IPv6 with Docker on Kimsufi (OVH)

Kimsufi only gives a single /128 IPv6 address per host, so we can’t just give containers routable addresses D:

But we can do NAT (similar to how IPv4 works), with the docker host having one public IP, and using iptables to route traffic to the container’s internal private IPs.

/etc/docker/daemon.json:

• ipv6 is needed to enable IPv6 support in Docker
• fixed-cidr-v6 is needed for ipv6
  • even though for each network which we want to be ipv6 enabled, we’ll specify a different range, the docker deamon still insists that we supply a default
  • we can use the private fd00::/8 range for this, equivalent to docker’s IPv4 172.16.x.x/12 range
  • in this example, we use fd00:dead:beef:N::/64 with N being 0 for the default network and then different numbers for each compose network we create
• ip6tables is needed to route traffic from the one public IPv6 address to the container’s internal private IPv6 address
• experimental is needed for ip6tables

{
	"userland-proxy": false,
	"ipv6": true,
	"ip6tables": true,
	"experimental": true,
	"fixed-cidr-v6": "fd00:dead:beef:0::/64"	
}

~/Projects/server/compose.yml:

networks:
  default:
    enable_ipv6: true
    ipam:
      config:
        - subnet: fd00:dead:beef:1::/64

services:
  traefik:
    image: traefik:v3.7
    ports:
      - 80:80
      - 443:443/tcp
      - 443:443/udp

  whoami:
    image: traefik/whoami
    labels:
      traefik.enable: true
      traefik.http.routers.whoami.rule: "Host(`whoami.shish.io`)"

$ curl --silent https://whoami.shish.io | grep X-Real-Ip
X-Real-Ip: <my client IPv6 address>