Add release v1.4.4

Don't remove weave network on plugin shutdown because it bricks Docker 1.10

CHANGELOG.md

@@ -1,3 +1,77 @@
+## Release 1.4.4
+
+Fixing a rather serious issue that slipped through our preparations
+for Docker 1.10:
+
+* Restarting Docker or rebooting your machine while the Weave Net
+  plugin is running causes Docker 1.10.0 to fail to start #1959/#1963
+
+Also one other small fix:
+
+* Avoid a hang when trying to use plugin and proxy at the same time
+  #1956/#1961
+
+## Release 1.4.3
+
+Preparing for Docker 1.10, plus some bug-fixes.
+
+* Avoid hang in Docker v1.10 on `docker volume ls` after `weave stop`,
+  `weave stop-plugin` or `weave reset` #1934/#1936
+* Fix "unexpected EOF" from Docker 1.10 on `docker exec` with Weave
+  proxy `--rewrite-inspect` enabled #1911/#1917
+* Avoid losing DNS entries and potentially double-allocating IP
+  Addresses allocated via plugin, on router restart; also extend
+  `weave ps` to show IP addresses allocated via plugin #1745/#1921
+* Stop creating lots of copies of `weavewait` program in Docker
+  volumes #1757/#1935
+* Prevent container starting prematurely when proxy in
+`--no-multicast-route` mode #1942/#1943
+* Log error message from plugin rather than crashing when weave not
+  running #1906/#1918
+* Warn, don't error, if unable to remove plugin network in 'weave
+  stop', to avoid breaking the usual upgrade or config change process
+  #1900/#1919
+* Don't crash if network conditions suggest only very small packets
+  will get through #1905/#1926
+* Cope with unexpected errors during route traversal when starting
+  container via proxy #1909/#1910/#1932
+
+## Release 1.4.2
+
+Bug-fixes and minor improvements.
+
+* A race condition in weavewait that would occasionally hang
+  containers at startup #1882/#1884
+* Having the plugin auto-restart prevents successful `weave launch` on
+  reboot #1869
+* Work round weave router failure on CoreOS 4.3 caused by kernel bug
+  #1854
+* `weave launch` would exit with error code on docker <1.9 #1851
+* Running `eval $(weave env)` multiple times would break `eval $(weave
+  env --restore)` #1824/#1825
+* Don't complain in `weave stop` about "Plugin is not running" when
+  plugin is not enabled #1840/#1841
+* `weave --local launch` would fail if utility program
+  `docker_tls_args` could not be found #1844
+* Improved error reporting when TLS arg detection fails #1843
+* Improve error reporting when docker isn't running #1845
+* Add `--trusted-subnets` usage to `weave` script #1842
+* weave run can hang under rare combinations of options #1858
+
+## Release 1.4.1
+
+This is a bug-fix release to cover a few issues that came up since the
+release of 1.4.0.
+
+* Weave would fail to launch when `$DOCKER_HOST` was set to a TCP socket secured with TLS #1820/#1822
+* Weave would fail to stop when run against Docker pre-1.9 #1815/#1817
+* Issue a warning instead of failing on `--with-dns` option to proxy, which was removed #1810/#1812
+* Make `weave version` show the plugin version #1797/#1813
+* Make `weave launch` show when the a container is restarting #1778/#1814
+* Make `weave launch` fail if the plugin is running, for consistency with router and proxy. #1818/#1819
+
+More details in the [change log](https://github.com/weaveworks/weave/issues?q=milestone%3A1.4.1).
+
 ## Release 1.4.0
 
 **Highlights**

Makefile

@@ -1,4 +1,4 @@
-PUBLISH=publish_weave publish_weaveexec
+PUBLISH=publish_weave publish_weaveexec publish_plugin
 
 .DEFAULT: all
 .PHONY: all update tests lint publish $(PUBLISH) clean clean-bin prerequisites build travis run-smoketests
@@ -119,7 +119,7 @@ $(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile prog/weaveexec/symlink $(DOCKER
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -t $(WEAVEEXEC_IMAGE) prog/weaveexec
 	touch $@
 
-$(DOCKERPLUGIN_UPTODATE): prog/plugin/Dockerfile $(DOCKERPLUGIN_EXE)
+$(DOCKERPLUGIN_UPTODATE): prog/plugin/Dockerfile $(DOCKERPLUGIN_EXE) $(WEAVEEXEC_UPTODATE)
 	$(SUDO) docker build -t $(DOCKERPLUGIN_IMAGE) prog/plugin
 	touch $@
 

net/if.go

@@ -18,15 +18,16 @@ func EnsureInterface(ifaceName string) (*net.Interface, error) {
 }
 
 func ensureInterface(ifaceName string) (*net.Interface, error) {
-	if iface, err := findInterface(ifaceName); err == nil {
-		return iface, nil
-	}
 	ch := make(chan netlink.LinkUpdate)
 	done := make(chan struct{})
 	defer close(done)
 	if err := netlink.LinkSubscribe(ch, done); err != nil {
 		return nil, err
 	}
+	// check for currently-existing interface after subscribing, to avoid race
+	if iface, err := findInterface(ifaceName); err == nil {
+		return iface, nil
+	}
 	for update := range ch {
 		if ifaceName == update.Link.Attrs().Name && update.IfInfomsg.Flags&syscall.IFF_UP != 0 {
 			break
@@ -44,22 +45,32 @@ func EnsureInterfaceAndMcastRoute(ifaceName string) (*net.Interface, error) {
 	if err != nil {
 		return nil, err
 	}
-	dest := net.IPv4(224, 0, 0, 0)
-	if CheckRouteExists(ifaceName, dest) {
-		return iface, err
-	}
 	ch := make(chan netlink.RouteUpdate)
 	done := make(chan struct{})
 	defer close(done)
 	if err := netlink.RouteSubscribe(ch, done); err != nil {
 		return nil, err
 	}
-	for update := range ch {
-		link, _ := netlink.LinkByIndex(update.Route.LinkIndex)
-		if link.Attrs().Name == ifaceName && update.Route.Dst.IP.Equal(dest) {
-			break
+	dest := net.IPv4(224, 0, 0, 0)
+	check := func(route netlink.Route) bool {
+		return route.Dst != nil && route.Dst.IP.Equal(dest)
+	}
+	// check for currently-existing route after subscribing, to avoid race
+	routes, err := netlink.RouteList(nil, netlink.FAMILY_V4)
+	if err != nil {
+		return nil, err
+	}
+	for _, route := range routes {
+		if check(route) {
+			return iface, nil
 		}
 	}
+	for update := range ch {
+		if check(update.Route) {
+			return iface, nil
+		}
+	}
+	// should never get here
 	return iface, nil
 }
 

