freeipa-server container won't start in docker compose

Question

Host OS is Ubuntu 19.10. I've been successful in starting the FreeIPA container using docker run, but I'd like to get it working in compose. When I run docker-compose up, freeipa crashes with the following error:

IPv6 stack is enabled in the kernel but there is no interface that has 
::1 address assigned. Add ::1 address resolution to 'lo' interface. 
You might need to enable IPv6 on the interface 'lo' in sysctl.conf.

My current config:

freeipa:
        image: freeipa/freeipa-server
        command:
            [
                "--realm=${ROOT_DOMAIN}",
                "--ds-password=${LDAP_USER_PASSWORD}",
                "--admin-password=${LDAP_ADMIN_PASSWORD}",
                "-U",
            ]
        hostname: ${FREEIPA_DOMAIN}
        container_name: freeipa
        restart: unless-stopped
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.freeipa.rule=Host(`${FREEIPA_DOMAIN:?Domain for Freeipa must be set!}`)"
            - "traefik.http.routers.freeipa.entrypoints=secure"
            - "traefik.http.routers.freeipa.tls.certresolver=le"
        networks:
            - proxy
        volumes:
            - ${SERVICES_ROOT}/${FREEIPA_ROOT:-freeipa}/db:/data
            - ${SERVICES_ROOT}/${FREEIPA_ROOT:-freeipa}/logs:/var/logs
            - /sys/fs/cgroup:/sys/fs/cgroup:ro
        tmpfs:
            - /run
            - /var/cache
            - /tmp

Link to the full (very large) compose file here

I've enabled ipv6 in Docker and reloaded the daemon:

cat /etc/docker/daemon.json
{
        "ipv6": true,
        "fixed-cidr-v6": "2001:db8:1::/64"
}

Following this blog post, I checked the interface configuration within a container:

$: docker run -itd ajeetraina/ubuntu-iproute bash
f549ae3efe887fe45a1594c87516b948cebbbb6916a6550d738e3271200bd9b7

$: docker exec -it f549 ifconfig
eth0      Link encap:Ethernet  HWaddr 02:42:ac:11:00:02
          inet addr:172.17.0.2  Bcast:172.17.255.255  Mask:255.255.0.0
          inet6 addr: fe80::42:acff:fe11:2/64 Scope:Link
          inet6 addr: 2001:db8:1::242:ac11:2/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:21 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:3722 (3.7 KB)  TX bytes:726 (726.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

It seems like there shouldn't be an issue with the loopback device from what I'm seeing here.

Please note that [the official docs](https://www.freeipa.org/page/Docker) say that the dockerized version "is still just a proof of concept and is not fully supported" and "for testing or demo purposes". I have no idea what exactly that means but please have this in your mind when using it inside docker. — mozzbozz, Jun 28 '20 at 13:11

score 5 · Answer 1 · answered Apr 15 '20 at 16:20

5

I have found the answer in an unrelated Github issue. Adding

sysctls:
    - net.ipv6.conf.all.disable_ipv6=0

to the service definition fixes the problem. I hope this helps someone!

answered Apr 15 '20 at 16:20

PortableStick

363
1
3
10

freeipa-server container won't start in docker compose

1 Answers1