Comment by tianon | Hacker News Reader

Comment by tianon | Hacker News Reader

Parent Full thread

It does have linked local addresses by default. It's the more complicated setup of actually routing IPv6 addresses outside our current host that's not enabled by default.

https://docs.docker.com/articles/networking/#ipv6 has more of the details (and the discussion at https://github.com/docker/docker/pull/8947#discussion_r22534... is also useful)

Basically, we can't use existing router advertisements (as I understand it) because you also have to tell your current IPv6 router that the entire prefix you use for Docker needs to go to this one host as opposed to just the one IPv6 address that host would auto-assign itself via RA.

Since there's manual outside-Docker setup involved, we can't really automate this bit. If there's a nice clean way to do so, we're definitely open to a PR (I'd love to have something simpler myself)! :)

That is not very clear from the docs then which say "By default, the Docker server configures the container network for IPv4 only. You can enable IPv4/IPv6 dualstack support by running the Docker daemon with the --ipv6 flag" - that doesnt sound like link local addresses by default...

Will have to take a look, I guess there are lots of potential setups. If you have a /64 per host it should be ok anyway, if you have a /64 for the network it might not be.

Link local addresses are not meant for application level use in IPv6 so bringing them up would only be confusing.

LL addresses are used for stuff like router advertisement, neighbour discovery (IPv6 equivalent of ARP) etc. You can't use link-local addresses without extra gyrations in socket API (scope id) so they cannot be usefully passed to normal apps.

What would be the ideal complementary feature to happen outside Docker to make this easier? Make radvd cgroup-aware, maybe?

I am not sure you need to. If each machine has a /64, then each can assign that on the docker0 bridge and run radvd which assigns addresses to the docker containers (from the /64 or eg a /80). I dont see radvd needs changes; you should be able to even run it on its own docker container.

I think the issues are more around the fact you may need to change existing addresses, plus potentially split up the /64 (or whatever) your machine has among docker bridges, plus you need to make sure the /64 is no longer on the external interface.

Reply on news.ycombinator.com