Ubuntu安装Docker Desktop后容器网络故障求助

问题背景 #

Linux机器装完Docker Desktop后，容器之间连不上，也没法访问互联网。用自诊断工具检测出两个问题：

1. DD0014：后端进程检查失败，提示readlink /proc/xxx/exe: permission denied
2. DD0012：VM网络功能失效，无法ping通主机

先解决DD0014权限问题 #

• 用root权限重新跑诊断工具，确认是不是普通用户权限不够：

  sudo /opt/docker-desktop/bin/com.docker.diagnose check
  

• 把当前用户加入docker用户组，避免后续权限问题：

  sudo usermod -aG docker $USER
  

  执行完退出当前会话重新登录，让组权限生效。
• 手动检查后端进程状态：

  ps aux | grep com.docker.backend
  

  要是进程在但权限有问题，重启Docker Desktop服务：

  systemctl restart docker-desktop
  

再解决DD0012 VM网络问题 #

• 临时关闭防火墙排查：
  先关防火墙试试能不能恢复网络（仅用来排查，别一直关着）：

  # 针对firewalld
  sudo systemctl stop firewalld
  # 针对ufw
  sudo ufw disable
  

  要是关了之后正常，就给Docker网段加永久放行规则（默认是192.168.65.0/24，可根据实际调整）：

  sudo firewall-cmd --add-source=192.168.65.0/24 --permanent
  sudo firewall-cmd --reload
  

• 检查SELinux限制：
  临时关SELinux测试：

  sudo setenforce 0
  

  要是生效，就改配置文件/etc/selinux/config，把SELINUX=enforcing改成SELINUX=permissive，之后重启系统。
• 重置Docker网络配置：
  在Docker Desktop设置里找「Reset」选项，选「恢复出厂设置」，重置完重启Docker Desktop。
• 手动验证VM连通性：
  跑个Alpine容器ping主机IP，看看能不能通：

  docker run --rm -it alpine ping <你的主机IP>
  

  要是ping不通，检查主机有没有开ICMP响应，或者路由规则是不是有问题。

额外排查建议 #

• 升级Docker Desktop到最新稳定版，你现在用的4.13.0可能有已知的网络/权限bug；
• 检查主机虚拟网络设备：

  ip link show
  

  确认有没有docker0、br-*或veth*这类Docker相关设备，要是没了，重启Docker服务重新生成。

原始诊断输出 #

➜  ~ /opt/docker-desktop/bin/com.docker.diagnose check
[2022-10-21T21:53:23.963576537Z][com.docker.diagnose][I] set path configuration to OnHost
Starting diagnostics

[PASS] DD0018: does the host support virtualization?
[PASS] DD0001: is the application running?
[PASS] DD0017: can a VM be started?
[PASS] DD0016: is the LinuxKit VM running?
[PASS] DD0011: are the LinuxKit services running?
[PASS] DD0004: is the Docker engine running?
[PASS] DD0015: are the binary symlinks installed?
[PASS] DD0031: does the Docker API work?
[PASS] DD0013: is the $PATH ok?
[PASS] DD0034: is Context set to a Docker Desktop context?
[PASS] DD0003: is the Docker CLI working?
[FAIL] DD0014: are the backend processes running? 2 errors occurred:
    * querying com.docker.backend process: is it running as a different user?: readlink /proc/22636/exe: permission denied
    * querying com.docker.backend process: is it running as a different user?: readlink /proc/22654/exe: permission denied