net/route.go

@@ -10,7 +10,7 @@ import (
 // A network is considered free if it does not overlap any existing
 // routes on this host. This is the same approach taken by Docker.
 func CheckNetworkFree(subnet *net.IPNet, ignoreIfaceNames map[string]struct{}) error {
-	return forEachRoute(ignoreIfaceNames, func(name string, route netlink.Route) error {
+	return forEachRoute(ignoreIfaceNames, func(route netlink.Route) error {
 		if route.Dst != nil && overlaps(route.Dst, subnet) {
 			return fmt.Errorf("Network %s overlaps with existing route %s on host.", subnet, route.Dst)
 		}
@@ -26,7 +26,7 @@ func overlaps(n1, n2 *net.IPNet) bool {
 // For a specific address, we only care if it is actually *inside* an
 // existing route, because weave-local traffic never hits IP routing.
 func CheckAddressOverlap(addr net.IP, ignoreIfaceNames map[string]struct{}) error {
-	return forEachRoute(ignoreIfaceNames, func(name string, route netlink.Route) error {
+	return forEachRoute(ignoreIfaceNames, func(route netlink.Route) error {
 		if route.Dst != nil && route.Dst.Contains(addr) {
 			return fmt.Errorf("Address %s overlaps with existing route %s on host.", addr, route.Dst)
 		}
@@ -34,32 +34,24 @@ func CheckAddressOverlap(addr net.IP, ignoreIfaceNames map[string]struct{}) erro
 	})
 }
 
-func forEachRoute(ignoreIfaceNames map[string]struct{}, check func(name string, r netlink.Route) error) error {
+func forEachRoute(ignoreIfaceNames map[string]struct{}, check func(r netlink.Route) error) error {
+	ignoreIfaceIndices := make(map[int]struct{})
+	for ifaceName := range ignoreIfaceNames {
+		if iface, err := net.InterfaceByName(ifaceName); err == nil {
+			ignoreIfaceIndices[iface.Index] = struct{}{}
+		}
+	}
 	routes, err := netlink.RouteList(nil, netlink.FAMILY_V4)
 	if err != nil {
 		return err
 	}
 	for _, route := range routes {
-		link, err := netlink.LinkByIndex(route.LinkIndex)
-		if err == nil {
-			if _, found := ignoreIfaceNames[link.Attrs().Name]; found {
-				continue
-			}
+		if _, found := ignoreIfaceIndices[route.LinkIndex]; found {
+			continue
 		}
-		if err := check(link.Attrs().Name, route); err != nil {
+		if err := check(route); err != nil {
 			return err
 		}
 	}
 	return nil
 }
-
-func CheckRouteExists(ifaceName string, dest net.IP) bool {
-	found := false
-	forEachRoute(map[string]struct{}{}, func(name string, route netlink.Route) error {
-		if name == ifaceName && route.Dst.IP.Equal(dest) {
-			found = true
-		}
-		return nil
-	})
-	return found
-}

plugin/ipam/driver.go

@@ -1,10 +1,12 @@
 package ipamplugin
 
 import (
+	"fmt"
 	"net"
 
 	"github.com/docker/libnetwork/ipamapi"
 	"github.com/docker/libnetwork/netlabel"
+	godocker "github.com/fsouza/go-dockerclient"
 	"github.com/weaveworks/weave/api"
 	. "github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/common/docker"
@@ -20,7 +22,13 @@ type ipam struct {
 }
 
 func NewIpam(client *docker.Client, version string) (ipamapi.Ipam, error) {
-	resolver := func() (string, error) { return client.GetContainerIP(WeaveContainer) }
+	resolver := func() (string, error) {
+		addr, err := client.GetContainerIP(WeaveContainer)
+		if _, ok := err.(*godocker.NoSuchContainer); ok {
+			return "", fmt.Errorf("%s container is not present. Have you launched it?", WeaveContainer)
+		}
+		return addr, err
+	}
 	return &ipam{client: client, weave: api.NewClientWithResolver(resolver)}, nil
 }
 
@@ -33,6 +41,9 @@ func (i *ipam) RequestPool(addressSpace, pool, subPool string, options map[strin
 	Log.Debugln("RequestPool", addressSpace, pool, subPool, options)
 	cidr, err := i.weave.DefaultSubnet()
 	Log.Debugln("RequestPool returning ", cidr, err)
+	if err != nil {
+		return "", nil, nil, err
+	}
 	// Pass back a fake "gateway address"; we don't actually use it,
 	// so just give the network address.
 	data := map[string]string{netlabel.Gateway: cidr.String()}

plugin/skel/listener.go

@@ -265,6 +265,7 @@ func sendError(w http.ResponseWriter, msg string, code int) {
 }
 
 func errorResponse(w http.ResponseWriter, fmtString string, item ...interface{}) {
+	w.WriteHeader(http.StatusInternalServerError)
 	json.NewEncoder(w).Encode(map[string]string{
 		"Err": fmt.Sprintf(fmtString, item...),
 	})

prog/plugin/main.go

@@ -69,25 +69,35 @@ func main() {
 	Log.Println("Weave plugin", version, "Command line options:", os.Args[1:])
 	Log.Info(dockerClient.Info())
 
-	var globalListener, meshListener net.Listener
+	err = run(dockerClient, address, meshAddress, meshNetworkName, nameserver, noMulticastRoute)
+	if err != nil {
+		Log.Fatal(err)
+	}
+}
+
+func run(dockerClient *docker.Client, address, meshAddress, meshNetworkName, nameserver string, noMulticastRoute bool) error {
 	endChan := make(chan error, 1)
 	if address != "" {
 		globalListener, err := listenAndServe(dockerClient, address, nameserver, noMulticastRoute, endChan, "global", false)
 		if err != nil {
-			Log.Fatalf("unable to create driver: %s", err)
+			return err
 		}
+		defer os.Remove(address)
 		defer globalListener.Close()
 	}
 	if meshAddress != "" {
 		meshListener, err := listenAndServe(dockerClient, meshAddress, nameserver, noMulticastRoute, endChan, "local", true)
 		if err != nil {
-			Log.Fatalf("unable to create driver: %s", err)
+			return err
 		}
+		defer os.Remove(meshAddress)
 		defer meshListener.Close()
 	}
 
 	if meshNetworkName != "" {
-		createNetwork(dockerClient, meshNetworkName, meshAddress)
+		if err := createNetwork(dockerClient, meshNetworkName, meshAddress); err != nil {
+			return err
+		}
 	}
 
 	sigChan := make(chan os.Signal, 1)
@@ -96,16 +106,9 @@ func main() {
 	select {
 	case sig := <-sigChan:
 		Log.Debugf("Caught signal %s; shutting down", sig)
-		if err := dockerClient.Client.RemoveNetwork(meshNetworkName); err != nil {
-			Log.Fatal(err)
-		}
+		return nil
 	case err := <-endChan:
-		if err != nil {
-			Log.Errorf("Error from listener: %s", err)
-			globalListener.Close()
-			meshListener.Close()
-			os.Exit(1)
-		}
+		return err
 	}
 }
 
@@ -141,7 +144,7 @@ func listenAndServe(dockerClient *docker.Client, address, nameserver string, noM
 	return listener, nil
 }
 
-func createNetwork(dockerClient *docker.Client, networkName, address string) {
+func createNetwork(dockerClient *docker.Client, networkName, address string) error {
 	if _, err := dockerClient.Client.NetworkInfo(networkName); err == nil {
 		Log.Printf("Docker network '%s' already exists", networkName)
 	} else if _, ok := err.(*go_docker.NoSuchNetwork); ok {
@@ -157,7 +160,8 @@ func createNetwork(dockerClient *docker.Client, networkName, address string) {
 		}
 		_, err := dockerClient.Client.CreateNetwork(options)
 		if err != nil {
-			Log.Fatalf("Error creating network: %s", err)
+			return fmt.Errorf("Error creating network: %s", err)
 		}
 	}
+	return nil
 }

prog/weaveexec/Dockerfile

@@ -4,9 +4,6 @@ MAINTAINER Weaveworks Inc <help@weave.works>
 LABEL works.weave.role=system
 
 WORKDIR /home/weave
-VOLUME /w
-VOLUME /w-noop
-VOLUME /w-nomcast
 ENTRYPOINT ["/home/weave/sigproxy", "/home/weave/weave"]
 
 RUN apk add --update \

prog/weaveproxy/main.go

@@ -21,6 +21,7 @@ func main() {
 		justVersion bool
 		logLevel    = "info"
 		c           = proxy.Config{Image: "weaveworks/weaveexec"}
+		withDNS     bool
 	)
 
 	c.Version = version
@@ -39,6 +40,7 @@ func main() {
 	mflag.BoolVar(&c.TLSConfig.Enabled, []string{"#tls", "-tls"}, false, "Use TLS; implied by --tlsverify")
 	mflag.StringVar(&c.TLSConfig.Key, []string{"#tlskey", "-tlskey"}, "", "Path to TLS key file")
 	mflag.BoolVar(&c.TLSConfig.Verify, []string{"#tlsverify", "-tlsverify"}, false, "Use TLS and verify the remote")
+	mflag.BoolVar(&withDNS, []string{"#-with-dns", "#w"}, false, "option removed")
 	mflag.BoolVar(&c.WithoutDNS, []string{"-without-dns"}, false, "instruct created containers to never use weaveDNS as their nameserver")
 	mflag.BoolVar(&c.NoMulticastRoute, []string{"-no-multicast-route"}, false, "do not add a multicast route via the weave interface when attaching containers")
 	mflag.Parse()
@@ -57,6 +59,10 @@ func main() {
 	Log.Infoln("weave proxy", version)
 	Log.Infoln("Command line arguments:", strings.Join(os.Args[1:], " "))
 
+	if withDNS {
+		Log.Warning("--with-dns option has been removed; DNS is on by default")
+	}
+
 	c.DockerHost = defaultDockerHost
 	if dockerHost := os.Getenv("DOCKER_HOST"); dockerHost != "" {
 		c.DockerHost = dockerHost

proxy/inspect_exec_interceptor.go

@@ -22,6 +22,10 @@ func (i *inspectExecInterceptor) InterceptResponse(r *http.Response) error {
 		return err
 	}
 
+	if _, ok := exec["Container"]; !ok {
+		return nil
+	}
+
 	container, err := exec.Object("Container")
 	if err != nil {
 		return err

router/sleeve.go

@@ -917,7 +917,7 @@ func (fwd *sleeveForwarder) processSendError(err error) error {
 			return nil
 		}
 
-		fwd.mtuHighestGood = 8
+		fwd.mtuHighestGood = 552
 		fwd.mtuLowestBad = mtu + 1
 		fwd.mtuCandidate = mtu
 		fwd.mtuTestsSent = 0

site/_includes/header-navbaronly.html

@@ -2,7 +2,7 @@
     <div class="navbar navbar-inverse">
       <div class="container">
         <div class="navbar-header">
-          <a class="navbar-brand" href="http://weave.works/"><img src="http://weave.works/img/weave-logo.png"></a>
+          <a class="navbar-brand" href="http://weave.works/"><img src="http://www.weave.works/wp-content/uploads/2015/11/weave-logo-nav.png" class=" img-responsive" align="left"></a>
         </div>
         <div class="nav-wrapper">
           <ul class="nav navbar-nav navbar-right">

site/building.md

@@ -21,7 +21,11 @@ You can also build in a container under any system that supports
 Docker.  And you can run Ubuntu in a VM and build there.  These
 options are described below.
 
-## Building directly on Ubuntu
+ * [Building directly on Ubuntu](#ubuntu)
+ * [Building in a Docker container](#docker)
+ * [Building using Vagrant](#vagrant)
+
+## <a name="ubuntu"></a>Building directly on Ubuntu
 
 The weave git repository should be cloned into
 `$GOPATH/src/github.com/weaveworks/weave`, in accordance with [the go
@@ -53,10 +57,10 @@ $ make
 ```
 
 This will build the weave components and package them into three
-Docker images (`weaveworks/weave`, `weaveworks/weavedns`, and
-`weaveworks/weaveexec`).  These are then exported as `weave.tar.gz`.
+Docker images (`weaveworks/weave`, `weaveworks/weaveexec`, and
+`weaveworks/plugin`).  These are then exported as `weave.tar.gz`.
 
-## Building in a Docker container
+## <a name="docker"></a>Building in a Docker container
 
 As a preliminary step, we create a container image based on Ubuntu
 that has all the prerequisites.  This avoids the need to download and
@@ -106,7 +110,7 @@ $ sudo docker run -v /var/run/docker.sock:/var/run/docker.sock -v <host gopath>:
 This will leave the intermediate build artifacts on the host, so that
 you can modify the weave source code and rebuild quickly.
 
-## Building using Vagrant
+## <a name="vagrant"></a>Building using Vagrant
 
 If you aren't running Linux, or otherwise don't want to run the docker
 daemon outside a VM, you can use

site/features.md

@@ -50,6 +50,8 @@ TCP/IP, e.g. a netcat UDP service would be run with
 
     root@a2:/# echo 'Hello, world.' | nc -u a1 5533
 
+Broadcast and multicast protocols also work over Weave Net.
+
 We can deploy the entire arsenal of standard network tools and
 applications, developed over decades, to configure, secure, monitor,
 and troubleshoot our container network. To put it another way, we can
@@ -113,7 +115,8 @@ Weave detects when a container has exited and releases its
 automatically allocated addresses so they can be re-used.
 
 See the [Automatic IP Address Management](ipam.html) documentation for
-further details.
+further details. We also have an explanation of
+[the basics of IP addressing](ip-addresses.html)
 
 Instead of getting weave to allocate IP addresses automatically, it is
 also possible to specify an address and network explicitly, expressed

site/ip-addresses.md

@@ -0,0 +1,103 @@
+---
+title: IP Addresses, routes and networks
+layout: default
+---
+
+# IP Addresses, routes and networks
+
+Weave Net lets you run containers on a private network, and so the IP
+addresses those containers use are insulated from the rest of the
+Internet, and you don't have to worry about them clashing. Except, if
+they actually do clash with some addresses that you'd like the
+containers to talk to.
+
+### Some definitions
+
+- _IP_ is the Internet Protocol, the fundamental basis of network
+   communication between billions of connected devices.
+- The _IP address_ is (for most purposes) the four numbers separated
+  by dots, like `192.168.48.12`. Each number is one byte in size, so can
+  be between 0 and 255.
+- Each IP address lives on a _Network_, which is some set of those
+  addresses that all know how talk to each other. The network address
+  is some prefix of the IP address, like `192.168.48`. To show
+  which part of the address is the network, we append a slash
+  and then the number of bits in the network prefix, like
+  `/24`.
+- A _route_ is an instruction for how to deal with traffic destined
+  for somewhere else - it specifies a Network, and a way to talk to
+  that network.  Every device using IP has a table of routes, so for
+  any destination address it looks up that table, finds the right
+  route, and sends it in the direction indicated.
+
+### Examples
+
+In the IP address `10.4.2.6/8`, the network prefix is the first 8 bits
+- `10`. Written out in full, that network is `10.0.0.0/8`.
+
+The most common prefix lengths are 8, 16 and 24, but there is nothing
+stopping you using a /9 network or a /26. E.g. `6.250.3.1/9` is on the
+`6.128.0.0/9` network.
+
+Several websites offer calculators to decode this kind of address; for
+example [IP Address Guide](http://www.ipaddressguide.com/cidr).
+
+Here is an example route table for a container attached to the Weave
+network:
+
+````
+# ip route show
+default via 172.17.42.1 dev eth0 
+10.2.2.0/24 dev ethwe  proto kernel  scope link  src 10.2.2.1 
+172.17.0.0/16 dev eth0  proto kernel  scope link  src 172.17.0.170 
+````
+
+It has two interfaces: one that Docker gave it called `eth0`, and one
+that weave gave it called `ethwe`. They are on networks
+`172.17.0.0/16` and `10.2.2.0/24` respectively, and if you want to
+talk to any other address on those networks then the routing table
+tells it to send directly down that interface. If you want to talk to
+anything else not matching those rules, the default rule says to send
+it to `172.17.42.1` down the eth0 interface.
+
+So, suppose this container wants to talk to another container at
+address `10.2.2.9`; it will send down the ethwe interface and weave
+Net will take care of routing the traffic. To talk an external server
+at address `74.125.133.128`, it looks in its routing table, doesn't
+find a match, so uses the default rule.
+
+### Configuring Weave
+
+The default configurations for both weave Net and Docker use [Private
+Networks](https://en.wikipedia.org/wiki/Private_network), whose
+addresses are never found on the public internet, so that reduces the
+chances of overlap. But it could be that you or your hosting provider
+are using some of these private addresses in the same range, which would
+cause a clash.
+
+Here's an example: on `weave launch`, the following error message
+can appear:
+
+````
+Network 10.32.0.0/12 overlaps with existing route 10.0.0.0/8 on host.
+ERROR: Default --ipalloc-range 10.32.0.0/12 overlaps with existing route on host.
+You must pick another range and set it on all hosts.
+````
+
+As the message says, the default that weave Net would like to use is
+`10.32.0.0/12` - a 12-bit prefix so all addresses starting with the bit
+pattern 000010100010, or in decimal everything from 10.32.0.0 through
+10.47.255.255. But the user's host already has a route for `10.0.0.0/8`,
+which overlaps, because the first 8 bits are the same. If we went
