Docker network weirdness following re-deploy.

[dragon2611]

I'm seeing some odd behavior which seems to be triggered if you redeploy a container from komodo that's already running it seems docker will S-NAT any traffic towards the container to the bridges network IP.

If you destroy the container and then re-deploy it this doesn't seem to happen and you see the original ip of the incoming traffic.

The container is running on NixOS 25.05 / Docker version 27.5.1, build v27.5.1.

In the case of a Zabbix container this breaks communications to external zabbix proxies as zabbix suddenly sees them coming from a 172.xx.xx IP instead of the original ip.

[smk762]

This is a docker quirk (hairpin / stale conntrack). It is recommended to always docker compose down && docker compose up -d to avoid this, though there are other ways to get around it with docker network configs.

[dragon2611]

Which I guess amounts to a Destroy (Or at least a stop) then Deploy in the komodo world?

[smk762]

Yes, that is an option, and one which works. You can also try flushing conntrack for each port after redeploy, or use --network host (carefully), or mess with iptables on the host (carefully). Beyond that there might be some NixOS specific things that might help or hurt.