7.1.2 Docker no shim "network"

May 16, 20251 yr

Hi, i've recently detected another issue I have with unraid. I'm running Adguard (docker container) on a custom Network br:0 and wanted to ping it via the host console, with the result of: ;; communications error to 10.55.0.2#53: host unreachable

Digging a bit deeper I've found a possible solution: activate "Host access to custom networks:", but it was already activated. then i found out that maye the shim network is not crated, which is the case.

By diggging into this threat here and there ive recreated the shim by using the command:

ip link add shim-br0 link br0 type macvlan mode bridge
ip link set shim-br0 up

all docker containers with the br0 custom network won't start. Only a restart solved the problem.

I've attached the diagnosis, hope someone can help me to fix the issue.

homeservercs-diagnostics-20250516-2337.zip

Quote

May 17, 20251 yr

Community Expert

when messing with the docker generated bridge with docker you need other commands to flush the interface and reconnect or assign a static ip...

Example:

Docker settings:

VM Settings:

Unraid Network settings (Default Bridging on, bonding off)

user scripts To touch the shim-br0

example:

user script run at first arry start

#!/bin/bash

# Wait at boot
sleep 30

echo "Fixing Docker shim bridge..."
ifconfig shim-br0 down 2>/dev/null
ip link set shim-br down 2>/dev/null
ip addr flush dev shim-br0
ip addr add 192.168.2.250/24 dev shim-br0
ip link set shim-br0 up
echo "Docker shim interface configured."

ip a

One Interface unraid example:

root@Docker:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq master br0 state UP group default qlen 1000
    link/ether bc:24:11:05:59:37 brd ff:ff:ff:ff:ff:ff
4: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether bc:24:11:05:59:37 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.251/24 metric 1 scope global br0
       valid_lft forever preferred_lft forever
6: tailscale1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1280 qdisc fq state UNKNOWN group default qlen 500
    link/none 
    inet6 fe80::2712:bdb6:8331:7a2c/64 scope link stable-privacy proto kernel_ll 
       valid_lft forever preferred_lft forever
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:a8:56:98:6c brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
8: shim-br0@br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether ce:b1:97:23:c3:98 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.250/24 scope global shim-br0
       valid_lft forever preferred_lft forever
root@Docker:~#

Edited May 17, 20251 yr by bmartino1
typo

Quote

May 18, 20251 yr

I suspect that we are seeing the same issue. So far, I have found one other besides myself and this post.

https://forums.unraid.net/topic/190305-712-docker-vlan-host-comms-broken/

In my case, nothing was changed in the networking or Docker config prior to or following the 7.1.1 or 7.1.2 updates, and it has been working with the same configuration since 6.12.

Quote

May 18, 20251 yr

Wow. I just found this post after spending some hours resolving yesterday.

My Configuration

In my environment, I typically host my Docker containers on the same network (10.0.0.0/24) that all of my devices are configured on - including the Unraid server at 10.0.0.10. I created a macvlan based custom Docker network on that same network, and each Docker container has an explicitly assigned IP address in the same network.

My unRaid has a dual 10GB network card with the interfaces bonded with 802.3ad on two aggregated ports on a Unifi 10GB switch (interface br1) with the 10.0.0.10 statically assigned.

For some reason, my Docker containers on the same network could not communicate with the unRaid host and vice versa. The final solution I found worked was to manually create a second interface called "br1.macvlan0" on its own IP that explicitly bridged with the br1 interface. After that, the Docker containers and host (Unraid server at 10.0.0.10) could not communicate seamlessly.

I installed User Scripts and added one to run the following explicitly at array start but you can have it start whenever appropriate for your situation.

#!/bin/bash
ip link add link br1 name br1.macvlan0 type macvlan mode bridge
ip addr add 10.0.0.2/24 dev br1.macvlan0
ip link set dev br1.macvlan0 up

The main difference from the OP (which I will try next as it's cleaner) is that I had added a second IP address as the bridge.

Edited May 18, 20251 yr by RandoUser

Quote

May 18, 20251 yr

Author

20 hours ago, bmartino1 said:

when messing with the docker generated bridge with docker you need other commands to flush the interface and reconnect or assign a static ip...

Example:

.....

Thanks for getting back.

