Unable to fetch http requests from containers

vbergae commented 2 years ago

[x] I have tried with the latest version of Docker Desktop
[x] I have tried disabling enabled experimental features
[x] I have uploaded Diagnostics
Diagnostics ID: D3AA7D7D-FF98-4524-A168-335C65AF095E/20211102185102

Expected behavior

From a container http and https requests should work

Actual behavior

All http requests performed from containers ends in timeouts

Information

Is it reproducible? No, in other computer works as expected
Is the problem new? Yes
Did the problem appear with an update? No, it was present from older versions
macOS Version: 12.0.1
Intel chip or Apple chip: Intel
Docker Desktop Version: 4.1.1

Steps to reproduce the behavior

Start a debian based image docker run -it debian /bin/bash

Try to fetch package updates # apt-get update

root@8d27d827298d:/# apt-get update
Err:1 http://deb.debian.org/debian bullseye InRelease                                                   
Could not connect to deb.debian.org:80 (199.232.82.132), connection timed out
Err:2 http://deb.debian.org/debian bullseye-updates InRelease                                           
Unable to connect to deb.debian.org:80:
Err:3 http://security.debian.org/debian-security bullseye-security InRelease           
Could not connect to security.debian.org:80 (151.101.2.132), connection timed out Could not connect to security.debian.org:80 (151.101.66.132), connection timed out Could not connect to security.debian.org:80 (151.101.130.132), connection timed out Could not connect to security.debian.org:80 (151.101.194.132), connection timed out
Reading package lists... Done                           
W: Failed to fetch http://deb.debian.org/debian/dists/bullseye/InRelease  Could not connect to deb.debian.org:80 (199.232.82.132), connection timed out
W: Failed to fetch http://security.debian.org/debian-security/dists/bullseye-security/InRelease  Could not connect to security.debian.org:80 (151.101.2.132), connection timed out Could not connect to security.debian.org:80 (151.101.66.132), connection timed out Could not connect to security.debian.org:80 (151.101.130.132), connection timed out Could not connect to security.debian.org:80 (151.101.194.132), connection timed out
W: Failed to fetch http://deb.debian.org/debian/dists/bullseye-updates/InRelease  Unable to connect to deb.debian.org:80:
W: Some index files failed to download. They have been ignored, or old ones used instead.

Try http vs https connections:

Pull elixir image docker run -it elixir /bin/bash

Run curl http://google.com

root@5b426d711fe5:/# curl --connect-timeout 30 http://google.com
curl: (28) Connection timed out after 30005 milliseconds

Pull elixir image docker run -it elixir /bin/bash

Run curl https://google.com

root@5b426d711fe5:/# curl --connect-timeout 30 https://google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://www.google.com/">here</A>.
</BODY></HTML>

vbergae commented 2 years ago

Sorry, it's a system wide problem without relation with docker

dpetrovaliev commented 2 years ago

@vbergae I had the same issue and I found out that I've turned on the new feature in iCloud "Private Relay". Turning off the option in settings solved my problem.

thaJeztah commented 2 years ago

Thank you @dpetrovaliev - that's useful information (and something we may need to document, and/or see if we can find a workaround for situations where it's enabled)

kutenai commented 2 years ago

I have the same issue, but I do not have icloud private relay turned on.

thaJeztah commented 2 years ago

@kutenai there's many possible causes for networking issues, some of which can be specific to your environment (proxies, VPNs, switching between WiFi networks, etc.) so it may be better to open a new ticket with exact steps to reproduce, and if possible a diagnostic ID.

(networking issues are hard, and "having the same issue" may have unrelated causes, so trying to prevent possibly unrelated issues from being mixed in a single ticket 😅)

kutenai commented 2 years ago

I run the elixir container, just to have a Docker container to run from. I tried curl http://deb.debian.org and got nothing. I then tried curl https://deb.debia.org, and got output from that.

