[GH-ISSUE #3005] Linux: Docker container restarts interrupt VPN traffic when veth interfaces are recreated #1378

New issue

Open

opened 2026-10-13 20:41:13 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 20:41:13 +00:00

Owner

Originally created by @samdark on GitHub (Aug 18, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/3005

Description

On Linux, restarting a local Docker container while AmneziaVPN is connected causes active network transfers through the VPN to stall or become interrupted.

The affected container had an always restart policy and was restarting approximately every 1–2 minutes. Each restart removed and recreated its Docker veth interface. Browser downloads repeatedly stopped at the same timestamps as these interface changes.

Stopping the container eliminated the interruptions completely. The physical network connection remained active throughout the test.

Steps to reproduce

Connect using the AmneziaVPN Linux client.
Start a large download or another long-running TCP transfer through the VPN.
Run a Docker container attached to a bridge network.
Cause the container to restart periodically (for example, let its process exit while using an always restart policy).
Observe the transfer when Docker removes and recreates the container's veth interface.
Stop the restarting container and repeat the transfer.

Actual behavior

Active downloads or other long-running connections stall or are interrupted when Docker recreates a veth interface.

The interruption timestamps correlate exactly with messages similar to:

containerd: shim disconnected
NetworkManager: new Veth device
NetworkManager: virtual interface changed state
NetworkManager: virtual interface removed
NetworkManager: replacement Veth device activated

AmneziaVPN logs network-watcher activity while virtual-interface changes are occurring:

Amnezia LinuxNetworkWatcherWorker: Properties changed for interface ...

Stopping the restarting Docker container prevents further interruptions.

Expected behavior

Creating or removing an unrelated Docker veth interface should not affect the VPN tunnel, routes, DNS configuration, firewall rules, or existing host network connections.

The AmneziaVPN network watcher should ignore virtual-interface events that do not change the physical uplink, default gateway, or VPN endpoint route.

Additional observations

The physical Ethernet connection remained connected.
The default physical-network route remained available.
The VPN interface remained present.
There was sufficient disk space and memory.
The browser did not crash or get terminated.
The container was not using host networking.
The issue was reproducible while the container was restarting.
The issue disappeared after stopping the container.
Ordinary browsing can conceal the issue because short requests retry automatically; large downloads make it visible.

Environment

OS: Ubuntu 26.04
Kernel: 7.0.0-29-generic
Network manager: NetworkManager
AmneziaVPN version: Unknown
VPN protocol: Unknown
Kill Switch: Unknown
Split tunneling: Unknown
Docker version: 29.7.2
Docker network driver: bridge
Physical connection: Ethernet

Possible cause

AmneziaVPN may be responding too broadly to NetworkManager interface-change events. Docker container restarts generate removal and creation events for ephemeral veth devices. If those events cause AmneziaVPN to refresh routes, DNS, firewall state, or tunnel configuration, existing connections may be interrupted.

Docker virtual interfaces that do not affect the active uplink or default route should likely be excluded from this handling.

All identifying information, addresses, server details, container names, image names, registry details, filenames, and download URLs have been omitted.

Originally created by @samdark on GitHub (Aug 18, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/3005 ## Description On Linux, restarting a local Docker container while AmneziaVPN is connected causes active network transfers through the VPN to stall or become interrupted. The affected container had an `always` restart policy and was restarting approximately every 1–2 minutes. Each restart removed and recreated its Docker `veth` interface. Browser downloads repeatedly stopped at the same timestamps as these interface changes. Stopping the container eliminated the interruptions completely. The physical network connection remained active throughout the test. ## Steps to reproduce 1. Connect using the AmneziaVPN Linux client. 2. Start a large download or another long-running TCP transfer through the VPN. 3. Run a Docker container attached to a bridge network. 4. Cause the container to restart periodically (for example, let its process exit while using an `always` restart policy). 5. Observe the transfer when Docker removes and recreates the container's `veth` interface. 6. Stop the restarting container and repeat the transfer. ## Actual behavior Active downloads or other long-running connections stall or are interrupted when Docker recreates a `veth` interface. The interruption timestamps correlate exactly with messages similar to: ```text containerd: shim disconnected NetworkManager: new Veth device NetworkManager: virtual interface changed state NetworkManager: virtual interface removed NetworkManager: replacement Veth device activated ``` AmneziaVPN logs network-watcher activity while virtual-interface changes are occurring: ```text Amnezia LinuxNetworkWatcherWorker: Properties changed for interface ... ``` Stopping the restarting Docker container prevents further interruptions. ## Expected behavior Creating or removing an unrelated Docker `veth` interface should not affect the VPN tunnel, routes, DNS configuration, firewall rules, or existing host network connections. The AmneziaVPN network watcher should ignore virtual-interface events that do not change the physical uplink, default gateway, or VPN endpoint route. ## Additional observations - The physical Ethernet connection remained connected. - The default physical-network route remained available. - The VPN interface remained present. - There was sufficient disk space and memory. - The browser did not crash or get terminated. - The container was not using host networking. - The issue was reproducible while the container was restarting. - The issue disappeared after stopping the container. - Ordinary browsing can conceal the issue because short requests retry automatically; large downloads make it visible. ## Environment ```text OS: Ubuntu 26.04 Kernel: 7.0.0-29-generic Network manager: NetworkManager AmneziaVPN version: Unknown VPN protocol: Unknown Kill Switch: Unknown Split tunneling: Unknown Docker version: 29.7.2 Docker network driver: bridge Physical connection: Ethernet ``` ## Possible cause AmneziaVPN may be responding too broadly to NetworkManager interface-change events. Docker container restarts generate removal and creation events for ephemeral `veth` devices. If those events cause AmneziaVPN to refresh routes, DNS, firewall state, or tunnel configuration, existing connections may be interrupted. Docker virtual interfaces that do not affect the active uplink or default route should likely be excluded from this handling. All identifying information, addresses, server details, container names, image names, registry details, filenames, and download URLs have been omitted.

bsakaguchi referenced this issue

2026-10-13 21:21:00 +00:00

[PR #1378] [MERGED] bugfix/pre-release-hotfixes #2333