+ahead and used the default network, then for an address like
+`10.32.5.6` the kernel would never be sure whether this meant the
+weave Net network of `10.32.0.0/12` or the hosting network of
+`10.0.0.0/8`.
+
+If you're sure the addresses you want are not really in use, then
+explicitly setting the range with `--ipalloc-range` in the
+command-line arguments to `weave launch` on all hosts will force Weave
+Net to use that range, even though it overlaps. Otherwise, you can
+pick a different range, preferrably another subset of the [Private
+Networks](https://en.wikipedia.org/wiki/Private_network).  For example
+172.30.0.0/16.

site/ipam.md

@@ -109,7 +109,8 @@ The range parameter is written in
 [CIDR notation](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) -
 in this example "/16" means the first 16 bits of the address form the
 network address and the allocator is to allocate container addresses
-that all start 10.2.
+that all start 10.2. We have [a page with more information on IP
+addresses and routes](ip-addresses.html).
 
 Weave shares the IP address range across all peers, dynamically
 according to their needs.  If a group of peers becomes isolated from

site/plugin.md

@@ -3,42 +3,35 @@ title: Using Weave Net via Docker Networking
 layout: default
 ---
 
-New in Docker version 1.9 is a plugin mechanism to add different
-network providers.
+# Weave Plugin
 
-To install, download the `weave` script as per the [readme][].
+Docker versions 1.9 and later have a plugin mechanism for adding
+different network providers. Weave installs itself as a network plugin
+when you start it with `weave launch`. To create a network that spans
+multiple docker hosts, the weave peers must be connected in the usual
+way, i.e. by specifying other hosts in `weave launch` or
+[`weave connect`](features.html#dynamic-topologies).
 
-The Weave Net plugin runs automatically when you `weave launch`.  You
-must still tell the weave peers to connect to one another, either via
-`weave launch` or `weave connect`.
-
-Note that the plugin container (`weaveplugin`) is run with
-`--restart=always`, so that it is there after a restart or reboot. If
-you remove this container (e.g. using `weave reset`) before removing
-all endpoints created using `--net=weave`, Docker can
-[hang](https://github.com/docker/libnetwork/issues/813).
-
-## Starting a container:
+Subsequently you can start containers with, e.g.
 
     $ docker run --net=weave -ti ubuntu
 
-## Using WeaveDNS for Service Discovery:
+on any of the hosts, and they can all communicate with each other.
 
-You need to pass the additional arguments `--dns` and `-dns-search`,
-for which we provide a helper in the weave script:
+In order to use Weave's [Service Discovery](weavedns.html), you
+need to pass the additional arguments `--dns` and `-dns-search`, for
+which we provide a helper in the weave script:
 
     $ docker run --net=weave -h foo.weave.local $(weave dns-args) -tdi ubuntu
     $ docker run --net=weave -h bar.weave.local $(weave dns-args) -ti ubuntu
     # ping foo
 
-For more details see the [Weave Service Discovery documentation][service-discovery].
-
 ## Under the hood
 
-The Weave Net plugin actually provides *two* network drivers to Docker
-- one named `weavemesh` that can operate without a [cluster
-store](#cluster-store) (like Docker's overlay driver) and one named
-`weave` that can only work with one.
+The Weave plugin actually provides *two* network drivers to Docker
+- one named `weavemesh` that can operate without a cluster store and
+one named `weave` that can only work with one (like Docker's overlay
+driver).
 
 ### `weavemesh` driver
 
@@ -46,6 +39,11 @@ store](#cluster-store) (like Docker's overlay driver) and one named
 * Supports only a single network (we create one named `weave` for you automatically)
 * Uses Weave's partition tolerant IPAM
 
+If you do create additional networks using the `weavemesh` driver,
+containers attached to them will be able to communicate with
+containers attached to `weave`; there is no isolation between those
+networks.
+
 ### `weave` driver
 
 * This runs in what Docker call "global scope"; requires a cluster store
@@ -53,10 +51,11 @@ store](#cluster-store) (like Docker's overlay driver) and one named
 * Used with Docker's cluster store based IPAM
 
 There's no specific documentation from Docker on using a cluster
-store, but the first part of [Getting Started with Docker Multi-host Networking][docker-net]
+store, but the first part of
+[Getting Started with Docker Multi-host Networking](https://github.com/docker/docker/blob/master/docs/userguide/networking/get-started-overlay.md)
 should point the way.
 
-Note that in the case of multiple docker networks, all containers are
+Note that in the case of multiple networks using the `weave` driver, all containers are
 on the same virtual network but Docker allocates their addresses on
 different subnets so they cannot talk to each other directly.
 
@@ -77,16 +76,23 @@ The plugin command-line arguments are:
  * `--no-multicast-route`: stop weave adding a static IP route for
    multicast traffic on its interface
 
+By default, multicast traffic will be routed over the weave network.
+To turn this off, e.g. because you want to configure your own multicast
+route, add the `--no-multicast-route` flag to `weave launch-plugin`.
+
 ## Restarting
 
-We start the plugin with a restart policy, because Docker attempts to
-recreate networks on startup.  If it isn't started automatically by
-Docker with a restart policy, it's not possible to start it manually
-because Docker is blocked.
+We start the plugin with a policy of `--restart=always`, so that it is
+there after a restart or reboot. If you remove this container
+(e.g. using `weave reset`) before removing all endpoints created using
+`--net=weave`, Docker may hang for a long time when it subsequently
+tries to talk to the plugin.
 
-Specifically, we use the policy `on-failure:3`, so Docker will give up
-after three attempts if something just isn't working.
+Unfortunately, [Docker 1.9 may also try to talk to the plugin before it has even started it](https://github.com/docker/libnetwork/issues/813).
