Conversation
Since the move to netip (v29.0.0), applyContainerOptions converted the
--ip value with To4() and silently skipped it when the conversion failed.
Passing an IPv6 address to --ip, for example:
docker run --network mynet --ip 2001:db8::5 alpine
no longer produced an error; the address was dropped, and the container
started with a dynamically assigned address instead of failing. Before
v29 the value was sent as-is, and the daemon rejected it.
Return an invalid-parameter error for an --ip value that is not IPv4,
and for an --ip6 value that is IPv4 (which was previously sent as an
IPv4-mapped IPv6 address).
Assisted-By: Claude Code
Signed-off-by: breken-ai <312387581+breken-ai@users.noreply.github.com>
The --link-local-ip flag had no validator, and since the move to netip
(v29.0.0) its values are converted with toNetipAddrSlice, which skips
any value it cannot parse. A mistyped address, for example:
docker run --network mynet --link-local-ip 169.254.1.1000 alpine
was silently dropped, and the container was created without it. Before
v29 the value was sent as-is, and the daemon rejected it.
Validate the flag with opts.ValidateIPAddress, the same validator the
--dns flag uses, so an invalid value fails when the flags are parsed.
Assisted-By: Claude Code
Signed-off-by: breken-ai <312387581+breken-ai@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docker run/docker createsilently drop some static network addresses instead of reporting an error. Both cases started in v29.0.0, in the move tonetip(f81816e). Before that change the values were sent as strings, and the daemon rejected invalid ones.1.
--ipwith an IPv6 address is ignoredapplyContainerOptionsconverts the value withnetip.AddrFromSlice(copts.ipv4Address.To4())and only sets itif ok. For an IPv6 valueTo4()returnsnil, so the address is skipped:--ip6with an IPv4 value was not silently dropped: it was sent as::ffff:172.20.88.22, and the daemon rejected it as "invalid IPv6 address: ::ffff:172.20.88.22". For symmetry, and for a clearer message, it is now rejected on the client too.docker network connect --ipis not affected. It keeps the family mismatch and lets the daemon reject it.2. An invalid
--link-local-ipis ignored--link-local-iphas no validator (opts.NewListOpts(nil)), andtoNetipAddrSliceskips any value thatnetip.ParseAddrcannot parse. A typo such as--link-local-ip 169.254.1.1000is dropped, and the container is created without it. The flag now usesopts.ValidateIPAddress, the same validator--dnsuses, so the error appears when the flags are parsed.The two fixes are separate commits.
Tests
The new
TestParseNetworkConfigcases (invalid-ip-is-ipv6,invalid-ip6-is-ipv4,invalid-link-local-ip) fail on master (7fc2dff) withexpected an error, got nil, and pass with this change.go test ./cli/command/container/ ./cli/command/network/ ./opts/passes.gofmtandgo vetare clean.Release notes (optional)
A picture of a cute animal (not mandatory but encouraged)
🦦
Created with: Claude Code. The commits carry an
Assisted-Bytrailer, following the AI policy in moby/moby CONTRIBUTING.md.