[PASS] DD0007: is the backend responding?
[PASS] DD0008: is the native API responding?
[PASS] DD0009: is the vpnkit API responding?
[PASS] DD0010: is the Docker API proxy responding?
[FAIL] DD0012: is the VM networking working? network checks failed: failed to ping host: exit status 1
[2022-10-21T21:53:24.648095036Z][com.docker.diagnose][I] ipc.NewClient: 4c9ff8fa-diagnose-network -> diagnosticd.sock diagnosticsd
[common/pkg/diagkit/gather/diagnose.runIsVMNetworkingOK()
[   common/pkg/diagkit/gather/diagnose/network.go:34 +0xd9
[common/pkg/diagkit/gather/diagnose.(*test).GetResult(0x11754a0)
[   common/pkg/diagkit/gather/diagnose/test.go:46 +0x43
[common/pkg/diagkit/gather/diagnose.Run.func1(0x11754a0)
[   common/pkg/diagkit/gather/diagnose/run.go:17 +0x5a
[common/pkg/diagkit/gather/diagnose.walkOnce.func1(0x2?, 0x11754a0)
[   common/pkg/diagkit/gather/diagnose/run.go:142 +0x77
[common/pkg/diagkit/gather/diagnose.walkDepthFirst(0x1, 0x11754a0, 0xc000223728)
[   common/pkg/diagkit/gather/diagnose/run.go:151 +0x87
[common/pkg/diagkit/gather/diagnose.walkDepthFirst(0x0, 0x11755a0, 0xc000223728)
[   common/pkg/diagkit/gather/diagnose/run.go:148 +0x52
[common/pkg/diagkit/gather/diagnose.walkOnce(0xb0fde0?, 0xc00035f890)
[   common/pkg/diagkit/gather/diagnose/run.go:137 +0xcc
[common/pkg/diagkit/gather/diagnose.Run(0x11755a0, 0x7fbd50ef6300?, {0xc00035fb20, 0x1, 0x1})
[   common/pkg/diagkit/gather/diagnose/run.go:16 +0x1d4
[main.checkCmd({0xc00012e010?, 0x6?, 0x4?}, {0x0, 0x0})
[   common/cmd/com.docker.diagnose/main.go:133 +0x105
[main.main()
[   common/cmd/com.docker.diagnose/main.go:99 +0x2a7
[2022-10-21T21:53:24.648917178Z][com.docker.diagnose][I] (c88fef01) 4c9ff8fa-diagnose-network C->S diagnosticsd POST /check-network-connectivity: {"ips":["169.254.5.211","169.254.5.199","192.168.86.22"]}
[2022-10-21T21:53:25.180233483Z][com.docker.diagnose][W] (c88fef01) 4c9ff8fa-diagnose-network C<-S d6792b26-diagnosticsd POST /check-network-connectivity (531.701612ms): failed to ping host: exit status 1

[SKIP] DD0030: is the image access management authorized?
[PASS] DD0037: is the virtiofs setup correct?
[PASS] DD0036: is the credentials store configured correctly?
[PASS] DD0033: does the host have Internet access?
[PASS] DD0018: does the host support virtualization?
[PASS] DD0001: is the application running?
[PASS] DD0017: can a VM be started?
[PASS] DD0016: is the LinuxKit VM running?
[PASS] DD0011: are the LinuxKit services running?
[PASS] DD0004: is the Docker engine running?
[PASS] DD0015: are the binary symlinks installed?
[PASS] DD0031: does the Docker API work?
[PASS] DD0032: do Docker networks overlap with host IPs?

Please investigate the following 2 issues:

1 : The test: are the backend processes running?
    Failed with: 2 errors occurred:
    * querying com.docker.backend process: is it running as a different user?: readlink /proc/22636/exe: permission denied
    * querying com.docker.backend process: is it running as a different user?: readlink /proc/22654/exe: permission denied



Not all of the backend processes are running.

2 : The test: is the VM networking working?
    Failed with: network checks failed: failed to ping host: exit status 1

VM seems to have a network connectivity issue. Check your host firewall and anti-virus settings in case they are blocking the VM.

Docker版本信息 #

➜  ~ docker version
Client: Docker Engine - Community
 Cloud integration: v1.0.29
 Version:           20.10.20
 API version:       1.41
 Go version:        go1.18.7
 Git commit:        9fdeb9c
 Built:             Tue Oct 18 18:20:18 2022
 OS/Arch:           linux/amd64
 Context:           desktop-linux
 Experimental:      true

Server: Docker Desktop 4.13.0 (89412)
 Engine:
  Version:          20.10.20
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.7
  Git commit:       03df974
  Built:            Tue Oct 18 18:18:35 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.8
  GitCommit:        9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
 GitCommit:        de40ad0

内容的提问来源于stack exchange，提问作者Jeggy