Cannot configure fixed-cidr in Docker for Windows via Whaley UI

[asmagin]

Expected behavior

If network subnet is set to 192.168.100.0/24 after you click "Apply" network should be set to 192.168.100.0/24

Actual behavior

Network subnet is set to 172.24.240.1/20

Get-NetNat

Name                             : H04d942b9-c959-4521-871b-f56a4d480972
ExternalIPInterfaceAddressPrefix :
InternalIPInterfaceAddressPrefix : 172.24.240.1/20
IcmpQueryTimeout                 : 30
TcpEstablishedConnectionTimeout  : 1800
TcpTransientConnectionTimeout    : 120
TcpFilteringBehavior             : AddressDependentFiltering
UdpFilteringBehavior             : AddressDependentFiltering
UdpIdleSessionTimeout            : 120
UdpInboundRefresh                : False
Store                            : Local
Active                           : True

Information

• Diagnostic ID - 7573C298-D8A5-4650-9B38-4DC2A1FD80A5/2017-04-07_12-51-08
• host distribution and version

Containers: 3
 Running: 0
 Paused: 0
 Stopped: 3
Images: 35
Server Version: 17.04.0-ce
Storage Driver: windowsfilter
 Windows:
Logging Driver: json-file
Plugins:
 Volume: local
 Network: l2bridge l2tunnel nat null overlay transparent
Swarm: inactive
Default Isolation: hyperv
Kernel Version: 10.0 14393 (14393.953.amd64fre.rs1_release_inmarket.170303-1614)
Operating System: Windows 10 Pro
OSType: windows
Architecture: x86_64
CPUs: 8
Total Memory: 15.82GiB
Name: ASMAGIN
ID: SP5F:S6FV:AW6K:PG34:OEQZ:7BTN:26BX:RFRH:E56P:YZBH:K2WM:HYXV
Docker Root Dir: C:\ProgramData\Docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

Steps to reproduce the behavior

1. Open Docker Setting in tray
2. Open Daemon setting
3. Switch to advanced setting
4. Update configuration like:

{
  "registry-mirrors": [],
  "insecure-registries": [],
  "debug": true,
  "experimental": false,
  "fixed-cidr": "192.168.100.0/24"
}

5. Click apply
6. Inspect nat network with powrshell Get-NetNat or docker network inspect nat

[JanneRantala]

I'm having the same issue. Also my problem is that default network overlaps with host network and therefore I can't connect to my containers.

[biiiipy]

Yeah, changes don't apply if there's already a nat network.
Workaround:

1. Set fixed-cidr through UI
2. Exit Docker and kill Docker service (Docker.Service)
3. (Get-ContainerNetwork | Where-Object {$_.Name -eq 'nat'}) | Remove-ContainerNetwork
4. Start Docker

Nat network should now be recreated with specified subnet.
(although at this moment v17.03 stable throws error and can't start up if fixed-cidr is specified, even if it's the same as default)

[JanneRantala]

Unfortunately that doesn't work for me as I am getting this issue #726

[jorisscheppers]

@biiiipy this workaround does not work. The Get-ContainerNetwork command does not work anymore (see https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-docker/docker-powershell) and is replaced by Get-ContainerNet. This commandlet only works if the daemon is running. And while the daemon is running, the networks cannot be removed.

PS C:\Users\joris> Remove-ContainerNet nat
Remove-ContainerNet : Docker API responded with status code=Forbidden, response={"message":"nat is a pre-defined network and cannot be removed"}
At line:1 char:1
+ Remove-ContainerNet nat
+ ~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Remove-ContainerNet], DockerApiException
    + FullyQualifiedErrorId : Docker Client Exception,Docker.PowerShell.Cmdlets.RemoveContainerNet

When you switch from Windows to Linux containers, it seems that the networks are 'rebuilt' to the default specifications for the target OStype. But when switching back to Windows containers the Docker daemon still seems to ignore the daemon.json settings regarding fixed-cidr. Does anyone have a clue why this is happening?

This situation is really annoying, since my company's internal subnet overlaps with the randomly generated subnet of the Docker nat network. The only workaround I found is to repeatedly revert the Docker daemon to factory defaults until the nat network is configured with a subnet that does not overlap. That or convince my boss to let me work from home indefinitely.

[docker-robott]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale comment.
Stale issues will be closed after an additional 30d of inactivity.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so.

Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows.
/lifecycle stale

[jorisscheppers]

This issue should be fixed. See moby/libnetwork#1916 (review)

[testworksau]

I have the same issue in 19.03.1. I can't say whether the fix referred to above has regressed.

PS C:\WINDOWS\system32> docker info                                                                                                                                                                                                                                  Client:
 Debug Mode: false

Server:
 Containers: 11
  Running: 0
  Paused: 0
  Stopped: 11
 Images: 8
 Server Version: 19.03.1
 Storage Driver: windowsfilter
  Windows:
 Logging Driver: json-file
 Plugins:
  Volume: local
  Network: ics l2bridge l2tunnel nat null overlay transparent
  Log: awslogs etwlogs fluentd gcplogs gelf json-file local logentries splunk syslog
 Swarm: inactive
 Default Isolation: hyperv
 Kernel Version: 10.0 18362 (18362.1.amd64fre.19h1_release.190318-1202)
 Operating System: Windows 10 Enterprise Version 1903 (OS Build 18362.175)
 OSType: windows
 Architecture: x86_64
 CPUs: 8
 Total Memory: 31.85GiB
 Name: AU03-GMCDO-NB1
 ID: NZEW:7VFB:RS7K:CP2S:DUKY:6JLF:54PN:26XJ:XOI3:WKK3:S5PA:2HIS
 Docker Root Dir: C:\ProgramData\Docker
 Debug Mode: true
  File Descriptors: -1
  Goroutines: 27
  System Time: 2019-08-14T17:52:46.6373521+10:00
  EventsListeners: 1
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false
 Product License: Community Engine

[akunaatrium]

I think I have the same problem on Windows Server 2019 and Windows Server 2016 using Docker version 19.03.1. Whatever I specify as the fixed-cidr gives no effect at all - docker network inspect nat still shows some completely arbitrary CIDR as the subnet.

[daschott]

@testworksau @akunaatrium did you remove the old NAT network + either restart the host or restart the docker service for the changes to take effect?

[akunaatrium]

Ok, looks like one has to do a Get-HNSNetwork | Remove-HNSNetwork as well, because just changing the daemon.json file and restarting the Docker service is not enough. Also, a single restart of the Docker service might not be sufficient, because one restart only populates the subnet, another restart populates the gateway, at least that's what I have witnessed.

[daschott]

@akunaatrium That is correct. Gateway not being populated is a separate issue. You should still see the gateway populated in HNS, just not in Docker. Docker may need a restart for the field to populate. The fix for this can be tracked here: moby/libnetwork#2429