Just to be clear, and I no not make another misstake. Does this mean in my case the following... - important, i'm on IPVLan NOT on MacLan, does this make any difference for your suggested script? the command I've postetd earlier was maclan, think this was one of my mistakes....

docker:

VM

Network-settings:

Command I've adjusted:

#!/bin/bash

# Wait at boot
sleep 30

echo "Fixing Docker shim bridge..."
ifconfig shim-br0 down 2>/dev/null
ip link set shim-br down 2>/dev/null
ip addr flush dev shim-br0
ip addr add 10.55.0.189/24 dev shim-br0
ip link set shim-br0 up
echo "Docker shim interface configured."

ip a

is this correct? I will use user scripts to add this script at starting the array, or is there a better way of doing it?

Thx

Quote

May 18, 20251 yr

Community Expert

Quote

Just to be clear, and I no not make another misstake. Does this mean in my case the following... - important, i'm on IPVLan NOT on MacLan, does this make any difference for your suggested script? the command I've postetd earlier was maclan, think this was one of my mistakes....

NO, the script is messing with the network interfaces no the docker networks driver.(doent' matter if its ipvlan/macvlan....).. While it may affect how the docker driver uses the network interface...

While it will work with ipvlan its really meant for macvlan due to how the interface use the mac address.

macvlan will randlomy make a mac address

ipvlan will reuse teh eth0/br0 mac address

some more info on the docker networks...

with tips and tweaks plugin giveing some nice notes to some settings:

The ipvlan type is best when connection to the physical network is not needed. Please read this on implementing an ipvlan network. https://docs.docker.com/engine/network/drivers/ipvlan/

The macvlan type of network allows direct connection to the physical network. Please read this on implementing a macvlan network. https://docs.docker.com/engine/network/drivers/macvlan/

Note: Docker uses its own dhcp service, which is the DHCP Pool setting. When you use multiple Unraid servers, then each server must have a different Docker DHCP Pool range configured.

Your unraid settings look good. moving into the script:

#!/bin/bash

# Wait at boot
sleep 30

echo "Fixing Docker shim bridge..."
ifconfig shim-br0 down 2>/dev/null
ip link set shim-br down 2>/dev/null
ip addr flush dev shim-br0
ip addr add 10.55.0.189/24 dev shim-br0
ip link set shim-br0 up
echo "Docker shim interface configured."

ip a

this looks good.

step 1 bring down the active interface.

setp 2 celar and bring down any assigned ip address to teh interface

step 3 clea and flush the dev netowrk interface for cusom ip (some small fixes from step 2 if not all is cleared...)

step 3 assign a static ip to the vhost/shim bridge interface (I do this to remove the same ip assigned that it gets from the br0 at eth0 creation

- as this make a duplicate mac taht can be flaged asa rouge dhcp as 2 ip are on 2 different mac address!...

step 4 with the device flusehed and or assinged static ip set we bring up the interface

ip a to log and douple check

could use a ip before the echo to have a before and after in the log...

this script was setup and desigend for me to sleep 30 secods and the script to run at first array start.

this gives times for the disk array to finish starting and other unraid docker auto strat to begin.
the dockers need time form a rebbot to when they are full up as we are messing with autostart and potential docker networks...

your sleep time may need adjusted to be latter depending on how long it takes to boot and be fully up and loaded.

as this script will run with the dockers running. (tehre will be some notes in syslog when it happens but no issues to dockcer that I have experienced...

Quote

May 18, 20251 yr

Author

I'm not an network expert, but i will try to figure it out and sorry for the dump questions:

1 hour ago, bmartino1 said:

While it will work with ipvlan its really meant for macvlan due to how the interface use the mac address.

macvlan will randlomy make a mac address

ipvlan will reuse teh eth0/br0 mac address

does this mean, it's not recommended if I use ipvlan? Currently I'm not planning to switch to macvlan for my unraid server. Are there any potential issues, in case of the shim-network if the ipvlan is using the same mac address?

1 hour ago, bmartino1 said:

step 1 bring down the active interface.

setp 2 celar and bring down any assigned ip address to teh interface

step 3 clea and flush the dev netowrk interface for cusom ip (some small fixes from step 2 if not all is cleared...)

step 3 assign a static ip to the vhost/shim bridge interface (I do this to remove the same ip assigned that it gets from the br0 at eth0 creation

- as this make a duplicate mac taht can be flaged asa rouge dhcp as 2 ip are on 2 different mac address!...

step 4 with the device flusehed and or assinged static ip set we bring up the interface

sorry but i do not get it. Is it possible to describe the steps in more detail?

step 1 bring down the active interface.

