Docker container can't reach the internet

Likely causes

1. No MASQUERADE (NAT) rule for the container network on the host.
2. The container's veth is not on the docker0 bridge, or the container has no default route via 172.17.0.1.
3. Forwarding is off on the host (net.ipv4.ip_forward = 0).

Diagnose

Run these in order. The output is what each printed on a lab's real Linux machines.

laptop:~# ip netns exec app curl -sS -m 3 http://10.0.1.30/

From inside the container the mirror server times out.

curl: (28) Connection timed out after 3005 milliseconds

laptop:~# ip netns exec web ip -br addr show up

Inside a container: one card with a private address, 172.17.0.2/16.

lo               UNKNOWN        127.0.0.1/8 ::1/128 
eth0@if13        UP             172.17.0.2/16 fe80::844e:43ff:feb9:1a1d/64 

laptop:~# ip -br addr show up

On the host: docker0 holds 172.17.0.1/16, the containers' gateway, and each container's cable ends in a veth.

lo               UNKNOWN        127.0.0.1/8 ::1/128 
eth0@if60218     UP             10.0.1.10/24 
docker0          UP             172.17.0.1/16 fe80::80a3:50ff:fedb:ea1a/64 
veth-web@if11    UP             fe80::5cb2:20ff:fef4:56a4/64 
veth-app@if11    UP             fe80::90b0:b0ff:fe22:8faa/64 

Fix

laptop:~# iptables -t nat -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE

Rewrite the container's source address to the host's on the way out: the server now sees you are 10.0.1.10.

laptop:~# ip netns exec app curl -s -m 3 http://10.0.1.30/
you are 10.0.1.10

ip link set veth-cache master docker0

For a container not on the bridge: put its veth on docker0.

The fix the lab's challenge "The new container is offline" checks.

ip -n cache route add default via 172.17.0.1

And give it a default route via the bridge's address.

The fix the lab's challenge "The new container is offline" checks.

Break it and fix it yourself

Each lab is a small network of real Linux machines in your browser, where this fault happens.

• Container networking: namespaces, veth and a bridge Free: its challenge "The new container is offline" set the fault for you to find and fix.

Open Container networking: namespaces, veth and a bridge