Sign inSign up

ednxzu/conntrackd

By ednxzu

•Updated 9 days ago

Conntrackd container for connection tracking synchronization

Image
0

1.7K

ednxzu/conntrackd repository overview

⁠conntrackd

Container image for running conntrackd, providing connection tracking synchronization for HA failover scenarios.

⁠Quick Start

docker run --privileged --net=host \
  -e IPV4_DESTINATION_ADDRESS=192.168.1.2 \
  -d ednxzu/conntrackd:latest

Note: conntrackd requires privileged mode for raw UDP socket access used in connection tracking synchronization.

⁠Environment Variables

NameDescriptionRequiredDefault
CONFIGPath to the config fileNo/etc/conntrackd/conntrackd.conf
SYNC_MODESync protocol (FTFW, NOTRACK, ALARM)NoFTFW
INTERFACENetwork interface for syncNoeth0
IPV4_ADDRESSLocal IPv4 addressNoauto-detect
IPV4_DESTINATION_ADDRESSPeer IPv4 addressYes-
SYNC_PORTUDP port for syncNo3780
HASH_SIZEConnection hash table sizeNo32768
HASH_LIMITMax tracked connectionsNo131072
SOCKET_PATHUnix socket pathNo/var/run/conntrackd/conntrackd.ctl

⁠Architecture

This repository builds container images for both amd64 and arm64 architectures.

Multi-architecture manifests are published on Docker Hub, so pulling the image on supported platforms will automatically get the correct architecture variant.

⁠Integration with Keepalived

To synchronize connection tracking during keepalived failovers, use the provided notify-conntrackd.sh script and share the conntrackd socket between containers.

⁠Architecture Diagram
┌─────────────────────────┐     ┌─────────────────────────┐
│  keepalived container   │     │  conntrackd container   │
│  (ednxzu/keepalived)    │     │  (ednxzu/conntrackd)    │
│                         │     │                         │
│  - keepalived daemon    │     │  - conntrackd daemon    │
│  - conntrack-tools      │     │  - entrypoint.sh        │
│  - notify-conntrackd.sh │     │                         │
│    calls conntrackd -C  │     │  Exposes:               │
│                         │     │  /var/run/conntrackd/   │
│  Mounts (shared vol):   │◄────│  conntrackd.ctl         │
│  /var/run/conntrackd/   │     │                         │
└─────────────────────────┘     └─────────────────────────┘
⁠Docker Compose Example
services:
  conntrackd:
    image: ednxzu/conntrackd:latest
    network_mode: host
    privileged: true
    environment:
      - INTERFACE=eth0
      - IPV4_DESTINATION_ADDRESS=192.168.1.2
    volumes:
      - conntrackd-socket:/var/run/conntrackd

  keepalived:
    image: ednxzu/keepalived:latest
    network_mode: host
    cap_add:
      - NET_ADMIN
    environment:
      - INTERFACE=eth0
      - VIRTUAL_IPS=192.168.1.100
      - NOTIFY=/notify-conntrackd.sh
    volumes:
      - conntrackd-socket:/var/run/conntrackd:ro

volumes:
  conntrackd-socket:
⁠State Transitions

The notify-conntrackd.sh script handles state transitions:

  • MASTER: Commits external cache to kernel, flushes caches, and resyncs
  • BACKUP: Requests bulk sync from peer
  • FAULT: Requests bulk sync from peer

⁠Bring your own config

Similar to the keepalived container, you can provide your own configuration file:

docker run --cap-add=NET_ADMIN \
--net=host \
-v "./conntrackd.conf:/etc/conntrackd/conntrackd.conf"
ednxzu/conntrackd

If the configuration file contains ${...} patterns, it will be processed with envsubst for variable substitution.

Tag summary

Content type

Image

Digest

sha256:df24582b8…

Size

6.4 MB

Last updated

9 days ago

docker pull ednxzu/conntrackd