Stop loosing people IP address in containers #12

New issue

Closed

opened 2020-07-06 06:54:07 +00:00 by quentin · 1 comment

quentin commented

2020-07-06 06:54:07 +00:00

Owner

My hypothesis:

For any reason, the iptables routing is broken
We then fallback to docker-proxy, which is... in fact a proxy, and it is its address we see.
Maybe we should switch to docker.io

As now, the following negative impacts have been seen:

Broken ratelimiting on Dovecot usage
Broken ban on Nextcloud connection failure

Inside containers, we only see one IP address: 172.17.0.1. It is not a normal behavior. I don't quite understand why/how the interaction with Nomad can lead to such a situation. Some links to help diagnose the problem: - https://windsock.io/the-docker-proxy/ - http://rabexc.org/posts/docker-networking My hypothesis: - For any reason, the iptables routing is broken - We then fallback to `docker-proxy`, which is... in fact a proxy, and it is its address we see. - Maybe we should switch to docker.io As now, the following negative impacts have been seen: - Broken ratelimiting on Dovecot usage - Broken ban on Nextcloud connection failure

quentin commented

2020-07-06 13:32:41 +00:00

Author

Owner

The problem is not with docker-proxy.
We should use X-Forwarded-For and find a solution with Dovecot.
Closing for now.

The problem is not with `docker-proxy`. We should use `X-Forwarded-For` and find a solution with Dovecot. Closing for now.