VMware NSX 4.1.0 docker network subnet can conflict with workload subnet

Products

• VMware NSX

Issue/Introduction

• Running on VMware NSX 4.1.0.
• Medium or Large size of NSX Managers were deployed.
• The internal docker0 interface subnet 172.17.0.1/16 on the NSX Manager conflicts with any existing subnets.
• To confirm the configuration of docker0 interface, run ifconfig from root of the NSX manager:

root@nsx-mngr-01:~# ifconfig
docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
    inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
    ether ##:##:##:##:##:## txqueuelen 0 (Ethernet)
    RX packets 0 bytes 0 (0.0 B)
    RX errors 0 dropped 0 overruns 0 frame 0
    TX packets 0 bytes 0 (0.0 B)
    TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

NOTE: The preceding log excerpts are only examples. Date, time and environmental variables may vary depending on your environment.

 

Environment

VMware NSX

Cause

Docker is installed in VMware NSX 4.1.0, when deployed as Medium or Large size appliance only. The default network is 172.17.0.1/16.

Resolution

The automatic install of the docker0 interface will be removed from version VMware NSX 4.1.1 and onwards.

Workaround:
There are 2 options below to workaround the conflict.
Make sure to take or have a latest VMware NSX backup.

1. Do not create docker bridge 'docker0': 

- login as root to an NSX Manager.
- Edit the following file /etc/docker/daemon.json or create it if it does not exist. Add below json :

root@nsx-mngr-01:/etc/docker# vim daemon.json

{
"bridge": "none"
}

- Restart the docker service:
root@nsx-mngr-01:/etc/docker# systemctl restart docker
 

2. Change docker0 subnet:

- login as root to an NSX Manager.
- Edit the following file /etc/docker/daemon.json or create it if it does not exist. Add below json :
root@nsx-mngr-01:/etc/docker# vim daemon.json

{
"bip": "172.26.0.1/16" >>> Enter the subnet you would like to use here
} :

- Restart the docker service:
root@nsx-mngr-01:/etc/docker# systemctl restart docker

As the docker service is not in use in this version, on the NSX Manager, you can stop containers using below command:

root@nsx-mngr-01:/etc/docker# systemctl stop nsx-metrics-agents.service nsx-datacollector-agents.service nsx-kafka.service

These services will get started after reboot again, to disable them use below command:

root@nsx-mngr-01:/etc/docker# systemctl disable nsx-metrics-agents.service nsx-datacollector-agents.service nsx-kafka.service