Bug 1486809

Summary: backport "docker build --network=..." support
Product: OpenShift Container Platform Reporter: Dan Winship <danw>
Component: ContainersAssignee: Lokesh Mandvekar <lsm5>
Status: CLOSED ERRATA QA Contact: Wenjing Zheng <wzheng>
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amurdaca, aos-bugs, bandrade, bbennett, danw, eparis, jhonce, jokerman, lsm5, mmccomas, pbergene, smunilla, wzheng
Target Milestone: ---   
Target Release: 3.7.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-11-28 22:08:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1487652    

Description Dan Winship 2017-08-30 14:59:53 UTC
https://github.com/openshift/origin/pull/13235 made origin pass networkmode to the docker build API, but that API only exists in docker 1.13, so this had no effect on OCP.

But the patch is quite small: https://github.com/moby/moby/pull/27702

Could we get this into our docker? (If I'm looking in the right place, it looks like we don't have that patch now.)

Comment 1 Antonio Murdaca 2017-08-31 18:18:04 UTC
Fixed here for 1.12.6: https://github.com/projectatomic/docker/commit/059451eff3725836f187ecb51a663487b27687f7

Comment 2 Dan Winship 2017-09-01 16:57:41 UTC
OK, so I don't know anything about the process for docker package updates... how long (at least roughly) will it take for this to be available to customers? Would this be done as part of an OCP 3.6.x release or would the new docker just get pushed to a yum repo that OCP hosts are subscribed to or what?

Comment 3 Eric Paris 2017-09-01 20:35:23 UTC
It would get pushed to rhel-extras. This means it would end up available for customers independent of OCP releases. any customer using docker 1.12 (aka about 3.4+) would potentially 'just get' this update.

Comment 7 Paul Bergene 2017-09-19 08:42:14 UTC
Which update of 1.12 is this fixed in?

Comment 8 Paul Bergene 2017-09-19 08:58:11 UTC
1.12.6. Got it.

Comment 9 Dan Winship 2017-09-19 15:41:11 UTC
The fix has not yet been released.

Comment 17 Dan Winship 2017-11-01 17:43:20 UTC
*** Bug 1487652 has been marked as a duplicate of this bug. ***

Comment 18 Wenjing Zheng 2017-11-02 03:31:05 UTC
I can see the error about cannot access service created in a different namespace as below (my env is with "multitenant" network plugin with docker 12.6 version):
Step 1 : FROM centos/ruby-22-centos7@sha256:2ceb8f738e0da65b0f371c1789bb48fc4f65796870354a31c6f57cd93ca9b8b6
 ---> a6ced72cd422
Step 2 : USER default
 ---> Running in cd95b746204e
 ---> 6398d842deea
Removing intermediate container cd95b746204e
Step 3 : RUN curl 172.30.13.160:8080
 ---> Running in aca776bfe881
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:02:07 --:--:--     0curl: (7) Failed connect to 172.30.13.160:8080; Connection timed out
error: build error: The command '/bin/sh -c curl 172.30.13.160:8080' returned a non-zero code: 7

So verifying this bug now.
]# docker version
Client:
 Version:         1.12.6
 API version:     1.24
 Package version: docker-1.12.6-61.git85d7426.el7.x86_64
 Go version:      go1.8.3
 Git commit:      85d7426/1.12.6
 Built:           Tue Sep 26 15:30:51 2017
 OS/Arch:         linux/amd64

Server:
 Version:         1.12.6
 API version:     1.24
 Package version: docker-1.12.6-61.git85d7426.el7.x86_64
 Go version:      go1.8.3
 Git commit:      85d7426/1.12.6
 Built:           Tue Sep 26 15:30:51 2017
 OS/Arch:         linux/amd64
# openshift version
openshift v3.7.0-0.189.0
kubernetes v1.7.6+a08f5eeb62
etcd 3.2.8

Comment 21 errata-xmlrpc 2017-11-28 22:08:20 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:3188