github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1236] cannot use a bridge that has no IP address #842

New issue

Open

opened 2026-05-05 06:57:28 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 06:57:28 -06:00

Owner

Originally created by @voidzero on GitHub (Apr 20, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1236

When I try to bind a veth to a bridge that has no IP address, I currently get:

Warning: the network interface vbr1 is not configured
Error: cannot configure the IP address twice for the same interface

This is defined here: https://github.com/netblue30/firejail/blob/master/src/firejail/profile.c#L349 and it also happens for a bridge without IP addresses.

The reason I want to do this is that the bridge has an lxc container configured to it, and the host doesn't need an IP address so I'd rather not give it one. The idea is that the firejailed instance uses the lxc container as a gateway.

Originally created by @voidzero on GitHub (Apr 20, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1236 When I try to bind a veth to a bridge that has no IP address, I currently get: ``` Warning: the network interface vbr1 is not configured Error: cannot configure the IP address twice for the same interface ``` This is defined here: https://github.com/netblue30/firejail/blob/master/src/firejail/profile.c#L349 and it also happens for a bridge without IP addresses. The reason I want to do this is that the bridge has an lxc container configured to it, and the host doesn't need an IP address so I'd rather not give it one. The idea is that the firejailed instance uses the lxc container as a gateway.

gitea-mirror added the

information_old

networking

labels 2026-05-05 06:57:28 -06:00

gitea-mirror commented

2026-05-05 06:57:32 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 20, 2017):

What command do you use to start the sandbox?

@netblue30 commented on GitHub (Apr 20, 2017): What command do you use to start the sandbox?

gitea-mirror commented

2026-05-05 06:57:33 -06:00

Author

Owner

@voidzero commented on GitHub (Apr 20, 2017):

Something like this:

firejail --name=foobar --noprofile --noroot --seccomp --machine-id --hostname=foobar \
--shell=none --net=br1 --mac=5c:20:ad:af:66:fa --veth-name=foo --ip=192.168.1.3/24 \
--defaultgw=192.168.1.1 --dns=8.8.8.8 --dns=8.8.4.4 -- my-funky-process

192.168.1.1 exists on the bridge, just not on the host.. it is owned by the lxc container. The bridge doesn't have an IPv6 address either - I run echo 1 > /proc/sys/net/ipv6/conf/br1/disable_ipv6 after the bridge is created. So from the host's vantage point it's kind of like a networking switch.

As a workaround, I add 192.168.1.254 to the bridge before starting firejail, and remove it once it's running. No issues, tcpdump shows me that everything works exactly how I hoped.

If you do want an extra check, maybe something like --bridge-no-ip would work so that the user can indicate being aware of the bridge not having an IP address.

@voidzero commented on GitHub (Apr 20, 2017): Something like this: ``` firejail --name=foobar --noprofile --noroot --seccomp --machine-id --hostname=foobar \ --shell=none --net=br1 --mac=5c:20:ad:af:66:fa --veth-name=foo --ip=192.168.1.3/24 \ --defaultgw=192.168.1.1 --dns=8.8.8.8 --dns=8.8.4.4 -- my-funky-process ``` 192.168.1.1 exists on the bridge, just not on the host.. it is owned by the lxc container. The bridge doesn't have an IPv6 address either - I run `echo 1 > /proc/sys/net/ipv6/conf/br1/disable_ipv6` after the bridge is created. So from the host's vantage point it's kind of like a networking switch. As a workaround, I add 192.168.1.254 to the bridge before starting firejail, and remove it once it's running. No issues, tcpdump shows me that everything works exactly how I hoped. If you do want an extra check, maybe something like `--bridge-no-ip` would work so that the user can indicate being aware of the bridge not having an IP address.

gitea-mirror commented

2026-05-05 06:57:36 -06:00

Author

Owner

@voidzero commented on GitHub (Aug 14, 2017):

@netblue30 hope it's ok for me to ping you on this 😉

@voidzero commented on GitHub (Aug 14, 2017): @netblue30 hope it's ok for me to ping you on this :wink:

gitea-mirror commented

2026-05-05 06:57:41 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 18, 2017):

Sure, no problem. I'll change it to an enhancement, and implement --bridge-no-ip as you suggested.

@netblue30 commented on GitHub (Aug 18, 2017): Sure, no problem. I'll change it to an enhancement, and implement --bridge-no-ip as you suggested.

gitea-mirror commented

2026-05-05 06:57:44 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 10, 2019):

Any progress here?

@rusty-snake commented on GitHub (Jul 10, 2019): Any progress here?

gitea-mirror commented

2026-05-05 06:57:47 -06:00

Author

Owner

@pallaswept commented on GitHub (Dec 9, 2025):

Bump ;)

@pallaswept commented on GitHub (Dec 9, 2025): Bump ;)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#842

No description provided.

Rows
Columns