gvisor-tap-vsock outbound TCP forwarding stalls with RootlessKit 3.1.0 / Docker 29.8.1 #644

Environment

• Ubuntu 24.04
• Docker Engine 29.8.1
• RootlessKit 3.1.0
• RootlessKit network driver: gvisor-tap-vsock
• Port driver: builtin
• GitLab CE 19.3.2 running in a rootless Docker container
• External PostgreSQL accessed through PgBouncer

RootlessKit process:

rootlesskit --state-dir=/run/user/<UID>/dockerd-rootless \
  --net=gvisor-tap-vsock \
  --mtu=65520 \
  --slirp4netns-sandbox=auto \
  --slirp4netns-seccomp=auto \
  --disable-host-loopback \
  --port-driver=builtin \
  --copy-up=/etc \
  --copy-up=/run \
  --propagation=rslave \
  --detach-netns /usr/bin/dockerd-rootless.sh

Problem

With gvisor-tap-vsock, outbound TCP connections from the RootlessKit network namespace intermittently stall.

The problem is reproducible when opening GitLab Admin Area → Dashboard.

I ran continuous loops creating fresh PostgreSQL connections from inside the GitLab container.

Two separate runs of 10,000 connections completed without errors while the GitLab UI was idle.

After opening Admin Area → Dashboard, new outbound connections started timing out:

psql: error: connection to server at "192.0.2.20", port 6432 failed: timeout expired

real    0m5.007s

At the same time:

• TCP from the host namespace to 192.0.2.20:6432 remained healthy (~4–6 ms).
• TCP from the RootlessKit network namespace failed not only to PostgreSQL/PgBouncer, but also to another unrelated destination (198.51.100.30:443).
• Restarting the rootless Docker service immediately restored networking.

Packet capture

Inside the RootlessKit namespace, SYN packets are visible on tap0 and are continuously retransmitted:

16:34:06 IP 10.0.2.100.48670 > 192.0.2.20.6432: Flags [S]
16:34:07 IP 10.0.2.100.48670 > 192.0.2.20.6432: Flags [S]
16:34:08 IP 10.0.2.100.48670 > 192.0.2.20.6432: Flags [S]
16:34:09 IP 10.0.2.100.48670 > 192.0.2.20.6432: Flags [S]
16:34:10 IP 10.0.2.100.48670 > 192.0.2.20.6432: Flags [S]

During the same failure window, a packet capture on the host's physical network interface showed:

0 packets captured
0 packets received by filter
0 packets dropped by kernel

This suggests that SYN packets are generated inside the RootlessKit network namespace and reach tap0, but are not forwarded to the host network interface.

Additional observations

During the failure:

• the host network namespace remained fully functional;
• the problem affected multiple unrelated TCP destinations;
• RootlessKit remained running;
• there was no significant file descriptor exhaustion;
• restarting the rootless Docker service immediately restored outbound connectivity.

Example RootlessKit FD usage during testing:

Max open files: 1048576
Open FDs observed: approximately 60–90

The host TCP stack also did not appear exhausted.

A/B test / workaround

I switched RootlessKit from:

--net=gvisor-tap-vsock

to:

--net=slirp4netns

while keeping:

--port-driver=builtin

After switching to slirp4netns, the problem is no longer reproducible.

Repeated fresh PostgreSQL connection tests complete successfully, including multiple runs with thousands of new TCP connections, and repeatedly opening GitLab Admin Area → Dashboard no longer causes outbound networking to stall.

Related upstream reports

This appears similar to:

• 10 TCP connections to unresponsive/blacklisted destinations enough to block all TCP connections for over a minute? containers/gvisor-tap-vsock#676
• Make TCP forwarder max in-flight connections and connect timeout configurable containers/gvisor-tap-vsock#698

PR #698 has already been merged upstream, but Docker Engine 29.8.1 / RootlessKit 3.1.0 still appears to exhibit similar behavior in this environment.

It would be useful to confirm:

1. Which gvisor-tap-vsock revision is included with RootlessKit 3.1.0.
2. Whether that revision contains the fix from Make TCP forwarder max in-flight connections and connect timeout configurable containers/gvisor-tap-vsock#698.
3. Whether a newer gvisor-tap-vsock dependency is planned for RootlessKit / Docker Engine.