Repository navigation
Give native Docker containers IPv4 internet access - #2
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 83f82e5703
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "ping -c 1 -W 5 a51-internet-peer; " | ||
| "echo 'PASS container-name DNS and bridge round trip'; " + script) | ||
| finally: | ||
| docker('rm', '-f', 'a51-internet-peer') |
There was a problem hiding this comment.
If a container named a51-internet-peer already exists while the test network does not, the docker run --name call fails with a name conflict, but this unconditional cleanup then forcibly removes that pre-existing container. Check for the container before starting or track whether this invocation successfully created it before deleting it.
Useful? React with 👍 / 👎.
1 participant
The native Docker launcher created a private network namespace with no uplink, so containers and the daemon could not reach the internet. It now connects that namespace to Android's IPv4 connection through a supervised veth uplink. Registry pulls, DNS, HTTP(S), and package downloads work on default and user-created Docker bridges.
The supervisor follows Android root's selected internet routing table, blocks egress when no route is available, and restores connectivity when it returns. Its forwarding request is managed by netd; firewall and policy changes are scoped to the Docker uplink and removed after daemon exit or explicit stop. The daemon trusts Android's system CA directories. The original offline mode remains available with
--isolated.Validated on SM-A515F / A515FXXU5EUJ4 with SELinux Enforcing:
alpine:3.22download from Docker Hub on the handset.apk updateon both bridge types.make check, ShellCheck, Python compilation, andgit diff --check.Sanitized results are in
evidence/docker-internet-summary.json; reproduction instructions and the internet validator are included. Wi-Fi was measured. This uplink does not add container IPv6, LAN ingress, per-app VPN policy, or an autostart service.