Docker is overriding my default route configuration

Question

A noob here starting with docker in a Orange Pi 3 (Rasberry Pi clone).

I'm trying to configure and start a docker containter (bitwarden_rs), but when I do, I lost connection to the external network. Docker mess with my route table.

Network configuration: I have a bridge br0 that bridges eth0 and wlan0. (Eth0 connects to the router, wlan0 is configured in AP mode)

Table when container is stopped:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway        0.0.0.0         UG    425    0        0 br0  <---OK
link-local      0.0.0.0         255.255.0.0     U     1000   0        0 br0
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
192.168.1.0     0.0.0.0         255.255.255.0   U     425    0        0 br0
192.168.2.0     0.0.0.0         255.255.255.0   U     425    0        0 br0

Table when container is running (No internet access to the exterior)

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         0.0.0.0         0.0.0.0         U     205    0        0 docker0 <---NOT OK
default         _gateway        0.0.0.0         UG    425    0        0 br0
link-local      0.0.0.0         255.255.0.0     U     205    0        0 docker0
link-local      0.0.0.0         255.255.0.0     U     230    0        0 vethed140ce
link-local      0.0.0.0         255.255.0.0     U     1000   0        0 br0
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
192.168.1.0     0.0.0.0         255.255.255.0   U     425    0        0 br0
192.168.2.0     0.0.0.0         255.255.255.0   U     425    0        0 br0

What can I do to fix it? It's docker config problem or maybe my system problem (armbian). Thanks

Answer 1

On ubuntu 20.04, I tried many methods, like prevent dhcpd to update route or change NetworkManager configure to let network-manager to igonre veth* device Neither of the above works.

I spent a lot of time and found that connman service changes default route. Change its config file /etc/connman/main.conf by uncommenting following line:

#NetworkInterfaceBlacklist = vmnet,vboxnet,virbr,ifb,veth-,vb-

and

systemctl restart connman

to restart connman service. The issue resolved eventually.

Answer 2

This is because, as you can see docker creates a linux bridge named 'docker0'. You can change the default settings for the docker bridge to resolve the issue. Configure the default bridge network by providing the bip option along with the desired subnet in the daemon.json

# vi /etc/docker/daemon.json
{
  "bip": "172.200.0.1/16"
}

and restart the service.

 systemctl restart docker

More details HERE and HERE

Answer 3

Answer with "bip": "172.200.0.1/16" is wrong, subnet 172.200.0.1/16 is not local, it is wild internet. See any whois service, e.g. https://browserleaks.com/ip/172.200.0.1