Skip to content

fix: cannot start container when IPv6 is disabled#4824

Open
shouhei wants to merge 1 commit intocontainerd:mainfrom
shouhei:fix/handle-missing-proc-net-tcp6-udp6
Open

fix: cannot start container when IPv6 is disabled#4824
shouhei wants to merge 1 commit intocontainerd:mainfrom
shouhei:fix/handle-missing-proc-net-tcp6-udp6

Conversation

@shouhei
Copy link
Copy Markdown

@shouhei shouhei commented Apr 4, 2026

Problem

On systems where IPv6 is disabled (e.g. kernel boot parameter ipv6.disable=1), running a container with port mapping fails with the following error:

$ cat /proc/cmdline | tr ' ' '\n'  | grep ipv6
ipv6.disable=1
$ sudo nerdctl run -p 8080:8080 alpine:latest echo 'OK'
FATA[0000] failed to load networking flags: open /proc/net/tcp6: no such file or directory
$ sudo nerdctl run alpine:latest echo 'OK'
OK
$

Root Cause

When allocating host ports, nerdctl unconditionally reads /proc/net/tcp6 and /proc/net/udp6 to check for ports already in use. On IPv6-disabled systems, the kernel does not create these files, causing the port allocation to fail entirely.

Fix

Treat ErrNotExist for /proc/net/tcp6 and /proc/net/udp6 as a non-error, returning nil (no IPv6 ports in use) instead of propagating the error.

Result

After this fix, containers with port mapping (-p) start successfully on IPv6-disabled systems.

Testing

No unit test is added at this time, as netTCP6Stats and netUDP6Stats are defined as const, making it difficult to inject alternative paths. If the maintainers prefer, these could be changed to var to allow unit testing with a mock path.

…d systems

Signed-off-by: Shouhei <shouhei.yamaguchi.be@gmail.com>
@AkihiroSuda AkihiroSuda added this to the v2.3.0 milestone Apr 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants