Subnet intersection check is preventing legit scenarios

@compdude22

Description

This has been brought up in discussions:

What is the purpose for subnet intersection checking in netutil.go? #3430
Understanding the Error: `subnet 192.168.10.0/24 overlaps with another one in this address space` in macvlan network creation with nerdctl #4082

And is also one of the issues in #4279.

In a shell:

this check was added in use free subnet to create network #1245 though it is no longer clear what was the motivation
this is preventing macvlan scenarios using the parent subnet for example
this is at odds with docker behavior

Part of one of the discussions #3430 (reply in thread) suggests removing the check entirely.

cc @compdude22 who participated in that discussion.

Steps to reproduce the issue

Create a network which subnet is overlapping with an existing system subnet.

Describe the results you received and expected

Expect: work.
Received: creation fail because subnet intersect with system subnet

What version of nerdctl are you using?

main

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

No response

I ran into FATA[0000] failed to verify networking settings: failed to create default network: subnet 10.4.0.0/24 overlaps with other one on this address space consistently.
My DHCP server assigns my PC a random IPv4 address from 10.0.0.0/8.
I tried to create the default network manually with a non-overlapping subnet, but nerdctl run still cannot pass the subnet intersection check.

You can just configure the default bridge ip to whatever you need (https://github.com/containerd/nerdctl/blob/7d116bf1fd6279bb9d2c3bae03cb66967e0b2fcc/docs/config.md#properties)

Also please open a different issue with enough details about what your problem is.

I ran into FATA[0000] failed to verify networking settings: failed to create default network: subnet 10.4.0.0/24 overlaps with other one on this address space consistently.

Doing what?

My DHCP server assigns my PC a random IPv4 address from 10.0.0.0/8.
I tried to create the default network manually with a non-overlapping subnet,

How?

but nerdctl run still cannot pass the subnet intersection check.

Which command?

FATA[0000] failed to verify networking settings: failed to create default network: subnet 10.4.0.0/24 overlaps with other one on this address space

ran into this while trying to set up nerdctl-in-nerdctl. Changing bridge-ip parameter in child container works.

This subnet check directly causes the macvlan network to be unusable. I noticed that this issue was raised a long time ago—are there any solutions available now?

bug can be bypass


cat > /etc/cni/net.d/macnet.conflist <<'EOF'
{
  "cniVersion": "1.0.0",
  "name": "macnet",
  "plugins": [{
    "type": "macvlan",
    "master": "ensxxxx",
    "mode": "bridge",
    "ipam": {
      "type": "host-local",
      "ranges": [[{"subnet": "10.xx.xx.0/21", "rangeStart": "10.1xx.xx.100", "rangeEnd": "10.x.x.150", "gateway": "10.xx.x.1"}]],
      "routes": [{"dst": "0.0.0.0/0"}]
    }
  }]
}
EOF
nerdctl network ls
nerdctl run --rm --network macnet alpine ip a

parseSubnet rejected any subnet that intersected the set of already used subnets, returning an overlap error even when the caller explicitly requested that subnet.

Removed the subnet-intersection rejection from parseSubnet, while retaining validation that the supplied address is the canonical network address. Added a regression test confirming that an explicitly overlapping subnet is accepted.

#5297

Navigation Menu

Repository navigation

Subnet intersection check is preventing legit scenarios #4281

Description

Steps to reproduce the issue

Describe the results you received and expected

What version of nerdctl are you using?

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

Host information

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Subnet intersection check is preventing legit scenarios #4281

Description

Description

Steps to reproduce the issue

Describe the results you received and expected

What version of nerdctl are you using?

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

Host information

Activity

zhangyoufu commented on May 23, 2025

apostasie commented on May 23, 2025

arogozhnikov commented on Aug 26, 2025

GavinTan commented on Sep 25, 2025

pythonwood commented on Oct 23, 2026

mvanhorn commented on Oct 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions