{"action":"created","issue":{"url":"https://api.github.com/repos/deis/deis/issues/3280","labels_url":"https://api.github.com/repos/deis/deis/issues/3280/labels{/name}","comments_url":"https://api.github.com/repos/deis/deis/issues/3280/comments","events_url":"https://api.github.com/repos/deis/deis/issues/3280/events","html_url":"https://github.com/deis/deis/issues/3280","id":60826213,"number":3280,"title":"Container cannot start if etcd does not listen on 127.0.0.1 address","user":{"login":"sitya","id":1099191,"avatar_url":"https://avatars.githubusercontent.com/u/1099191?v=3","gravatar_id":"","url":"https://api.github.com/users/sitya","html_url":"https://github.com/sitya","followers_url":"https://api.github.com/users/sitya/followers","following_url":"https://api.github.com/users/sitya/following{/other_user}","gists_url":"https://api.github.com/users/sitya/gists{/gist_id}","starred_url":"https://api.github.com/users/sitya/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sitya/subscriptions","organizations_url":"https://api.github.com/users/sitya/orgs","repos_url":"https://api.github.com/users/sitya/repos","events_url":"https://api.github.com/users/sitya/events{/privacy}","received_events_url":"https://api.github.com/users/sitya/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-03-12T14:24:06Z","updated_at":"2015-03-23T07:23:41Z","closed_at":null,"body":"As it is advised, on our hosts etcd listens on only the private network addresses (10.x.x.x:4001), but in this case it is not able to start any container, because in the generated ServiceUnit files there are no `-C $ETCD` option for the `etcdctl` commands, so the image cannot be found.\r\n\r\nLike:\r\n```\r\n[Unit]\r\nDescription=lambda-unicycle_v2.cmd.1\r\n\r\n[Service]\r\nExecStartPre=/bin/sh -c \"IMAGE=$(etcdctl get /deis/registry/host 2>&1):$(etcdctl get /deis/registry/port 2>&1)/lambda-unicycle:v2; docker pull $IMAGE\"\r\nExecStartPre=/bin/sh -c \"docker inspect lambda-unicycle_v2.cmd.1 >/dev/null 2>&1 && docker rm -f lambda-unicycle_v2.cmd.1 || true\"\r\nExecStart=/bin/sh -c \"IMAGE=$(etcdctl get /deis/registry/host 2>&1):$(etcdctl get /deis/registry/port 2>&1)/lambda-unicycle:v2; port=$(docker inspect -f '{{range $k, $v := .ContainerConfig.ExposedPorts }}{{$k}}{{end}}' $IMAGE | cut -d/ -f1) ; docker run --name lambda-unicycle_v2.cmd.1    -P -e PORT=$port $IMAGE \"\r\nExecStop=/usr/bin/docker stop lambda-unicycle_v2.cmd.1\r\nExecStop=/usr/bin/docker rm -f lambda-unicycle_v2.cmd.1\r\nTimeoutStartSec=20m\r\nTimeoutStopSec=10\r\nRestartSec=5\r\nRestart=on-failure\r\n```\r\n\r\nI guess it is generated via the https://github.com/deis/deis/blob/master/controller/scheduler/fleet.py file."},"comment":{"url":"https://api.github.com/repos/deis/deis/issues/comments/84855203","html_url":"https://github.com/deis/deis/issues/3280#issuecomment-84855203","issue_url":"https://api.github.com/repos/deis/deis/issues/3280","id":84855203,"user":{"login":"sitya","id":1099191,"avatar_url":"https://avatars.githubusercontent.com/u/1099191?v=3","gravatar_id":"","url":"https://api.github.com/users/sitya","html_url":"https://github.com/sitya","followers_url":"https://api.github.com/users/sitya/followers","following_url":"https://api.github.com/users/sitya/following{/other_user}","gists_url":"https://api.github.com/users/sitya/gists{/gist_id}","starred_url":"https://api.github.com/users/sitya/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sitya/subscriptions","organizations_url":"https://api.github.com/users/sitya/orgs","repos_url":"https://api.github.com/users/sitya/repos","events_url":"https://api.github.com/users/sitya/events{/privacy}","received_events_url":"https://api.github.com/users/sitya/received_events","type":"User","site_admin":false},"created_at":"2015-03-23T07:23:41Z","updated_at":"2015-03-23T07:23:41Z","body":"Hi,\r\nthe `addr` and `peer-addr` work fine, but without setting `bind-addr` and `peer-bind-addr` explicitly to `PRIVATE_IPV4` etcd will answer properly on the `http://$PUBLIC_IPV4:4001` as well. And it is problem. But if I set these options explicitly to `PRIVATE_IPV4` it won't be listening on 127.0.0.1. :-(\r\n\r\nI think,  it will be solved with [upgrading to etcd 2.0](https://github.com/coreos/etcd/blob/master/Documentation/clustering.md#04-to-20-migration-guide), with the `listening-*` options.\r\n\r\nTill CoreOS and Deis will use etcd 2.0.x, I configured [Deis firewall](http://docs.deis.io/en/latest/managing_deis/security_considerations/) to prevent connect to etcd using the `PUBLIC_IPV4` address, but I am pretty sure, that the sustainable soulution will be the using of client certification to connect etcd by Deis, as we talked about in #3201 issue."}}