[BUG] gw_priority is ignored on ipv4 network if service also joins an ipv6 network without priority

[stavros-k]

Description

Not sure if this is "as intended", if so, it might worth documenting it.

As mentioned in comments like:
docker/roadmap#658 (comment)

Steps To Reproduce

networks:
  lan_access:
    name: lan_access
    driver: macvlan
    enable_ipv6: false
    enable_ipv4: true
    driver_opts:
      parent: eth0
    ipam:
      driver: default
      config:
        - subnet: 192.168.10.0/24
          gateway: 192.168.10.1

  databases:
    name: databases
    driver: bridge
    enable_ipv6: true
    enable_ipv4: true

services:
  postgres:
    image: postgres:18.1@sha256:bfe50b2b0ddd9b55eadedd066fe24c7c6fe06626185b73358c480ea37868024d
    networks:
      databases: {}
  home-assistant:
    image: ghcr.io/home-operations/home-assistant:2025.12.5@sha256:6be0843b06ad82233639e56f261b2377f78df140e3d16d2d08b2c29c8889b697
    networks:
      databases: {}
      lan_access:
        ipv4_address: 192.168.10.18
        gw_priority: 1000 

databases will be the default gw.
Forcing databases to disable ipv6 it will make lan_access the default gw.

Compose Version

Docker Environment

Client: Docker Engine - Community
 Version:    28.3.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.25.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.38.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 29
  Running: 29
  Paused: 0
  Stopped: 0
 Images: 32
 Server Version: 28.3.1
 Storage Driver: overlay2
  Backing Filesystem: zfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2 nvidia
 Default Runtime: nvidia
 Init Binary: docker-init
 containerd version: 05044ec0a9a75232cad458027ca83437aae3f4da
 runc version: v1.2.5-0-g59923ef
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.12.33-production+truenas
 Operating System: Debian GNU/Linux 12 (bookworm)
 OSType: linux
 Architecture: x86_64
 CPUs: 16
 Total Memory: 62.63GiB
 Name: truenas
 ID: af416a29-e97e-48c4-a294-35253e26efb6
 Docker Root Dir: /mnt/.ix-apps/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Default Address Pools:
   Base: 172.16.0.0/12, Size: 24

Anything else?

No response

[Pnkcaht]

I will conduct an analysis along with tests on this

[Pnkcaht]

Hi @stavros-k , The root cause was that NetworkingConfig.EndpointsConfig was constructed from a map, which results in non-deterministic ordering. As a consequence, gw_priority was not consistently honored when multiple networks were defined in the Compose file.

The fix ensures endpoint configurations are explicitly ordered by descending gw_priority before being passed to the Docker Engine. A unit test was added to validate the correct ordering.

PR: #13512

[ndeloof]

Using your reproduction example and docker inspect on home-assistant container I confirmed GwPriority is well set. I wonder this is an engine issue.

can you please try to reproduce by creating this container with a plain docker run --network ... command, following https://docs.docker.com/engine/network/#connecting-to-multiple-networks ?

[stavros-k]

Looks like it is..

truenas_admin@prometheus[~]$ sudo docker network create --driver macvlan  --gateway 10.20.30.1 --subnet 10.20.30.0/24 maclvan
ff244efc6dcede7113c18cf2b49f19fc33b5999d9e04788404415e6d25b16e0e

truenas_admin@prometheus[~]$ sudo docker network create internal
573c4a2cef17c9ffe901fb635eba0e369bb174b25314df732d4528bc4da89a09

truenas_admin@prometheus[~]$ sudo docker run -it --network name=maclvan,gw-priority=1000 --network internal bash ip r
default via 172.16.14.1 dev eth0
10.20.30.0/24 dev eth1 scope link  src 10.20.30.2
172.16.14.0/24 dev eth0 scope link  src 172.16.14.2

truenas_admin@prometheus[~]$ sudo docker run -it --network name=maclvan,gw-priority=1000 --network name=internal,gw-priority=999 bash ip r
default via 172.16.14.1 dev eth0
10.20.30.0/24 dev eth1 scope link  src 10.20.30.2
172.16.14.0/24 dev eth0 scope link  src 172.16.14.2

