From 57e9ec327ebefc5e4a40cfccc7d50f5d55c15cba Mon Sep 17 00:00:00 2001 From: Paul Menzel Date: Wed, 21 Oct 2026 11:58:53 +0200 Subject: [PATCH] sysctl.conf: Keep IPv6 on lo With IPv6 disabled on all interfaces, lo has no ::1. But since commit 915614d (sysctl.conf: Allow inet free binds) also sets net.ipv6.ip_nonlocal_bind = 1, binding to ::1 still succeeds, while connecting to it fails: bind ::1 ok connect ::1 failed: [Errno 99] Cannot assign requested address Servers that try ::1 first and fall back to 127.0.0.1 only when the bind fails therefore listen on an address no client can reach. Bazel does exactly that (GrpcServerImpl binds [::1] via Netty's epoll transport), so on MXQ nodes its client never connects to its own server: Starting local Bazel server and connecting to it... ... still trying to connect to local Bazel server (154781) after 10 seconds ... [...] FATAL: couldn't connect to server (154781) after 120 seconds. Re-enable IPv6 on lo only, so ::1 exists. Other interfaces stay without IPv6, as `all` and `default` keep disable_ipv6 = 1. Applying the changed file with `sysctl -p` in a network namespace gives lo ::1/128, and connecting to a server bound to ::1 succeeds. Assisted-by: claude-opus-5 (Claude Code) --- etc/sysctl.conf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/etc/sysctl.conf b/etc/sysctl.conf index 0f4c7a67..501f9a85 100644 --- a/etc/sysctl.conf +++ b/etc/sysctl.conf @@ -35,6 +35,11 @@ net.ipv4.conf.all.arp_filter = 1 # disable ipv6 net.ipv6.conf.all.disable_ipv6 = 1 +# but keep ::1 on lo. With ip_nonlocal_bind (below), binding to ::1 succeeds +# even without the address, so servers trying ::1 before 127.0.0.1 (e.g. +# Bazel) never fall back and listen where no client can connect. +net.ipv6.conf.lo.disable_ipv6 = 0 + # on user request increase the number of inode watches. # 256k should be fine. (default is 8k) fs.inotify.max_user_watches = 262144