=> disable docker and vm ware?

setp 2 clear and bring down any assigned ip address to teh interface

=> how? what do have to do in order to clear step 2

step 3 clear and flush the dev netowrk interface for cusom ip (some small fixes from step 2 if not all is cleared...)

=> how?

step 3 assign a static ip to the vhost/shim bridge interface (I do this to remove the same ip assigned that it gets from the br0 at eth0 creation

- as this make a duplicate mac taht can be flaged asa rouge dhcp as 2 ip are on 2 different mac address!...

=> how?

step 4 with the device flusehed and or assinged static ip set we bring up the interface

=> how?

general: when do i have to do the above steps? only one, before i initialy start the script, because in general the script will automatically startet on boot.

btw. this is my current routing table:

thank you for your help!

Edited May 18, 20251 yr by ChrisCross

Quote

May 18, 20251 yr

Community Expert
Solution

...

Quote

May 21, 20251 yr

Author

On 5/18/2025 at 10:23 PM, bmartino1 said:

...

Many thx, got it working for now, lets see if the script is working too, after rebooting the maschine.

What was working temporarly, was the hint by @KnightRdr23 : I was able to resolve this by stopping docker, changing ipvlan to macvlan, saving then reverting and saving, and also changing host access to custom networks to disabled, saving then enabled, and saving again. Finally re-enabled docker and seem to be working again for now,

Quote

May 21, 20251 yr

15 minutes ago, ChrisCross said:
Many thx, got it working for now, lets see if the script is working too, after rebooting the maschine.

Is this script universal, or does it need customizing to work? My box has both bridging and bonding disabled, VLANs, and custom bridges in place. Also, my IP base is different from the script. I couldn't see any specific walkthrough of customizing the script to suit a system's config, and I would like to avoid killing my network connectivity completely.

Any chance of getting a walkthrough on what needs to be customized?

Quote

May 21, 20251 yr

Author

48 minutes ago, aglyons said:
Any chance of getting a walkthrough on what needs to be customized?

I'm not an expert but you can us it as an starting point. And I have to mention, i do not know if it will work, as I haven't rebooted my system yet. My two cents on it, maybe bmarino1 jumps in and correct me:

#!/bin/bash

# Wait at boot
sleep 30

echo "Fixing Docker shim bridge..."
ifconfig shim-br0 down 2>/dev/null
ip link set shim-br down 2>/dev/null
ip addr flush dev shim-br0
ip addr add 10.55.0.189/24 dev shim-br0
ip link set shim-br0 up
echo "Docker shim interface configured."

ip a

check your standard network is, in my case br0

you have to manually insert an available IP adresse, in my case 10.55.0.189/24 , which will then be assigned for the shim-network

and i think thats it. You can check if the shim network was sucessfully created by checking the network routing tabel or use the command ifconfig directly

Quote

May 21, 20251 yr

Community Expert

3 hours ago, aglyons said:
Is this script universal, or does it need customizing to work? My box has both bridging and bonding disabled, VLANs, and custom bridges in place. Also, my IP base is different from the script. I couldn't see any specific walkthrough of customizing the script to suit a system's config, and I would like to avoid killing my network connectivity completely.
Any chance of getting a walkthrough on what needs to be customized?

defualt un-edited unraid settings universal yes...

if you have eth0 then change br0 if its bond then change br0 to bond.

Original it was called vhost in v6. so it was called vhost0

use ip a to see the interface name to get the correct interface name.

Quote

May 21, 20251 yr

Thanks @bmartino1 and @ChrisCross

Regarding the IP address to assign, is that for the host network or the VLAN? If it's the host network, is that not going to add another IP to the host machine on the same host network? I already have Unifi complaining on the regular about two devices having the same IP; now it appears that we are adding a third IP for one box!?

@limetech This is an example of the community trying to help solve these issues, but there is a lack of clarity and an introduction of third-party code to solve a bug that could cause complications should the following release address this issue from another direction. If there is an official patch that works, either broadcast that out in an email to paid users or release the 7.1.3 release with this in place.

