Replies: 9 comments 14 replies
-
Also happens on 5.3 (which was expected, as this is probably passt-related). |
Beta Was this translation helpful? Give feedback.
-
From your config it seems like you are using a custom network ( If it connects to an outgoing server it should not be handled via our rootless port forwarder so that means it goes through the NAt in the rootless-netns into pasta and then out to the LAN. So it is possible something is wrong with pasta. In order to debug any pasta issues in that case you can use the following options in containers.conf:
They will be added to the pasta cli. In order for them to take effect you must stop all containers that use a custom network and then start them again. Then you should see pasta running with these arguments. Then when this issue happens again copy both pasta files and upload them here so maybe the pasta maintainers then can have a look at them. Note it is best to do this while you have no other containers running that generate a lot of data to not add to much irrelevant data into the logs. |
Beta Was this translation helpful? Give feedback.
-
@sbrivio-rh @dgibson PTAL |
Beta Was this translation helpful? Give feedback.
-
Here's new traces with TCP_CORK and TCP_NODELAY; both didn't seem to have helped. In the case of TCP_CORK the timeout happened very quickly, while with TCP_NODELAY it took a little longer (so the |
Beta Was this translation helpful? Give feedback.
-
I just realized that my previous trace might not have been with the Anyhow, testing your branch (after fixing the |
Beta Was this translation helpful? Give feedback.
-
Here's a new trace, taken on https://passt.top/passt/commit/?id=5dc962affc07e6f8f449d56836476cb2350570ce:
|
Beta Was this translation helpful? Give feedback.
-
Oops, sorry, I build tested first, then slightly changed the condition. :) Thanks a lot for re-testing and for the new traces. I didn't look into them yet, but still my earlier question remains: do you run the container as privileged (that is, rootless, but with all the capabilities available as the namespace is detached), or with any capability ( I'm wondering because it shouldn't be possible for a regular user to affect keep-alive parameters (net.ipv4.tcp_keepalive_time, net.ipv4.tcp_keepalive_intvl, net.ipv4.tcp_keepalive_probes sysctls). And yet we have keep-alive segments after 15 seconds, with one second interval. Regardless of that, I guess we should forget for a moment about this part of RFC 9293 3.8.4:
(I haven't had a look at the corresponding kernel implementation yet) and just make the client happy by acknowledging those keep-alive segments, because here it looks like the client/sender is interpreting that as a dead connection. |
Beta Was this translation helpful? Give feedback.
-
https://passt.top/passt/commit/?id=3a93acc7c4c0eb26eab4f6a2362ce89fb4b70509 has been working fine for over 24h, so I think we can declare victory here. Thanks for debugging this! |
Beta Was this translation helpful? Give feedback.
-
This is now fixed in passt 2024_11_21.238c69f, and matching Debian package passt-0.0~git20241121.238c69f-1. |
Beta Was this translation helpful? Give feedback.
-
I'm in the process of porting my stack of homelab containers to podman + quadlets, on Debian 13/trixie/testing (shipping podman 5.2.5 and passt ee7d0b6 from 20241030), and I'm having issues with some containers. My zigbee2mqtt container, which connects to a zigbee adapter on my local network, successfully manages to connect to the adapter but the connections always get closed after a couple of minutes:
This did not happen when I was still using Docker, and also not when using podman compose. This is the quadlet I'm using, which is very trivial:
Traefik is configured using socket activation, but that shouldn't matter here. The adapter zigbee2mqtt is connecting to sits on my actual network (
192.168.0.*
). I also do not have anything noteworthy incontainers.conf
.The issue is particularly frustrating because zigbee2mqtt doesn't handle the disconnect very well. Other users have also reported this, e.g. Koenkk/zigbee2mqtt#22590 (comment) which also points to pasta. I personally cannot switch back to slirp4netns (because I need pasta for Traefik to see the actual source IP).
I'd be happy to test out the newly released 5.3, but it's not easy to do so on Debian.
Beta Was this translation helpful? Give feedback.
All reactions