CODEWITHSUNDEEP
dockervpn
Daniel
Daniel

Reputation: 3272

Docker not working with a VPN due to network issues

For some reason my VPN (NordVPN) is interfering with Docker:

make start
docker-compose -f docker-compose/docker-compose.base.yml -f docker-compose/docker-compose.dev.yml up -d
doCreating network "docker-compose_default" with the default driver
ERROR: could not find an available, non-overlapping IPv4 address pool among the defaults to assign to the network
cmake: *** [Makefile:59: up_dev] Error 1

The issue seems to be to do with networking. I'm not sure how to troubleshoot it or fix it, though. After disabling my VPN and running sudo systemctl restart docker, Docker works fine.

Environment

Upvotes: 25

Views: 39861

Answers (3)

Jack Senechal
Jack Senechal

Reputation: 1618

You could try

docker-compose down

That will accomplish the following cleanup for you:

Stop and remove containers, networks, images, and volumes

Upvotes: -1

Piero
Piero

Reputation: 1853

This worked for me. Stop the running container and try with

docker network prune

Note: use with caution

Upvotes: 16

acran
acran

Reputation: 8988

TL;DR

The issue here is that docker/docker-compose is unable to find a suitable address range to assign a subnet to the a new internal network since the VPN adds routes for all IP addresses.

Solutions:

  1. manually define the network and its address range in docker-compose.yml or use an existing one => requires changes in all your docker-compose.yml files which also may become hardly portable due to the hard coded addresses.
  2. start docker/all your services before the VPN => probably not practicable in all cases
  3. reconfigure the routing configuration of your VPN to exclude ranges to be used by docker => will add complexity to your VPN configuration and may leak traffic intended for VPN if done wrong

Explanation

By default docker-compose sets up a dedicated docker network for each project i.e. a virtual bridge device on the docker host.

To assign a subnet range and gateway address to the network docker tries to select a range from a pool of possible ranges. It checks that the selected range does not overlap with a range/route already bound to a connected network device to prevent issues with colliding address ranges in use by the host.

The VPN on the other hand may add its own routes in order to redirect all traffic through the VPN tunnel. Because of this docker will not be able to find a "unused" address range to assign to the new network.

For more on this see the answers to this question and the respective issue on GitHub

Upvotes: 26

Related Questions