{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/28159","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/28159/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/28159/comments","events_url":"https://api.github.com/repos/docker/docker/issues/28159/events","html_url":"https://github.com/docker/docker/issues/28159","id":187934170,"number":28159,"title":"C/R breaks existing TCP connections","user":{"login":"Tchinmai7","id":7880027,"avatar_url":"https://avatars.githubusercontent.com/u/7880027?v=3","gravatar_id":"","url":"https://api.github.com/users/Tchinmai7","html_url":"https://github.com/Tchinmai7","followers_url":"https://api.github.com/users/Tchinmai7/followers","following_url":"https://api.github.com/users/Tchinmai7/following{/other_user}","gists_url":"https://api.github.com/users/Tchinmai7/gists{/gist_id}","starred_url":"https://api.github.com/users/Tchinmai7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tchinmai7/subscriptions","organizations_url":"https://api.github.com/users/Tchinmai7/orgs","repos_url":"https://api.github.com/users/Tchinmai7/repos","events_url":"https://api.github.com/users/Tchinmai7/events{/privacy}","received_events_url":"https://api.github.com/users/Tchinmai7/received_events","type":"User","site_admin":false},"labels":[{"id":237472034,"url":"https://api.github.com/repos/docker/docker/labels/area/networking","name":"area/networking","color":"fbca04","default":false},{"id":75627479,"url":"https://api.github.com/repos/docker/docker/labels/kind/question","name":"kind/question","color":"EBEFC9","default":false},{"id":375241490,"url":"https://api.github.com/repos/docker/docker/labels/version/master","name":"version/master","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-11-08T08:53:05Z","updated_at":"2016-11-09T15:47:16Z","closed_at":null,"body":"**Description**\r\n\r\nI'm running Apache Traffic Server in a docker container, and the container acts as a reverse proxy to YouTube. The  certs of youtube,etc are cloned and are available in the container.\r\nI have two hosts, and the container runs on only one host at any point of time. I'm using HAProxy as a loadbalancer to route the traffic onto the containers. TLS is terminated only at the container end and not at the load balancer. Everything works fine when I configure my browser to point to the HAproxy ip and  access youtube. Videos play smoothly. The setup is as follows\r\n\r\n![setup](https://cloud.githubusercontent.com/assets/7880027/20091857/f865c552-a5ba-11e6-9c9b-da40522a60ef.png)\r\n\r\nI'm trying to migrate the container from host1 to host2. \r\n\r\n**Steps to reproduce the issue:**\r\n1. create the network on both hosts\r\ndocker network create -d bridge --subnet=10.10.0.0/16 criu\r\n\r\n2. create the containers on both hosts \r\ndocker create --name YouTube --security-opt seccomp:unconfined --network criu --ip 10.10.10.1 -p 8080:8080 -p 444:443 tchinmai7/youtube_ats:5.0\r\n\r\n3. Checkpoint container on host1, and scp files to host2.\r\ndocker checkpoint create  YouTube c1\r\ncontainer_id=\"$(docker inspect --format=\"{{.Id}}\" $container)\"\r\nsudo tar -czf YouTube.tar /var/lib/docker/containers/${container_id}/checkpoints/c1\r\nscp YouTube.tar tchinmai@172.25.196.15:\r\n\r\n4. Restore the container on host2.\r\ndest_container_id=\"$(docker inspect --format=\"{{.Id}}\" YouTube)\"\r\nsudo mkdir -p /var/lib/docker/containers/${dest_container_id}/checkpoints/c1\r\nsudo tar xzf YouTube.tar --strip-components=6 -C /var/lib/docker/containers/${dest_container_id}/checkpoints/\r\ndocker start --checkpoint $checkpoint_id YouTube\r\n\r\nHaProxy listens on 443: and the default backend is configured as follows\r\n\r\nbackend youtube\r\n\tmode tcp\r\n\tbalance roundrobin\r\n\tserver lab_18 172.25.196.18:444 check\r\n\tserver lab_15 172.25.196.15:444 check\r\n\r\n\r\n\r\n**Describe the results you received:**\r\nWhen C/R is being done, the youtube video still plays. However, on looking at the TCP connections using Wireshark, it is seen that the connections are being severed and recreated.  And the Checkpoint process itself fails *sometimes* with this error\r\nhttp://pastebin.com/fFANpWDN\r\n\r\n**Describe the results you expected:**\r\nTCP connection is maintained despite migration, and the dumping process goes smoothly.