+If using `systemd`, we advise that you modify the Docker unit to
+remove the timeout on startup, to give Docker enough time to abandon
+its attempts.
 
-[readme]: https://github.com/weaveworks/weave/blob/master/README.md#installation
-[service-discovery]: weavedns.html
-[docker-net]: https://github.com/docker/docker/blob/master/docs/userguide/networking/get-started-overlay.md
+E.g. in the file `/lib/systemd/system/docker.service`, add under `[Service]`:
+
+    TimeoutStartSec=0

site/proxy.md

@@ -115,6 +115,10 @@ will only include one of them.
 
     host1$ weave launch-router && weave launch-proxy --rewrite-inspect
 
+By default, multicast traffic will be routed over the weave network.
+To turn this off, e.g. because you want to configure your own multicast
+route, add the `--no-multicast-route` flag to `weave launch-proxy`.
+
 ## <a name="ipam"></a>Automatic IP address assignment
 
 If [automatic IP address assignment](ipam.html) is enabled in weave,

site/troubleshooting.md

@@ -5,14 +5,19 @@ layout: default
 
 # Troubleshooting Weave
 
- * [Overall status](#weave-status)
- * [List connections](#weave-status-connections)
- * [List peers](#weave-status-peers)
- * [List DNS entries](#weave-status-dns)
- * [JSON report](#weave-report)
- * [List attached containers](#list-attached-containers)
+ * [Basic diagnostics](#diagnostics)
+ * [Status reporting](#weave-status)
+   - [List connections](#weave-status-connections)
+   - [List peers](#weave-status-peers)
+   - [List DNS entries](#weave-status-dns)
+   - [JSON report](#weave-report)
+   - [List attached containers](#list-attached-containers)
+ * [Stopping weave](#stop)
+ * [Reboots](#reboots)
  * [Snapshot releases](#snapshots)
 
+## <a name="diagnostics"></a>Basic diagnostics
+
 Check what version of weave you are running with
 
     weave version
@@ -37,31 +42,7 @@ Another useful debugging technique is to attach standard packet
 capture and analysis tools, such as tcpdump and wireshark, to the
 `weave` network bridge on the host.
 
-To stop weave, if you have configured your environment to use the
-Weave Docker API Proxy, e.g. by running `eval $(weave env)` in your
-shell, you must first restore the environment with
-
-    eval $(weave env --restore)
-
-Then run
-
-    weave stop
-
-Note that this leaves the local application container network intact;
-containers on the local host can continue to communicate, whereas
-communication with containers on different hosts, as well as service
-export/import, is disrupted but resumes when weave is relaunched.
-
-To stop weave and completely remove all traces of the weave network on
-the local host, run
-
-    weave reset
-
-Any running application containers will permanently lose connectivity
-with the weave network and have to be restarted in order to
-re-connect.
-
-### <a name="weave-status"></a>Overall status
+## <a name="weave-status"></a>Status reporting
 
 A status summary can be obtained with `weave status`:
 
@@ -267,22 +248,48 @@ You can also supply a list of container IDs/names to `weave ps`, like this:
     able ce:15:34:a9:b5:6d 10.2.5.1/24
     baker 7a:61:a2:49:4b:91 10.2.8.3/24
 
-### Reboots
+## <a name="stop"></a>Stopping weave
+To stop weave, if you have configured your environment to use the
+Weave Docker API Proxy, e.g. by running `eval $(weave env)` in your
+shell, you must first restore the environment with
 
-When a host reboots, docker's default behaviour is to restart any
-containers that were running. Since weave relies on special network
-configuration outside of the containers, the weave network will not
-function in this state.
+    eval $(weave env --restore)
 
-To remedy this, stop and re-launch the weave container, and re-attach
-the application containers with `weave attach`.
+Then run
 
-For a more permanent solution,
-[disable Docker's auto-restart feature](https://docs.docker.com/articles/host_integration/)
-and create appropriate startup scripts to launch weave and run
-application containers from your favourite process manager.
+    weave stop
 
-### <a name="snapshots"></a>Snapshot Releases
+Note that this leaves the local application container network intact;
+containers on the local host can continue to communicate, whereas
+communication with containers on different hosts, as well as service
+export/import, is disrupted but resumes when weave is relaunched.
+
+To stop weave and completely remove all traces of the weave network on
+the local host, run
+
+    weave reset
+
+Any running application containers will permanently lose connectivity
+with the weave network and have to be restarted in order to
+re-connect.
+
+## <a name="reboots"></a>Reboots
+
+The router and proxy containers do not have Docker restart policies
+set, because the process of getting everything re-started and
+re-connected via restart policies is not entirely reliable. Until that
+changes, we recommend you create appropriate startup scripts to launch
+weave and run application containers from
+[your favourite process manager](systemd.html).
+
+If you are shutting down or restarting a host deliberately, run `weave
+reset` to clear everything down.
+
+The Weave Docker plugin does restart automatically because it must
+always start with Docker, as described in
+[its documentation](plugin.html).
+
+## <a name="snapshots"></a>Snapshot releases
 
 We sometimes publish snapshot releases, to provide previews of new
 features, assist in validation of bug fixes, etc. One can install the

site/weavedns.md

@@ -55,9 +55,8 @@ root@ubuntu:/# ping pingme
 > the hostname is not in the weaveDNS domain the container will *not*
 > be registered, but will still use weaveDNS for resolution.
 
-It is also possible to force or forbid an application container's use
-of weaveDNS with the `--with-dns` and `--without-dns` options to
-`weave run` and `weave launch-proxy`.
+To disable application containers' use of weaveDNS, add the
+`--without-dns` option to `weave run` or `weave launch-proxy`.
 
 ## <a name="how-it-works"></a>How it works
 
@@ -100,7 +99,7 @@ In the event that weaveDNS is launched in this way, it's important that
 other calls to `weave` also specify the bridge device:
 