Hmmm now, even with ipv4 only networks still doesnt work.

truenas_admin@prometheus[~]$ sudo docker network create internalv4 --ipv6=false --ipv4=true
a527029e79e52eee97ec788b68c808ed8692360f5e599b4ca9906f7dad9184f1

truenas_admin@prometheus[~]$ sudo docker run -it --network name=maclvan,gw-priority=1000 --network internalv4 bash ip r
default via 172.16.15.1 dev eth0
10.20.30.0/24 dev eth1 scope link  src 10.20.30.2
172.16.15.0/24 dev eth0 scope link  src 172.16.15.2

[stavros-k]

Okay

networks:
  maclvanv4:
    driver: macvlan
    enable_ipv6: false
    driver_opts:
      parent: br1
    ipam:
      config:
        - subnet: 10.20.30.0/24
          gateway: 10.20.30.1
  internalv4:
    driver: bridge
    enable_ipv6: false

services:
  bash:
    image: bash
    command: ip r
    networks:
      internalv4:
      maclvanv4:
        ipv4_address: 10.20.30.156
        gw_priority: 1000
        priority: 1000

Gives

bash-1  | default via 10.20.30.1 dev eth0
bash-1  | 10.20.30.0/24 dev eth0 scope link  src 10.20.30.156
bash-1  | 172.16.5.0/24 dev eth1 scope link  src 172.16.5.2
bash-1 exited with code 0

---

networks:
  maclvanv4:
    driver: macvlan
    enable_ipv6: false
    driver_opts:
      parent: br1
    ipam:
      config:
        - subnet: 10.20.30.0/24
          gateway: 10.20.30.1
  internalv4:
    driver: bridge
    # enable_ipv6: false

services:
  bash:
    image: bash
    command: ip r
    networks:
      internalv4:
      maclvanv4:
        ipv4_address: 10.20.30.156
        gw_priority: 1000
        priority: 1000

Gives

bash-1  | default via 172.16.5.1 dev eth0
bash-1  | 10.20.30.0/24 dev eth1 scope link  src 10.20.30.156
bash-1  | 172.16.5.0/24 dev eth0 scope link  src 172.16.5.2
bash-1 exited with code 0

---

Via docker run:

Both IPv4

truenas_admin@prometheus[~]$ sudo docker network create --driver bridge --ipv6=false --ipv4=true internal
9e407d74b51752b4ddeb147ee7eb0de334e26ef1e1d8aee12ced9ef3ff18df70

truenas_admin@prometheus[~]$ sudo docker network create --driver macvlan --subnet=10.20.30.0/24 --gateway=10.20.30.1 -o parent=br1 --ipv6=false --ipv4=true maclvan
7b2dc465e8da616cb0a77fbafc912bdeb180fcbb0e1dc371a1bb6e4c428bd2d5

truenas_admin@prometheus[~]$ sudo docker run --rm \
  --network name=maclvan,gw-priority=1000 \
  --network internal \
  bash ip r
default via 10.20.30.1 dev eth1
10.20.30.0/24 dev eth1 scope link  src 10.20.30.2
172.16.5.0/24 dev eth0 scope link  src 172.16.5.2

One IPv6

truenas_admin@prometheus[~]$ sudo docker network create --driver bridge --ipv6=true --ipv4=true internal
2c90ee776b0847270b92cb2d77eb69d599afe026e7485c7e53107a03c9677cfc

truenas_admin@prometheus[~]$ sudo docker network create --driver macvlan --subnet=10.20.30.0/24 --gateway=10.20.30.1 -o parent=br1 --ipv6=false --ipv4=true maclvan
8195c1746b73915b2cf93bf35fc2eccf3c5f3e23be4854bbc1c91602aa94c1c3

truenas_admin@prometheus[~]$ sudo docker run --rm \
  --network name=maclvan,gw-priority=1000 \
  --network internal \
  bash ip r
default via 172.16.5.1 dev eth1
10.20.30.0/24 dev eth0 scope link  src 10.20.30.2
172.16.5.0/24 dev eth1 scope link  src 172.16.5.2