snap · Issue #8905 · lxc/lxd · GitHub issue for more detail.