 ```bash
-$ sudo DOCKER_BRIDGE=someother weave run --with-dns ...
+$ sudo DOCKER_BRIDGE=someother weave run ...
 ```
 
 ## <a name="load-balancing"></a>Load balancing

test/105_frag_2_test.sh

@@ -8,7 +8,8 @@ C2=10.2.1.71
 # 700 = Linux's minimum PMTU (552) + weave framing overheads
 # (currently about 60, but we leave some margin). That way the PMTUs
 # seen by containers is still >= 552.
-drop_large_udp_packets="FORWARD -p udp --destination-port 6783 -m length '!' --length 0:700 -j DROP"
+drop_large_sleeve_packets="INPUT -p udp --destination-port 6783 -m length '!' --length 0:700 -j DROP"
+drop_large_fastdp_packets="INPUT -p udp --destination-port 6784 -m length '!' --length 0:700 -j DROP"
 
 start_suite "PMTU discovery and packet fragmentation"
 
@@ -18,7 +19,8 @@ weave_on $HOST2 launch
 start_container $HOST1 $C1/24 --name=c1
 start_container $HOST2 $C2/24 --name=c2
 
-run_on $HOST2 "sudo iptables -I $drop_large_udp_packets"
+run_on $HOST1 "sudo iptables -I $drop_large_sleeve_packets"
+run_on $HOST1 "sudo iptables -I $drop_large_fastdp_packets"
 assert_raises "weave_on $HOST2 connect $HOST1"
 sleep 35 # give weave time to discover the PMTU
 
@@ -28,6 +30,7 @@ sleep 35 # give weave time to discover the PMTU
 exec_on $HOST2 c2 $PING -s 10000 $C1 1>/dev/null 2>&1 || true
 assert_raises "exec_on $HOST2 c2 $PING -s 10000 $C1"
 
-run_on $HOST2 "sudo iptables -D $drop_large_udp_packets"
+run_on $HOST1 "sudo iptables -D $drop_large_fastdp_packets"
+run_on $HOST1 "sudo iptables -D $drop_large_sleeve_packets"
 
 end_suite

test/610_proxy_wait_for_weave_test.sh

@@ -6,15 +6,26 @@ entrypoint() {
   docker_on $HOST1 inspect --format="{{.Config.Entrypoint}}" "$@"
 }
 
+check_iface_ready() {
+    assert_raises "proxy docker_on $HOST1 run -e 'WEAVE_CIDR=$1' $BASE_IMAGE $CHECK_ETHWE_UP"
+    assert_raises "proxy docker_on $HOST1 run -e 'WEAVE_CIDR=$1' $BASE_IMAGE ip -4 -o addr show ethwe | grep -q '$1'"
+}
+
 start_suite "Proxy waits for weave to be ready before running container commands"
-weave_on $HOST1 launch-proxy
+
 BASE_IMAGE=busybox
 # Ensure the base image does not exist, so that it will be pulled
 ! docker_on $HOST1 inspect --format=" " $BASE_IMAGE >/dev/null 2>&1 || docker_on $HOST1 rmi $BASE_IMAGE
 
-assert_raises "proxy docker_on $HOST1 run --name c1 -e 'WEAVE_CIDR=10.2.1.1/24' $BASE_IMAGE $CHECK_ETHWE_UP"
+# check that interface is ready, with and without --no-multicast-route
+weave_on $HOST1 launch-proxy --no-multicast-route
+check_iface_ready 10.2.1.1/24
+weave_on $HOST1 stop-proxy
+weave_on $HOST1 launch-proxy
+check_iface_ready 10.2.1.1/24
 
 # Check committed containers only have one weavewait prepended
+proxy_start_container $HOST1 --name c1 -e 'WEAVE_CIDR=10.2.1.1/24'
 COMMITTED_IMAGE=$(proxy docker_on $HOST1 commit c1)
 assert_raises "proxy docker_on $HOST1 run --name c2 $COMMITTED_IMAGE"
 assert "entrypoint c2" "$(entrypoint $COMMITTED_IMAGE)"

test/650_proxy_env_test.sh

@@ -30,7 +30,7 @@ check
 
 # Check we can use weave env/config with unix -Hs specified
 weave_on $HOST1 stop
-run_on $HOST1 "COVERAGE=$COVERAGE weave launch-proxy -H unix:///var/run/weave/weave.sock"
+weave_on $HOST1 launch-proxy -H unix:///var/run/weave/weave.sock
 assert_raises "run_on $HOST1 'eval \$(weave env) ; docker $CMD'"
 assert_raises "run_on $HOST1 'docker \$(weave config) $CMD'"
 

test/810_plugin_router_restart.sh

@@ -0,0 +1,24 @@
+#! /bin/bash
+
+. ./config.sh
+
+C1_NAME=c1.weave.local
+
+start_suite "Recovery of container details on router restart (via 'local' plugin)"
+
+weave_on $HOST1 launch
+start_container_local_plugin $HOST1 --name=c1 --hostname=$C1_NAME
+c1ip=$(container_ip $HOST1 c1)
+
+weave_on $HOST1 stop-router
+weave_on $HOST1 launch-router
+
+assert "container_ip $HOST1 c1" "$c1ip"
+assert "weave_on $HOST1 dns-lookup $C1_NAME" "$c1ip"
+
+# check that c1 IP has been reclaimed and doesn't get assigned to a
+# fresh container
+start_container $HOST1 --name=c2
+assert_raises "container_ip $HOST1 c2 | grep -v $c1ip"
+
+end_suite

test/config.sh

@@ -176,7 +176,7 @@ proxy_start_container_with_dns() {
 rm_containers() {
     host=$1
     shift
-    [ $# -eq 0 ] || docker_on $host rm -f "$@" >/dev/null
+    [ $# -eq 0 ] || docker_on $host rm -f -v "$@" >/dev/null
 }
 
 container_ip() {

weave

@@ -40,13 +40,11 @@ Usage:
 weave --help | help
 weave setup
 weave version
-weave launch        [--password <password>] [--nickname <nickname>]
+weave launch        <same arguments as 'weave launch-router'>
+weave launch-router [--password <password>] [--nickname <nickname>]
                       [--ipalloc-range <cidr> [--ipalloc-default-subnet <cidr>]]
                       [--no-discovery] [--init-peer-count <count>]
                       [--trusted-subnets <cidr>,...] <peer> ...
-weave launch-router [--password <password>] [--nickname <nickname>]
-                      [--ipalloc-range <cidr> [--ipalloc-default-subnet <cidr>]]
-                      [--no-discovery] [--init-peer-count <count>] <peer> ...
 weave launch-proxy  [-H <endpoint>] [--without-dns]
                       [--no-default-ipalloc] [--no-rewrite-hosts]
                       [--no-multicast-route]
@@ -95,25 +93,19 @@ usage() {
     exit 1
 }
 
-docker_sock() {
-  if [ -z "$DOCKER_HOST" ]; then
-    echo "/var/run/docker.sock"
-    return
-  fi
-  if echo "$DOCKER_HOST" | grep -q "^unix://" >/dev/null; then
-    echo "${DOCKER_HOST#unix://}"
-  fi
-}
-
-docker_sock_volume_mount() {
-  if [ -n "$(docker_sock)" ]; then
-    echo "-v $(docker_sock):$(docker_sock)"
-  fi
+docker_sock_options() {
+    # Pass through DOCKER_HOST if it is a Unix socket;
+    # a TCP socket may be secured by TLS, in which case we can't use it
