0

I'm working on a fresh ubuntu 18.04.01 in which I installed Docker version 18.09.1, build 4c52b90 by following the official install guide. I'm experiencing a weird issue regarding TLS 1.2

On the host I can curl to any URL with https without a problem. Here is an example with github, but works just fine with google and such.

$ curl --version
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.0g zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3
Release-Date: 2018-01-24
$ curl -v https://github.com
* Rebuilt URL to: https://github.com/
*   Trying 140.82.118.3...
* TCP_NODELAY set
* Connected to github.com (140.82.118.3) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
...

On a docker container I'm unable to reach https://github.org and others, while https://google.com for instance works just fine.

Here is curl version and connection to google

$ docker run -it --rm ubuntu:18.04 bash
$ root@66c5a69546fc:/# curl --version
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.0g zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3
Release-Date: 2018-01-24

root@ 66c5a69546fc:/# curl -v https://google.com
* Rebuilt URL to: https://google.com/
*   Trying 216.58.205.110...
* TCP_NODELAY set
* Connected to google.com (216.58.205.110) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):

here is the curl to github that will eventually end in an handshake timeout

$ root@c69bad8b7d95:/# curl -v https://github.com
* Rebuilt URL to: https://github.com/
*   Trying 140.82.118.3...
* TCP_NODELAY set
* Connected to github.com (140.82.118.3) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS handshake, Client hello (1):

while both ping and curl in http work fine

$ root@c69bad8b7d95:/# ping github.com
PING github.com (140.82.118.3) 56(84) bytes of data.
64 bytes from lb-git-ssh.net.am4-ams.github.net (140.82.118.3): icmp_seq=1 ttl=49 time=25.6 ms
64 bytes from lb-git-ssh.net.am4-ams.github.net (140.82.118.3): icmp_seq=2 ttl=49 time=25.7 ms
^C
--- github.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 25.644/25.685/25.726/0.041 ms
$ root@c69bad8b7d95:/# curl -v http://github.com
* Rebuilt URL to: http://github.com/
*   Trying 140.82.118.4...
* TCP_NODELAY set
* Connected to github.com (140.82.118.4) port 80 (#0)

Is there a docker setting that I'm missing? I tried setting in daemon.json a different DNS, changing the bip for docker but nothing seems to work

Thank you for the help Alberto

  • Those are different containers. – Michael Hampton Jan 11 at 17:52
  • Yes I copy paste in two different occasions. Same results – Alberto Sabaini Jan 11 at 21:38
  • I had to contact the cloud provider. Apparently it was an issue with the MTU not being standard. I had to edit /etc/docker/daemon.json json { "mtu": 1300 } Also, be aware that docker-compose does not pick up that setting, so you need to force it whenever you create a network yaml network: mynet: driver: bridge driver_opts: com.docker.network.driver.mtu: 1300 – Alberto Sabaini Jan 17 at 12:14

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.