I can ping deb.debian.org just fine PING debian.map.fastlydns.net (199.232.162.132) 56(84) bytes of data. 64 bytes from 199.232.162.132 (199.232.162.132): icmp_seq=1 ttl=37 time=111 ms 64 bytes from 199.232.162.132 (199.232.162.132): icmp_seq=2 ttl=37 time=109 ms 64 bytes from 199.232.162.132 (199.232.162.132): icmp_seq=3 ttl=37 time=105 ms

I am on an M1 Mac, I'm just. not sure if that's part of the issue or not.

djs55 commented 2 years ago

@dpetrovaliev @vbergae I'm curious to know whether HTTP works from the host with private relay enabled.

If you have a moment, could you try using curl and nc from a terminal:

dave@m1 ~ % curl -vvv http://deb.debian.org
*   Trying 151.101.18.132:80...
* Connected to deb.debian.org (151.101.18.132) port 80 (#0)
> GET / HTTP/1.1
> Host: deb.debian.org
> User-Agent: curl/7.77.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: Apache
< X-Content-Type-Options: nosniff
< X-Frame-Options: sameorigin
< Referrer-Policy: no-referrer
< X-Xss-Protection: 1
< Permissions-Policy: interest-cohort=()
< Last-Modified: Thu, 26 Oct 2017 07:34:58 GMT
< ETag: "735-55c6e3596516e"
< X-Clacks-Overhead: GNU Terry Pratchett
< Content-Type: text/html
< Content-Length: 1845
< Accept-Ranges: bytes
< Date: Fri, 05 Nov 2021 14:02:14 GMT
< Via: 1.1 varnish
< Age: 0
< Connection: keep-alive
< X-Served-By: cache-lcy19249-LCY
< X-Cache: MISS
< X-Cache-Hits: 0
< X-Timer: S1636120935.856068,VS0,VE17
< Vary: Accept-Encoding
< 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
   <TITLE>Welcome to deb.debian.org (fastly instance)!</TITLE>
</HEAD>
...

and

% nc deb.debian.org 80
GET / HTTP/1.0

-- it should give you a HTTP/1.1 500 Domain Not Found response.

kutenai commented 2 years ago

The curl request just times out. So does nc.. it does nothing

Note that I do NOT have private relay enabled.

thaJeztah commented 2 years ago

If non-TLS (http://) connections don't work from the host either, sounds like something else is blocking them; is this a corporate network you're on? (any VPN and/or Proxy that's used?)

kutenai commented 2 years ago

This is my home, business internet. No corporate firewalls install. I do have a corporate VPN.

Hmm. Well, I turned that VPN off (I swear I'd tried that before.... ) and now the debian works. I'm an idiot. Seriously, I am! That should have been the first thing I tried.. and, I"m sure I did... but, obviously, NOT.

The thing that threw me is that my original build failed even with the VPN off, but, upon closer examination, the failure is different...

Isolating this down to just a debian issue was helpful, as it gave me a base case, and it appears the corporate VPN was causing the issue.

djs55 commented 2 years ago

@kutenai glad you managed to figure it out! We have a "self-diagnose" program in Docker Desktop. I'll have a look to see if it checks host network connectivity.

thaJeztah commented 2 years ago

I'll have a look to see if it checks host network connectivity.

Good idea!

Hmm. Well, I turned that VPN off (I swear I'd tried that before.... ) and now the debian works.

Great! Good to hear it's resolved

I'm an idiot. Seriously, I am! That should have been the first thing I tried.. and, I"m sure I did... but, obviously, NOT.

😂 don't be too hard on yourself!

xabbudm commented 2 years ago

@vbergae I had the same issue and I found out that I've turned on the new feature in iCloud "Private Relay". Turning off the option in settings solved my problem.

The same for me ;-).

As the behavior is similar to the one described e.g. here, I guess that apple uses a kind of proxy internally to implement their private relay feature. But I don't know if one can one can find out what the address of the proxy is :-(

docker-robott commented 2 years ago

Closed issues are locked after 30 days of inactivity. This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows. /lifecycle locked

docker / for-mac