\r\n\r\n**Additional information you deem important (e.g. issue happens only occasionally):**\r\nmentioned above\r\n\r\n**Output of `docker version`:**\r\n**Host 1** \r\nClient:\r\n Version:      1.13.0-dev\r\n API version:  1.25\r\n Go version:   go1.7.1\r\n Git commit:   8eadd43\r\n Built:        Mon Sep 26 08:22:26 2016\r\n OS/Arch:      linux/amd64\r\n Experimental: true\r\n\r\nServer:\r\n Version:      1.13.0-dev\r\n API version:  1.25\r\n Go version:   go1.7.1\r\n Git commit:   8eadd43\r\n Built:        Mon Sep 26 08:22:26 2016\r\n OS/Arch:      linux/amd64\r\n Experimental: true\r\n\r\n** Host 2 ** \r\nClient:\r\n Version:      1.13.0-dev\r\n API version:  1.25\r\n Go version:   go1.7.1\r\n Git commit:   8eadd43\r\n Built:        Mon Sep 26 08:22:26 2016\r\n OS/Arch:      linux/amd64\r\n Experimental: true\r\n\r\nServer:\r\n Version:      1.13.0-dev\r\n API version:  1.25\r\n Go version:   go1.7.1\r\n Git commit:   8eadd43\r\n Built:        Mon Sep 26 08:22:26 2016\r\n OS/Arch:      linux/amd64\r\n Experimental: true\r\n\r\n**Output of `docker info`:**\r\n**Host1 :**\r\nContainers: 3\r\n Running: 1\r\n Paused: 0\r\n Stopped: 2\r\nImages: 31\r\nServer Version: 1.13.0-dev\r\nStorage Driver: aufs\r\n Root Dir: /var/lib/docker/aufs\r\n Backing Filesystem: extfs\r\n Dirs: 48\r\n Dirperm1 Supported: true\r\nLogging Driver: json-file\r\nCgroup Driver: cgroupfs\r\nPlugins: \r\n Volume: local\r\n Network: bridge host null overlay\r\nSwarm: inactive\r\nRuntimes: runc\r\nDefault Runtime: runc\r\nSecurity Options: apparmor seccomp\r\nKernel Version: 4.4.0-45-generic\r\nOperating System: Ubuntu 14.04.5 LTS\r\nOSType: linux\r\nArchitecture: x86_64\r\nCPUs: 8\r\nTotal Memory: 7.77 GiB\r\nName: tchinmai-X9SCL-X9SCM\r\nID: 5VNE:SXTN:H5NE:WVUW:KZTJ:ZE2R:4HWI:53PI:MOPX:MPYB:5KWX:3AOY\r\nDocker Root Dir: /var/lib/docker\r\nDebug Mode (client): false\r\nDebug Mode (server): false\r\nUsername: tchinmai7\r\nRegistry: https://index.docker.io/v1/\r\nWARNING: No swap limit support\r\nExperimental: true\r\nInsecure Registries:\r\n 127.0.0.0/8\r\nLive Restore Enabled: false\r\n\r\n**Host 2 :** \r\nContainers: 4\r\n Running: 1\r\n Paused: 0\r\n Stopped: 3\r\nImages: 5\r\nServer Version: 1.13.0-dev\r\nStorage Driver: aufs\r\n Root Dir: /var/lib/docker/aufs\r\n Backing Filesystem: extfs\r\n Dirs: 47\r\n Dirperm1 Supported: true\r\nLogging Driver: json-file\r\nCgroup Driver: cgroupfs\r\nPlugins: \r\n Volume: local\r\n Network: bridge host null overlay\r\nSwarm: inactive\r\nRuntimes: runc\r\nDefault Runtime: runc\r\nSecurity Options: apparmor seccomp\r\nKernel Version: 4.4.0-45-generic\r\nOperating System: Ubuntu 14.04.5 LTS\r\nOSType: linux\r\nArchitecture: x86_64\r\nCPUs: 4\r\nTotal Memory: 7.757 GiB\r\nName: tchinmai\r\nID: VYLO:AN53:XQLJ:LYEY:H7FN:KPS5:3H5B:BD2O:AMWO:3FYI:5HZZ:RKDE\r\nDocker Root Dir: /var/lib/docker\r\nDebug Mode (client): false\r\nDebug Mode (server): false\r\nRegistry: https://index.docker.io/v1/\r\nWARNING: No swap limit support\r\nExperimental: true\r\nInsecure Registries:\r\n 127.0.0.0/8\r\nLive Restore Enabled: false\r\n\r\n\r\n\r\n**Additional environment details (AWS, VirtualBox, physical, etc.):**\r\nphysical machines running ubuntu 14.04.5 LTS 4.4.0-45-generic kernel\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/259446574","html_url":"https://github.com/docker/docker/issues/28159#issuecomment-259446574","issue_url":"https://api.github.com/repos/docker/docker/issues/28159","id":259446574,"user":{"login":"boucher","id":22065,"avatar_url":"https://avatars.githubusercontent.com/u/22065?v=3","gravatar_id":"","url":"https://api.github.com/users/boucher","html_url":"https://github.com/boucher","followers_url":"https://api.github.com/users/boucher/followers","following_url":"https://api.github.com/users/boucher/following{/other_user}","gists_url":"https://api.github.com/users/boucher/gists{/gist_id}","starred_url":"https://api.github.com/users/boucher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boucher/subscriptions","organizations_url":"https://api.github.com/users/boucher/orgs","repos_url":"https://api.github.com/users/boucher/repos","events_url":"https://api.github.com/users/boucher/events{/privacy}","received_events_url":"https://api.github.com/users/boucher/received_events","type":"User","site_admin":false},"created_at":"2016-11-09T15:47:16Z","updated_at":"2016-11-09T15:47:16Z","body":"This is definitely out of scope right now. @Tchinmai7 have you looked into p.haul? The networking bit of live migration is the hardest part, and I haven't actually accomplished it myself (though @crosbymichael has, and @xemul and @avagin can also chime in). You need to mess with iptables to keep the connection alive during the migration."}}
{"actor":{"display_login":"boucher"}}