Installing docker-io or openstack breaks DNS and DHCP
Installing the docker-io package or some of the OpenStack packages breaks dnsmasq in Amahi 7, thus rendering Amahi servers and the networks that depend on them to their knees.
We don't know why yet, but a good measure would be to put a negative dependency on hda-ctl and hda-platform.
Credit to DarthNerdus for tracking this down!
#5 Updated by Anonymous over 7 years ago
I managed to narrow down the point of failure when installing docker-io.
Docker adding an additional network interface called docker0. It purposefully checks for the IP address of the other interfaces and setups up routing that does not conflict. (In my case it went with 172.17.42.1 as opposed to my 10.0.1.x network.) The issue arises in how traffic is routed once this network interface is added.
To be honest, I'm not very confident on the differences between Ubuntu and Fedora distribtions and some of the differing conventions. I do know that during startup (whether at boot or later via systemctl), Docker adds rules to iptables at the same time that it adds the network interface to properly route traffic and not interrupt existing connections. Whether by Fedora convention or Amahi's, iptables is not the primary firewall by default. In order to have my network operate with Docker enable, I performed the following steps.
// It is recommended to do this before installing docker, otherwise it's going to be painful # systemctl stop firewalld # systemctl disable firewalld # yum install -y iptables-services // This is the last recommend iptables config from https://wiki.amahi.org/index.php/Firewall:_iptables // I did however remove the last two lines which limits traffic to the specific openings. // By removing these lines this allow usage of iptables as a traffic controller moreso than a firewall. # echo amahi_iptables.txt > /etc/sysconfig/iptables # systemctl enable iptables-services # systemctl start iptables-services
At that point this allows you to use iptables as the firewall and docker can add the proper routing and masquerading rules it requires.
Also available in: Atom