I'm running Docker in rootless mode on a Raspberry Pi 4 (aarch64) with Ubuntu 24.04.2 LTS, and I'm encountering issues with IPv6 port binding when using the pasta network driver. The setup works when falling back to slirp4netns, but that approach masks the client’s IPv6 source address, which is problematic for reverse proxy and security-related purposes.

📦 Environment Details

Docker version: 28.1.1 (rootless)
Docker Compose: v2.35.1
Kernel: 6.8.0-1024-raspi
OS: Ubuntu 24.04.2 LTS
CPU: aarch64 (Raspberry Pi 4)
Memory: 3.7 GiB

🌐 pasta Version

pasta version: 0.0~git20240220.1e6f92b-1

⚙️ Docker Configuration

Docker is configured to support IPv6, with a custom CIDR block:

{
  "log-driver": "journald",
  "icc": false,
  "live-restore": true,
  "no-new-privileges": true,
  "ipv6": true,
  "fixed-cidr-v6": "fdf7:3da2:1::/64",
  "default-address-pools": [
    { "base": "172.17.0.0/16", "size": 16 },
    { "base": "fdf7:3da2::/104", "size": 112 }
  ]
}

Full output of docker info is included at the end for reference.

📄 Relevant Docker Compose Snippet

networks:
  external-reverse-proxy:
    enable_ipv6: true

Example service bound to this network:

services:
  external-reverse-proxy:
    image: external-reverse-proxy:latest
    ports:
      - "35689:80"
      - "28453:443"
    networks:
      - external-reverse-proxy

🔎 Docker Network Inspection Output

Excerpt from docker network inspect one4all_external-reverse-proxy:

"EnableIPv6": true,
"IPAM": {
  "Config": [
    {
      "Subnet": "172.20.0.0/16",
      "Gateway": "172.20.0.1"
    },
    {
      "Subnet": "fdf7:3da2::/112",
      "Gateway": "fdf7:3da2::1"
    }
  ]
}
...
"IPv6Address": "fdf7:3da2::3/112"

✅ Works With

When using:

• slirp4netns as network driver
• builtin port driver

...the setup works, but incoming IPv6 client addresses are not preserved — they appear NATed by the gateway adress.

❓Questions

• Is IPv6 port binding expected to work with pasta (with implicit port forwarding) in rootless mode?
• What is the recommended setup to preserve client IPv6 source addresses when using rootless Docker?
  • Is pasta the right tool here?

📎 Additional Context

I need to expose IPv6 ports and retain source IPs from clients (important for my reverse proxy and security monitoring setup).