17.06.0-rc1 crashes when I connect or disconnect from VPN

[kinghuang]

At my workplace, I have to use FortiClient to connect to VPN. Every time I connect or disconnect from the VPN, Docker for Mac 17.06.0-rc1 crashes.

Expected behavior

When I connect or disconnect from the VPN, Docker for Mac should continue to function. This is the behaviour in previous versions of Docker for Mac.

Actual behavior

Docker crashes and restarts whenever I connect or disconnect from the VPN.

Information

Docker for Mac: version: 17.06.0-rc1-ce-mac13 (4cdec4294a50b2233146b09469b49937dabdebdd)
macOS: version 10.12.5 (build: 16F73)
logs: /tmp/4AC1AAE1-4F29-4D90-987C-D1EA0E6E94B2/20170603-103141.tar.gz
[OK]     db.git
[OK]     vmnetd
[OK]     dns
[OK]     driver.amd64-linux
[OK]     virtualization VT-X
[OK]     app
[OK]     moby
[OK]     system
[OK]     moby-syslog
[OK]     db
[OK]     env
[OK]     virtualization kern.hv_support
[OK]     slirp
[OK]     osxfs
[OK]     moby-console
[OK]     logs
[OK]     docker-cli
[OK]     menubar
[OK]     disk

Steps to reproduce the behavior

1. Have Docker for Mac 17.06.0-rc1 installed and running.
2. Connect or disconnect from a VPN using FortiClient.

[sylver]

I think that's something wider, I have the same issue locally (see #1683)

[kinghuang]

This is still an issue for me on Docker for Mac 17.06.0-rc4-ce-mac15.

[djs55]

@kinghuang it looks like the diagnostics upload failed. Could you reproduce the problem on the latest rc4 and retry the upload?

[gtardif]

Reproduced docker daemon restart on every connect / disconnect from fortis VPN.
Diags seem to be uploaded fine : 97C9B813-1DEF-44E8-9DC6-3A01E1E8727A
(I did a couple of diagnose with / without the VPN on, all seem to have been uploaded properly)

[djs55]

@gtardif interestingly the last 6 VM console logs (console-ring.0 through console-ring.5) show the VM being rebooted cleanly i.e. not technically a crash of Docker, but it does involve the containers being stopped. This is expected to happen when the proxy settings change (due to the environment variables) but shouldn't happen in your case since you have "No proxy" selected.

Unfortunately the main logs haven't captured the reason for the VM reboot. Interestingly your logs don't seem to have captured the usual "Hyperkit subprocess has shutdown" and the normal logging from the subprocess manager -- this could either be related to the problem or perhaps the logging level has been accidentally turned down?

[djs55]

@kinghuang: @gtardif and I believe we have reproduced this in-house and have a fix. We'll let you know when we have a build you can test.

[gtardif]

@kinghuang you can try with this build :
https://download.docker.com/mac/edge/18382/Docker.dmg, it should not reboot anymore when connect / disconnect the VPN (except if this implies proxy changes, that really require a VM reboot).
This should be released very shortly

[kinghuang]

@gtardif I've downloaded and installed 18382. Docker is still restarting when I connect or disconnect from VPN.

Diagnostic ID: 4AC1AAE1-4F29-4D90-987C-D1EA0E6E94B2

[kinghuang]

Based on @djs55's comment about proxies, I've changed the setting from “Use system proxy” to “No proxy”. Docker doesn't seem to be restarting on VPN connect/disconnect anymore. I'll keep an eye on it.

[djs55]

@kinghuang thanks for the fast update :)

Looking at the diagnostics, it seems that your HTTP proxy settings are changing (slightly) when you turn the VPN on and off:

Triggering a VM reboot because proxy settings changed from main.proxyS
ettings{http:"", https:"", exclude:""} to main.proxySettings{http:"", https:"", exclude:"*.local, 169.254/16"}

This is expected behaviour for the moment. A future version of Docker will have a transparent HTTP proxy which will avoid having to reboot the VM.

Let us know if you see any other odd behaviour.

Thanks for the report!

[djs55]

For reference this appears to be the same root cause as #1809 (and several other reports)

I think it's worth making this change of exclude with no actual proxy set into a special case and avoid the restart.

[djs55]

The unnecessary reboot caused by the exclude changing when there is no proxy set has been cherry-picked into the branch for 17.06.1, which should hopefully be released later this week. Thanks for your report!

[roshanpal]

Is the update out already? I'm still having this issue on Mac. Whenever I disconnect my VPN, docker restarts. Kindly fix this asap.

[roshanpal]

Hello? Any update? Is this issue fixed? Should I downgrade?

[docker-robott]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale comment.
Stale issues will be closed after an additional 30d of inactivity.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so.

Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows.
/lifecycle stale

[docker-robott]

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows.
/lifecycle locked