Edited May 21, 20251 yr by aglyons

Quote

May 21, 20251 yr

Community Expert

3 hours ago, aglyons said:
Thanks @bmartino1 and @ChrisCross
Regarding the IP address to assign, is that for the host network or the VLAN? If it's the host network, is that not going to add another IP to the host machine on the same host network? I already have Unifi complaining on the regular about two devices having the same IP; now it appears that we are adding a third IP for one box!?
@limetech This is an example of the community trying to help solve these issues, but there is a lack of clarity and an introduction of third-party code to solve a bug that could cause complications should the following release address this issue from another direction. If there is an official patch that works, either broadcast that out in an email to paid users or release the 7.1.3 release with this in place.

This is more due to orginal legacy code in how unraid generates and makes networks and there connections. As unraid runs on slackware linnux and doesn't use systemd it uses system intervars...

root@Docker:~# cd /etc/rc.d/

root@Docker:/etc/rc.d# ls

rc.0@ rc.apcupsd* rc.crond* rc.inetd* rc.local_shutdown* rc.ntpd* rc.serial* rc.unraid-api*

rc.4* rc.atd* rc.dnsmasq rc.ip_forward* rc.loop* rc.openldap rc.setterm* rc.wireguard*

rc.4.local* rc.avahidaemon* rc.docker* rc.kadmind rc.mcelog* rc.php-fpm* rc.smartd rc.wireless*

rc.6* rc.avahidnsconfd* rc.elogind* rc.keymap* rc.messagebus* rc.ptpd* rc.sshd* rc.wsdd2*

rc.K* rc.bind rc.flash_backup* rc.kpropd rc.modules* rc.rpc* rc.swapfile@ rc0.d@

rc.M* rc.cgconfig rc.font rc.krb5kdc rc.modules.local* rc.rsyslogd* rc.sysstat rc6.d/

rc.S* rc.cgred rc.inet1* rc.library.source rc.mysqld rc.runlog rc.sysvinit*

rc.S.cont* rc.cgroup2unraid* rc.inet1.conf rc.libvirt* rc.nfsd* rc.samba* rc.tailscale@

rc.acpid* rc.cpufreq* rc.inet2* rc.local* rc.nginx* rc.saslauthd rc.udev*

root@Docker:/etc/rc.d#

so unraid / slackware services as run from here example start stop status for the application daemon

root@Docker:/etc/rc.d# /etc/rc.d/rc.samba status

Samba server daemon is currently running.

root@Docker:/etc/rc.d#

then the mess that is unraid trying to make script to fix and edit inet the linux service daemon regarding networks...
root@Docker:/etc/rc.d# cat rc.inet

rc.inet1 rc.inet1.conf rc.inet2 rc.inetd

root@Docker:/etc/rc.d# cat rc.inet
its a long confusing script of loop of legacy code and script... Some has gotten better other areas worse...

(What I want is to have docker enabled, preserver custom networks in the docker db file. and to make my own docker netwroks and bridge interfaces to actual use the hypev layer 2/layer 3 virtual switch and linux comand to make my own netowrks and connections for the docker newtork. but this get into gotcha and caveots in the sytem that break other ares....

(Like why am I bridging a bridge interface I can make mutiple bridges off eth0...)
But then they[Limnetech/Unraid] can't gurantee conectivity.... and it works as is... just a mess across the forum and docs...

as noted in the programing scripts chat. this is a known issue with how linux network bridges are made and the over security in unfi equipment

hoard to exaplin depends on unif settings. It would be the host network and may be a vlan network depending on your setting and how you have unraid netwroking setup.

the option that flags this in unifi is rouge dhcp server.
this is due to first bridge creation it wil not make a endpoint on itself and will reuse the orginral interface

defualt unraid eth0 will make a br0 interface
br0 is then softwre shim bridge made for the ip[vlan/macvlan network.
the shim-br0 (or vhost0) interface is a bridge on a bridge and how the setting was passed is simlar to what it did to eth0
as eth0 is assigend ot the bridge interface the ip if set static or vlan if set on the interface gets assinged to br0 interface.

to make the docker network another bridge was called to br0 and it duplicated instead or replacing the interface of the netwrok.

SO for me
I don't run vlans.. I run unifi

root@Docker:~# ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo