Open nek0 opened 5 years ago
Thank you for your contributions.
This has been automatically marked as stale because it has had no activity for 180 days.
If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.
Here are suggestions that might help resolve this more quickly:
I would like to point out, that this issue still persists. when mutliple containers get started at the same time, iptables fails to create all port forwardings neccessary.
We currently start systemd-nspawn directly for declarative containers. Systemd-nspawn talks with the kernel directly to issue iptables rules. I think there is a race condition when multiple systemd-nspawn container are run in parallel. One solution might be to use systemd-machined or create all containers in serial instead parallel.
I marked this as stale due to inactivity. → More info
I don't this have been solved.
I marked this as stale due to inactivity. → More info
Has this been solved yet?
Issue description
when using multiple nixos-containers with private networks and forwarded ports from host to container on the same host, the ports are not forwarded deterministically to the container, as they start simultaneously and cause some kind of race condition in iptables. I've put together a small example as nixops configuration file which can easily be run on any 18.09-stable nixos host.
Steps to reproduce
conf.nix
nixops create -d determinism conf.nix
nixops deploy -d determinism
nixops ssh -d determinism server
iptables -t nat -S
8001
8002
and8003
forwarded to three different nixos containers, but you usually don't.Technical details
"x86_64-linux"
Linux 4.19.16, NixOS, 19.03pre166887.db8e3654e2c (Koi)
yes
yes
nix-env (Nix) 2.2
"nixos-18.09.1922.97e0d53d669, nixos-unstable-19.03pre166449.be445a9074f, nixpkgs-19.03pre166887.db8e3654e2c"
""
/nix/var/nix/profiles/per-user/root/channels/nixos