[GH-ISSUE #3130] [macOS 26.6.2] System-wide network deadlock in tun2socks/utun path triggered by Docker Desktop #1451

New issue

Open

opened 2026-10-13 20:42:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 20:42:44 +00:00

Owner

Originally created by @sergiusd on GitHub (Sep 5, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/3130

[macOS 26.6.2] System-wide network deadlock in tun2socks/utun path triggered by Docker Desktop

Summary

macOS became completely unresponsive while AmneziaVPN was connected. The Apple-generated stackshot identified an explicit kernel lock cycle involving Docker Desktop and the input thread of the tunnel interface used by AmneziaVPN:

Deadlock: com.docker.backend (Docker) [81977] thread 0x9c5f82
  -> kernel_task [0] thread 0x91c3f9 "dlil_input_utun22"
  -> com.docker.backend (Docker) [81977] thread 0x9c5f82

Blocked by Deadlock: 58 tasks

The deadlock blocked WindowServer, Finder, Dock, runningboardd, powerd, mDNSResponder, AmneziaVPN, tun2socks, Docker Desktop, browsers, terminals, and IDEs. Normal Force Quit and shutdown were impossible, so the Mac had to be powered off by holding the power button.

This appears related to #2933 and possibly #2897, but the trigger and final lock graph are different. In this case, the lock cycle formed immediately after Docker Desktop started and opened many outbound connections through Amnezia's utun22 interface.

Environment

Hardware: MacBookPro18,2, Apple Silicon, 32 GB RAM
macOS: 26.6.2, build 25G83, arm64
AmneziaVPN: 5.0.1.5; bundle version 5.0.1 (5)
Tunnel process: /Applications/AmneziaVPN.app/Contents/MacOS/tun2socks
Tunnel interface: utun22
Protocol path: most likely XRay/VLESS or another Amnezia mode using the external tun2socks process
Docker Desktop: 4.66.1, build 222799
Docker networking: gVisor; UseVpnkit enabled
LuLu 4.5.1 network extension was also active
ProtonVPN was installed but disconnected

Expected behavior

Starting or using Docker Desktop while AmneziaVPN is connected should not deadlock the macOS networking stack. A failed socket or tunnel operation should return an error or time out without blocking unrelated applications, WindowServer, or system shutdown.

Actual behavior

Applications progressively stopped responding, followed by Finder, Dock, WindowServer, and essential system services. Keyboard shortcuts, Force Quit, terminal access, and normal shutdown stopped working. A forced power-off was required.

macOS recorded the reset as:

Boot failure count: 1
Boot faults: btn_rst,finger_reset force_off

Originally created by @sergiusd on GitHub (Sep 5, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/3130 # [macOS 26.6.2] System-wide network deadlock in tun2socks/utun path triggered by Docker Desktop ## Summary macOS became completely unresponsive while AmneziaVPN was connected. The Apple-generated stackshot identified an explicit kernel lock cycle involving Docker Desktop and the input thread of the tunnel interface used by AmneziaVPN: ```text Deadlock: com.docker.backend (Docker) [81977] thread 0x9c5f82 -> kernel_task [0] thread 0x91c3f9 "dlil_input_utun22" -> com.docker.backend (Docker) [81977] thread 0x9c5f82 Blocked by Deadlock: 58 tasks ``` The deadlock blocked `WindowServer`, Finder, Dock, `runningboardd`, `powerd`, `mDNSResponder`, AmneziaVPN, `tun2socks`, Docker Desktop, browsers, terminals, and IDEs. Normal Force Quit and shutdown were impossible, so the Mac had to be powered off by holding the power button. This appears related to #2933 and possibly #2897, but the trigger and final lock graph are different. In this case, the lock cycle formed immediately after Docker Desktop started and opened many outbound connections through Amnezia's `utun22` interface. ## Environment - Hardware: MacBookPro18,2, Apple Silicon, 32 GB RAM - macOS: 26.6.2, build 25G83, arm64 - AmneziaVPN: 5.0.1.5; bundle version `5.0.1 (5)` - Tunnel process: `/Applications/AmneziaVPN.app/Contents/MacOS/tun2socks` - Tunnel interface: `utun22` - Protocol path: most likely XRay/VLESS or another Amnezia mode using the external `tun2socks` process - Docker Desktop: 4.66.1, build 222799 - Docker networking: gVisor; `UseVpnkit` enabled - LuLu 4.5.1 network extension was also active - ProtonVPN was installed but disconnected ## Expected behavior Starting or using Docker Desktop while AmneziaVPN is connected should not deadlock the macOS networking stack. A failed socket or tunnel operation should return an error or time out without blocking unrelated applications, `WindowServer`, or system shutdown. ## Actual behavior Applications progressively stopped responding, followed by Finder, Dock, `WindowServer`, and essential system services. Keyboard shortcuts, Force Quit, terminal access, and normal shutdown stopped working. A forced power-off was required. macOS recorded the reset as: ```text Boot failure count: 1 Boot faults: btn_rst,finger_reset force_off ```

bsakaguchi referenced this issue

2026-10-13 21:21:17 +00:00

[PR #1451] [CLOSED] Update AdLabel.qml #2360