Network change detected on every Docker container start/stop — skip address-less interfaces?

[fabio-lapolla]

Since 2.1.19, dnscrypt-proxy running on a Docker host (here in a container with network_mode: host, but a binary on the host would see the same interfaces) logs a network change every time an unrelated container starts or stops:

[2026-10-21 04:30:26] [NOTICE] Network change detected; rotating DNSCrypt client state
[2026-10-21 04:30:26] [NOTICE] Rotated DNSCrypt client key after network change
[2026-10-21 04:31:26] [NOTICE] Network change detected; rotating DNSCrypt client state
[2026-10-21 04:31:26] [NOTICE] Rotated DNSCrypt client key after network change

Each of these matches a short-lived container being started or removed. The host's real network (eth0, its addresses, the Docker bridges) doesn't change.

It seems to come from buildNetworkInterfaceFingerprint(): non-global addresses are already skipped, but every interface that is up still adds its name and index to the fingerprint, even with no addresses left. Docker creates a new vethXXXX interface for each container (only an fe80:: address), so the fingerprint changes whenever a container comes or goes.

Nothing breaks, the rotation is cheap, and queries keep working. It's mostly log noise, and the "network change" no longer tells you much on such hosts.

Would it make sense to leave out interfaces that have no global unicast address at all? A real network change would presumably still show up through the addresses of the interfaces that do have one.

dnscrypt-proxy 2.1.19, linux_arm64 (Raspberry Pi OS / Debian 13, Docker 29.9.2).

[jedisct1]

This should be fixed now.

Thank you!

[fabio-lapolla]

You're welcome! And thank you for dnscrypt-proxy and for the super quick fix!