When Docker Containers Can’t Reach the Host

Pinging the host’s IP address (say, 192.168.1.23) from inside a container worked perfectly on a laptop, but failed entirely on a server. The immediate suspicion was a misunderstanding of Linux bridges; reading up on bridges added some knowledge but didn’t fix anything. A suggestion to check iptables seemed unlikely at first, since no custom rules existed beyond the standard Docker set, which worked fine on the laptop.

Finding the Drop with iptables Counters

A blog post on iptables visibility recommended running iptables -L -n -v --line-numbers. The output showed something telling: policy DROP 2 packets on a chain. To confirm this was the actual culprit, iptables -Z reset all counters and a retry produced the identical result—packets were being dropped at that policy.

The ufw Firewall Was the Problem

The drop came from rules installed by ufw, the default firewall on many Ubuntu systems. Pinpointing the exact rule proved difficult, but disabling the firewall entirely with ufw disable solved the problem immediately.

Since the server already sits behind an external firewall (DigitalOcean’s), running an additional iptables-based firewall on the machine seemed redundant. The external firewall was configured to block all TCP ports except 22 and 80, making local ufw rules unnecessary.

Trying Ignite for VM Management

Separate weekend work involved reimplementing a Firecracker VM API on top of ignite. Early findings:

  • ignite converts Docker containers into VM images
  • it uses dmsetup to set up a device mapper, avoiding a full image copy on each VM start
  • however, different tags still each get a full copy of the image—shared container layers don’t save disk space

A hacky HTTP API wrapper (ignite-manager.go) was written, shelling out to the ignite CLI frequently.

Startup Speed Concerns

Ignite VMs currently take 15–20 seconds to start on a DigitalOcean droplet. That’s too slow for the goal of 5-second startup times, so further investigation into the device mapper setup is planned.