Docker windows mode breaks Hyper-V vEthernet (Default Switch)

[AceHack]

Expected behavior

Create Hyper-V VM and ping google.com works
Looks like Default Switch is a new built in Hyper-V natted virtual switch that is created by default now when you install Hyper-V in the latest windows version. I don't think docker is expecting this.

Actual behavior

ping google.com results in
Ping request could not find host google.com. Please check the name and try again.

Information

• Diagnostic ID from "Diagnose & Feedback" in the menu.
  CB980F31-37E6-4F94-8622-E16E6ADBFA2A/2017-10-04_11-57-30
• a reproducible case if this is a bug, Dockerfiles FTW
• page URL if this is a docs issue or the name of a man page
• host distribution and version (Windows version, build number, etc)
  Windows 10 Enterprise Build 16299.rs3_release.170922-1354
  Docker 17.09.0-ce, build afdb6d4

Steps to reproduce the behavior

1. Install All the following windows components Containers, Guarded Host (Optional), Hyper-V (All), Windows Defender Application Guard (Optional)
2. Create Hyper-V VM and assign it's network to the default built in "Default Switch"
3. Open VM and ping google.com and things work as expected
4. Install docker for windows (default is Linux mode when you first install)
5. Open VM and ping google.com and things still work as expected
6. Switch docker to windows mode
7. Open VM and ping google.com and things no longer work as expected you get the error "Ping request could not find host google.com. Please check the name and try again."
8. If you ping 8.8.8.8 or 172.217.9.206 (Google) things still work as expected so it appears to be something with DNS that docker is breaking in windows mode for the Hyper-V Default Switch

I've attached some diagnostics from the script WindowsContainerNetworking-LoggingAndCleanupAide.ps1 if it offers any help.
FYI, networking inside the containers are working fine, this is just an issues in the Hyper-V VMs.

Thanks.

PreCleanupState_TNDQFBTE.zip

[AceHack]

FYI, there is also another default adapter that Hyper-V creates that you have no control over.

vEthernet (HvsiIcs)

This seems new as well in the latest windows versions.

[mle-ii]

Pretty sure I'm hitting or hit something similar to your issue, though by default mine appears to be using a broken nat setup on my machine. When I run the Debug-ContainerHost.ps1 script it shows my nat config to be broken. I can almost get the "Default Switch" one to work by configuring DNS when running inside the console, but it doesn't work when I try to build with that network as it doesn't resolve dns names even after setting DNS.

I'm on the latest Windows 10 Pro - 16299.15.amd64fre.rs3_release.170928-1534
Docker version 17.10.0-ce, build f4ffd25

These are the networks I see:

C:\Windows\System32>docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
21783432030c        Default Switch      ics                 local
82b167c5c8d5        nat                 nat                 local
426acc0aeceb        none                null                local

I've tried uninstalling Docker and the Container feature and reinstalling various versions but they are all broken network wise and none of the networking troubleshooting docs I've read have been able to get it back to working.

[mle-ii]

Ok, I still don't know if I am hitting the same issue but I was finally able to get this working though it took quite of work and I have no idea which thing fixed it. :(

Still on Windows 10 Pro 1709 with all the latest updates.
I uninstalled Docker.
Renamed the c:\programdata\docker directory.
Removed the Containers and the Hyper-V features.
Rebooted post removal of features.
Went through the registry and tried to clean up all the old virtual networking related things by searching for docker/vswitch/nat/HNS and looking at other items nearby in the registry. Removing ones that seemed to be network settings related to docker or Hyper-V.
EDIT: Also went into Device Manager and removed all the virtual network adapters/cards added by Docker/Hyper-V
Rebooted.
Installed the Containers and Hyper-V features.
Rebooted.
Installed Docker latest CE Edge version.
Rebooted.
Told it to not use the LCOW feature when Docker started up.
Switched to Windows Containers.
Tried to run a simple thing and it failed.

C:\Windows\System32>docker run -ti microsoft/nanoserver ipconfig /all
Unable to find image 'microsoft/nanoserver:latest' locally
latest: Pulling from microsoft/nanoserver
bce2fbc256ea: Download complete
b0b5e40cb939: Download complete
docker: Error response from daemon: open \\.\pipe\docker_engine_windows: The system cannot find the file specified.
See 'docker run --help'.

C:\Windows\System32>docker run -ti microsoft/nanoserver ipconfig /all
docker: Error response from daemon: open \\.\pipe\docker_engine_windows: The system cannot find the file specified.
See 'docker run --help'.

Turned off "Experimental features". This is very likely a separate issue, but wanted to call it out here in case someone hit this when trying out the steps I ran. #1252

Reran the various "tests" that failed before and they all seemed to work fine.
docker run -ti microsoft/nanoserver ipconfig /all - Failed until I turned off "Experimental features" even with the latest "clean" setup.
docker run -ti microsoft/nanoserver ping 8.8.8.8 - Failed before until I told it to use the "Default Switch" network.
docker run -ti microsoft/nanoserver ping google.com - Failed before unless I told it to use the "Default Switch" network and also configured DNS while connected to the container.

[mle-ii]

One additional item. I reran this Invoke-WebRequest https://aka.ms/Debug-ContainerHost.ps1 -UseBasicParsing | Invoke-Expression and the network still seems to have at least one issue.

Describing Container network is created
 [+] At least one local container network is available 2.23s
 [+] At least one NAT, Transparent, or L2Bridge Network exists 33ms
 [+] NAT Network's vSwitch is internal 12ms
 [-] A Windows NAT is configured if a Docker NAT network exists 296ms
   Expected {0} to be greater than or equal to {1}
   221:        $winnatCount | Should Not BeLessThan $natCount
   at <ScriptBlock>, <No file>: line 221
 [+] Specified Network Gateway IP for NAT network is assigned to Host vNIC 124ms
 [+] NAT Network's internal prefix does not overlap with external IP' 23ms

Not sure if this error from the docker logs is related. 10/26/2017 11:20:45 AM 1 Error Error occurred when creating network insufficient vnis(0) passed to overlay. Windows driver requires VNIs to be prepopulated

Also Get-NetNat returns nothing.

