Check who previously owned an address claimed outside the range

ipam/claim.go

@@ -51,7 +51,15 @@ func (c *claim) Try(alloc *Allocator) bool {
 	if !alloc.ring.Contains(c.cidr.Addr) {
 		// Address not within our universe; assume user knows what they are doing
 		alloc.infof("Address %s claimed by %s - not in our range", c.cidr, c.ident)
-		addOwned()
+		previousOwner := alloc.findOwner(c.cidr.Addr)
+		switch {
+		case previousOwner == "":
+			addOwned()
+		case previousOwner == c.ident: // already owned by this ID
+		case c.ident == api.NoContainerID: // already owned by anonymous container
+		default:
+			c.sendResult(fmt.Errorf("address %s already in use", c.cidr))
+		}
 		c.sendResult(nil)
 		return true
 	}