{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/15151","labels_url":"https://api.github.com/repos/docker/docker/issues/15151/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/15151/comments","events_url":"https://api.github.com/repos/docker/docker/issues/15151/events","html_url":"https://github.com/docker/docker/issues/15151","id":98116597,"number":15151,"title":"Container crash leaves iptables DOCKER / POSTROUTING chain in unclean state","user":{"login":"falschparker82","id":670772,"avatar_url":"https://avatars.githubusercontent.com/u/670772?v=3","gravatar_id":"","url":"https://api.github.com/users/falschparker82","html_url":"https://github.com/falschparker82","followers_url":"https://api.github.com/users/falschparker82/followers","following_url":"https://api.github.com/users/falschparker82/following{/other_user}","gists_url":"https://api.github.com/users/falschparker82/gists{/gist_id}","starred_url":"https://api.github.com/users/falschparker82/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/falschparker82/subscriptions","organizations_url":"https://api.github.com/users/falschparker82/orgs","repos_url":"https://api.github.com/users/falschparker82/repos","events_url":"https://api.github.com/users/falschparker82/events{/privacy}","received_events_url":"https://api.github.com/users/falschparker82/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/more-info-needed","name":"status/more-info-needed","color":"C6A49A"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-30T08:53:05Z","updated_at":"2015-08-09T19:11:12Z","closed_at":null,"body":"Hi there,\r\n\r\nwe observed an issue yesterday on Docker 1.6.2 (not sure if it's fixed by docker/libnetwork#301  docker/docker#13957 , but probably not), running on Ubuntu 14.04\r\n\r\nA container mysteriously crashed, so I restarted it via `docker-compose up -d`. Container was configured to expose internal port 8080 as external port 1336. Now came the curious part: From the host, the container was reachable under localhost:1336, but NOT under $HOST_PRIVATE_IP:1336\r\n\r\nThis was a situation that \"shouldn't ever happen\" as we saw it and took us quite a few hours to find out. Finally, we found the culprit in the iptables:\r\n\r\n```\r\nChain POSTROUTING (policy ACCEPT)\r\ntarget     prot opt source               destination         \r\n[...]\r\nMASQUERADE  tcp  --  ip-172-17-0-154.eu-west-1.compute.internal  ip-172-17-0-154.eu-west-1.compute.internal  tcp dpt:http-alt\r\n[...]\r\nMASQUERADE  tcp  --  ip-172-17-0-212.eu-west-1.compute.internal  ip-172-17-0-212.eu-west-1.compute.internal  tcp dpt:http-alt\r\n\r\nChain DOCKER (2 references)\r\ntarget     prot opt source               destination         \r\nDNAT       tcp  --  anywhere             anywhere             tcp dpt:1336 to:172.17.0.154:8080\r\n[...]\r\nDNAT       tcp  --  anywhere             anywhere             tcp dpt:1336 to:172.17.0.212:8080\r\n```\r\n\r\nDocker apparently never cleaned up the old DNAT entry, so it was conflicting with the newer one and shadowing it.\r\n\r\nThe docker daemon was never restarted throughout the whole issue and investigation (mainly because we wanted to find the culprit). We could not find out what exactly crashed the container - but not the daemon - though.\r\n\r\nIf this is somehow still an issue, it seems rather easy to fix by always checking for duplicate external port configurations (which should never happen) when inserting the iptable rules. I'm unfortunately not too deep within the codebase, so I can't fix this and don't know if it's still an issue.\r\n\r\nBest,\r\n\r\nDominik\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/129226797","html_url":"https://github.com/docker/docker/issues/15151#issuecomment-129226797","issue_url":"https://api.github.com/repos/docker/docker/issues/15151","id":129226797,"user":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"created_at":"2015-08-09T19:11:12Z","updated_at":"2015-08-09T19:11:12Z","body":"@falschparker82 have you been able to test of this is resolved with 1.7.1? Thanks!"}}