I also have this problem. Enabling LCOW with 1709+ destroys DNS functionality on the "Default Switch". Unfortunately, the "nat" switch that Docker LCOW creates does not work for non-Docker based VMs either. It would be nice if both could work simultaneously. If I manually set the /etc/resolv.conf to a functioning external DNS server (e.g., 8.8.8.8) then the VM will work until it renews the DHCP and then of course it breaks again.

[tegaaa]

I'm also having the same issue same as @AceHack. Since I'm heavy user of docker with windows containers and VM this is really anoying... hope this will be fixed soon.

[draggeta]

Same issue for me as well. I've removed docker for now until this issue is fixed as it otherwise breaks my other labs.

[gbraad]

Reproducible here. I have used LCOW for tests, and now "Default Switch" is not able to offer a DHCP with nameservers set, as the VM will only have search mshome.net in /etc/resolv.conf.

---

Using

Get-NetIPInterface -InterfaceAlias "vEthernet (Default Switch)" -AddressFamily IPv4 | Get-NetIPAddress | ForEach-Object { $_.IPAddress }

seems to provide me with the correct address for use as DNS (and Gateway) for the VMs on the "Default Switch"

[W1M0R]

I experienced the same symptoms. I solved the problem by:

1. Resetting my Default Ethernet connection (the one typically connected to my local network and the internet), by going into Properties and putting a checkmark on the following unchecked items:

   a. Client for Microsoft Networks
   b. File and Printer Sharing for Microsoft Networks
   c. QoS Packet Scheduler
   d. Internet Protocol Version 4 (TCP/IPv4)
   e. Microsoft LLDP Protocol Driver
   f. Internet Protocol Version 6 (TCP/IPv6)
   g. Link-Layer Topology Discovery Responder
   h. Link-Layer Topology Discovery Mapper I/O Driver
   i. Hyper-V Extensible Virtual Switch.

   Most of these items are usually checked by default for the Default Ethernet connection,
   but they were somehow unchecked by Docker for Windows, perhaps during a reset of Docker,
   or the creation of additional Hyper-V Virtual Network Switches, or the switching to Windows
   Containers mode.

2. Configuring Docker for Windows so that it doesn't automatically start with Windows.

3. Restarting Windows.

4. Manually launching Docker for Windows.

Without these changes, the following would happen:

1. Windows would use a vEthernet (External) connection as its Ethernet connection, since the Default Ethernet connection didn't have the required features.
2. Hyper-V would then use the wrong Ethernet connection for its Virtual Network switches.
3. Docker for Windows would then also use the incorrect Ethernet connection.

My setup is:
Windows 10 Pro 64-bit with 7 Network Connections (1 Main Ethernet, 6 Hyper-V vEthernet).
One vEthernet connection is an "External Connection", the rest are "Internal Connections" (NAT).
The vEthernet connections are called: Default Switch, DockerNAT, Internal Ethernet Port Windows Phone Emulator, nat, 4a85a7234be272d, and External Switch.

Perhaps this issue is related to the fact that Hyper-V does not support Multiple NAT connections:
https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/user-guide/setup-nat-network#troubleshooting

[shelmire]

@W1M0R Thanks for the post! I installed Docker on Windows and restarted to no internet connection. Similar setup to yours.

[jcmarchi]

The problem is not related to the fact Hyper-V does not support Multiple NAT connections. I can make it work very easily with a custom network and a couple tweaks in the Default Switch and the DockerNAT, mostly making the Network "external" and adding (routing) the new network IP address in their scope, but after each reboot, Docker simply UNDO all my changes, which is extremely annoying, aggravating and unacceptable!

How stupid this problem is.

I hate applications that force the hand on users.

When I discuss it and hear from the Docker Team they claim it is for security purposes, but they ignore the fact not all Docker usage is for production environments and this "limitation" prevents developers from set their network environments accordingly with their needs.

Also, no one is able to explain why MACVLAN doesn't work in Windows!

In Linux it all work, flawlessly, but in Windows nothing does.

I am not sure if Docker team is not competent enough to develop proper code in Windows or if they simply do not want to make it available for Windows users. Either way, it is a shame (and this is a voice of frustration speaking out loud).

My apologies but I am frustrated mostly because the way changes are reversed after boot. If I change something in my setting I do not want any crappy code touching it!!!! Docker team should know better...

BTW, Hyper-V is not a problem because I can create multiple instances of whatever systems I want in there and all will work with the network I set as I want without issues, and without changing it after reboot. Docker is the problem!

Notwithstanding, I suggest a little "debug hack" in the "MobiLinuxVM"... Most advanced users will find a set of iptables rules and other conditions that will give you nightmares (thus you will understand why the fstab is never executed in your Linux VM, the one you thought should work exactly as a real server does).

[xtremeperf]

@jcmarchi I'm not sure why you're thinking this has anything to do with Docker, because NAT and all the other virtual switch types are part of the Microsoft Windows networking stack. Those IP addresses that are changing after each reboot, those are configured and managed by Microsoft Windows services and drivers.

I think I might know the problem causing you guys these issues. Can you please reply with the output from running these four Powershell commands? Be sure to run as admin.

(Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuild

Get-VMNetworkAdapter -ManagementOS

Get-NetAdapter | Format-Table Name,InterfaceDescription,ifIndex,Status,LinkSpeed,MediaConnectionState

Get-NetIPInterface