Docker: connection reset by peer

english
#1

I have a physical CentOS 7 host (A) on my LAN (192.168.0.0/16). SElinux is disabled, and firewalld is disabled. It is the only changes I made from install defaults.

I have an other host (B) on that LAN; (B) has services like www, ssh, icmp.

At this step, I can play with (B) from (A):

$ ping *(B)*
 ... success ...
$ curl google.com
 ... success ...
$ curl *(B)*
 ... success ...
$ mysql *(B)*
 ... success ...

Everything is running fine.

Now, I install Docker Community on (A):

$ yum check-update
$ curl -fsSL https://get.docker.com/ | sh
$ systemctl start docker

And now the results of such commands again on (A):

$ ping *(B)*
 ... success ...
$ curl google.com
 ... success ...    
$ curl *(B)*
 ... Recv failure: Connection reset by peer ...
$ mysql *(B)*
 ... Connection reset by peer ...

So basically, once Docker is setup and active, all TCPs connections from (A) (the host OR a docker container) to my LAN failed. Such error are likely to be a firewall issue, because TCPs connections from (B) to (A) are still available.

However I check iptables on (A) for REJECT rules or policies mistakes and there is absolutely nothing. I even clean iptables entirely on (A), and the problem still occur.

If all firewalls/security systems are disabled or empty of restrictives rules, and with permissives policies, I don't understand where is the problem and where I have to check on my CentOS system to solve the issue.

Could you please help ?

#2

This sounds like the docker bridge IP may be colliding with IP's on your network. If this is a completely clean installation and there wasn't a /var/lib/docker from before, then look into adjusting the bip setting in the docker daemon. You'll know this is an issue if docker network inspect bridge shows an IP range you need, and netstat -nr (or ip r) shows the IP range used by docker0 also being used by other interfaces or as a gateway. To update the bip setting, see https://docs.docker.com/engine/userguide/networking/default_network/custom-docker0/