[AdaAibaby]

Fixes #3585.

Problem

kernel_args.go hardcoded ipv6.disable=0 and ipv6.autoconf=1, enabling IPv6 inside every Firecracker guest. But the host-side network setup is IPv4-only — no router advertisement is sent on the host tap — so SLAAC produces only an unroutable fe80:: link-local address.

With IPv6 enabled but unroutable, a runtime that runs its own Happy Eyeballs (RFC 8305) races AAAA first, hits the dead fe80:: path, and waits out a ~250 ms timeout before falling back to IPv4 on every dual-stack outbound connection. This affects Node.js (autoSelectFamily, default-on since Node 20), curl --happy-eyeballs, Go dual-stack dialing, and similar.

Scope correction vs. the original description: plain glibc getaddrinfo tools (pip, apt, most curl) are mostly spared — with only a link-local source address, RFC 6724 already sorts IPv4 ahead of IPv6, so they usually try IPv4 first. The penalty is real but concentrated in runtimes/libraries that do their own A/AAAA racing, not "every tool loses 5s".

Fix

Derive the guest's IPv6 state from whether the host slot actually has an IPv6 router, instead of hardcoding it:

• Slot.HasIPv6Router() bool — single source of truth; returns false today.
• ProcessOptions.IPv6RouterConfigured — carries the slot's answer into buildKernelArgs without coupling the kernel-args layer to the network package; set from Slot.HasIPv6Router() in Process.Create.
• buildKernelArgs — no router (the default) → emit sysctl.net.ipv6.conf.{all,default}.disable_ipv6=1 on the kernel command line. Router present → keep ipv6.disable=0 / ipv6.autoconf=1.

Why address-stripping sysctls instead of ipv6.disable=1

ipv6.disable=1 turns off the entire AF_INET6 stack — socket(AF_INET6) returns EAFNOSUPPORT, so a guest service that binds :: (the dual-stack wildcard, the default for many web servers / Node / Python) fails to start. Sandboxes run arbitrary user code, so that is a real compatibility regression.

Instead, sysctl.net.ipv6.conf.{all,default}.disable_ipv6=1 (kernel cmdline, supported since Linux 5.8) strips IPv6 addresses from every interface — the kernel then has no IPv6 source address and RFC 6724 prefers IPv4, which removes the Happy Eyeballs penalty — while keeping the AF_INET6 socket API and bind(::) working. The only behaviour it drops is an explicit [::1] loopback bind, which has no routable counterpart without a v6 stack anyway.

Verification

Kernel-cmdline sysctl parsing is confirmed end-to-end on the actual guest kernel: booted vmlinux-6.1.158 (the guest Firecracker kernel this environment ships — alongside 6.1.102) under firecracker with a busybox initramfs, with vs. without the sysctl args.

boot	/proc/cmdline has sysctl.*	all.disable_ipv6	default.disable_ipv6	ip -6 addr (lo)	ipv6 proc tree
with sysctl args	yes	1	1	no inet6 address	PRESENT
control (without)	no	0	0	::1/128	PRESENT

The guest 6.1 kernel applies the command-line sysctls (disable_ipv6 flips to 1), every IPv6 address is gone (even ::1), and the AF_INET6 stack stays compiled-in and enabled (the /proc/sys/net/ipv6 tree is present) — i.e. address-stripping, not a stack teardown. socket(AF_INET6) + bind(::) remaining usable under disable_ipv6=1 (while ipv6.disable=1 fails all of socket/bind(::)/bind(::1)) was separately confirmed via netns.

mode	AF_INET6 socket	bind(::)	bind(::1)	v6 addrs
current main	yes	yes	yes	fe80 + ::1
this PR (strip addrs)	yes	yes	no	none
ipv6.disable=1	no	no	no	none

Changes

File	What changed
network/slot.go	HasIPv6Router() bool — documented extension point, returns false
fc/process.go	ProcessOptions.IPv6RouterConfigured; set from slot.HasIPv6Router() before buildKernelArgs
fc/kernel_args.go	IPv6 args derived from options.IPv6RouterConfigured instead of hardcoded
fc/kernel_args_test.go	Updated pinned defaults; added ipv6 router configured case
docs/ARCHITECTURE.md	Documents the IPv4-only guest default and the dual-stack upgrade path

Testing

go build / go vet clean for fc + network. go test ./pkg/sandbox/fc/ passes (pinned-cmdline + new dual-stack case). Kernel-cmdline sysctl parsing confirmed end-to-end on guest vmlinux-6.1.158 (see the Verification table above); the AF_INET6/bind(::) retention under disable_ipv6=1 confirmed via netns.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 926e6ed210

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[blancadesal]

Tested this on a bare-metal server (Debian 13/trixie, kernel 6.12) while trying to run the DEV-LOCAL.md local-dev flow end-to-end.

Reproduced the bug on main: apt-get inside the guest tried an unroutable IPv6 address first (Cannot initiate the connection to deb.debian.org:80 (2a04:4e42:...)) before falling back to IPv4.

Cherry-picked this PR onto the same environment, rebuilt the orchestrator, and confirmed a clean build with no IPv6 attempts – apt-get went straight to IPv4. 🎉