+    if echo "$DOCKER_HOST" | grep -q "^unix://" >/dev/null; then
+        echo "-v ${DOCKER_HOST#unix://}:${DOCKER_HOST#unix://} -e DOCKER_HOST"
+    else
+        echo "-v /var/run/docker.sock:/var/run/docker.sock"
+    fi
 }
 
 exec_remote() {
     docker $DOCKER_CLIENT_ARGS run --rm --privileged --net=host \
-        $(docker_sock_volume_mount) \
+        $(docker_sock_options) \
         -v /proc:/hostproc \
         -e PROCFS=/hostproc \
         -e DOCKERHUB_USER="$DOCKERHUB_USER" \
@@ -128,12 +120,10 @@ exec_remote() {
         -e WEAVE_NO_FASTDP \
         -e WEAVE_NO_BRIDGED_FASTDP \
         -e WEAVE_NO_PLUGIN \
-        -e DOCKER_HOST \
         -e DOCKER_BRIDGE \
         -e DOCKER_CLIENT_HOST="$DOCKER_CLIENT_HOST" \
         -e DOCKER_CLIENT_ARGS \
         -e PROXY_HOST="$PROXY_HOST" \
-        -e WEAVE_CIDR=none \
         -e COVERAGE \
         $WEAVEEXEC_DOCKER_ARGS $EXEC_IMAGE --local "$@"
 }
@@ -174,7 +164,7 @@ check_docker_server_api_version() {
     # Cope with various versions of `docker version` output format
     if ! DOCKER_API_VERSION=$(docker version -f '{{.Server.APIVersion}}' 2> /dev/null ) ; then
         if ! DOCKER_API_VERSION=$(docker version -f '{{.Server.ApiVersion}}' 2> /dev/null ) ; then
-            if ! DOCKER_API_VERSION=$(docker version | sed -n -e 's|^Server API version: *\([0-9][0-9]*\.[0-9][0-9]\).*|\1|p') ; then
+            if ! DOCKER_API_VERSION=$(docker version | sed -n -e 's|^Server API version: *\([0-9][0-9]*\.[0-9][0-9]\).*|\1|p') || [ -z "$DOCKER_API_VERSION" ] ; then
                 echo "ERROR: Unable to determine docker version" >&2
                 exit 1
             fi
@@ -354,6 +344,7 @@ IMAGE=$BASE_IMAGE:$IMAGE_VERSION
 BASE_PLUGIN_IMAGE=$DOCKERHUB_USER/plugin
 PLUGIN_IMAGE=$BASE_PLUGIN_IMAGE:$IMAGE_VERSION
 PLUGIN_CONTAINER_NAME=weaveplugin
+VOLUMES_CONTAINER_NAME=weavevolumes-$IMAGE_VERSION
 
 PROCFS=${PROCFS:-/proc}
 DOCKER_BRIDGE=${DOCKER_BRIDGE:-docker0}
@@ -772,11 +763,11 @@ connect_container_to_bridge() {
     # veth pair in the 'up' or 'down' state.  Furthermore, moving one
     # end into a netns normally sets them to 'down'.  But, moving an
     # end into the default netns is a null operation, so they stay up,
-    # which leads to errors later on.  So to get a consistent result,
-    # we have to be explicit in setting them 'up' or 'down' as
-    # necessary.
+    # which leads to errors in 'set name' since that requires the
+    # interface to be down. So to get a consistent result, we set the
+    # interface 'down' to begin with.
     if ! netnsenter ip link set $GUEST_IFNAME down ||
-       ! netnsenter ip link set $GUEST_IFNAME name $1 up ||
+       ! netnsenter ip link set $GUEST_IFNAME name $1 ||
        ! ip link set $LOCAL_IFNAME up ||
        ! add_iface_$BRIDGE_TYPE $LOCAL_IFNAME ||
        ! configure_arp_cache $1 "netnsenter" ; then
@@ -843,8 +834,12 @@ setup_router_iface_bridged_fastdp() {
     setup_router_iface_fastdp "$@"
 }
 
+container_in_host_ns() {
+    [ -h "$PROCFS/$CONTAINER_PID/ns/net" -a -h "/proc/self/ns/net" -a "$(readlink $PROCFS/$CONTAINER_PID/ns/net)" = "$(readlink /proc/self/ns/net)" ]
+}
+
 attach() {
-    if [ -h "$PROCFS/$CONTAINER_PID/ns/net" -a -h "/proc/self/ns/net" -a "$(readlink $PROCFS/$CONTAINER_PID/ns/net)" = "$(readlink /proc/self/ns/net)" ] ; then
+    if container_in_host_ns ; then
         echo "Container is running in the host network namespace, and therefore cannot be" >&2
         echo "connected to weave. Perhaps the container was started with --net=host." >&2
         return 1
@@ -905,38 +900,36 @@ detach() {
     netnsenter ip link del $CONTAINER_IFNAME type veth
 }
 
-container_weave_addrs() {
-    netnsenter ip addr show dev $CONTAINER_IFNAME
+container_ip_addr_show() {
+    ! container_in_host_ns && netnsenter ip addr show
 }
 
 ######################################################################
 # functions for interacting with containers
 ######################################################################
 
-# Check that a container named $1 with image $2 is not running
+# Check that a container for component $1 named $2 with image $3 is not running
 check_not_running() {
-    case $(docker inspect --format='{{.State.Running}} {{.Config.Image}}' $1 2>/dev/null) in
-        "true $2")
-            echo "$1 is already running." >&2
-            exit 1
+    RUN_STATUS=$(docker inspect --format='{{.State.Running}} {{.State.Status}} {{.Config.Image}}' $2 2>/dev/null) || true
+    case ${RUN_STATUS%:*} in
+        "true restarting $3")
+            echo "$2 is restarting; you can stop it with 'weave stop-$1'." >&2
+            return 3
             ;;
-        "true $2:"*)
-            echo "$1 is already running." >&2
-            exit 1
+        "true "*" $3")
+            echo "$2 is already running; you can stop it with 'weave stop-$1'." >&2
+            return 1
             ;;
-        "false $2")
-            docker rm $1 >/dev/null
-            ;;
-        "false $2:"*)
-            docker rm $1 >/dev/null
+        "false "*" $3")
+            docker rm $2 >/dev/null
             ;;
         true*)
-            echo "Found another running container named '$1'. Aborting." >&2
-            exit 1
+            echo "Found another running container named '$2'. Aborting." >&2
+            return 2
             ;;
         false*)
-            echo "Found another container named '$1'. Aborting." >&2
-            exit 1
+            echo "Found another container named '$2'. Aborting." >&2
+            return 2
             ;;
     esac
 }
@@ -1039,6 +1032,17 @@ wait_for_status() {
     done
 }
 
+# Parse the output of `ip addr show`, outputing weave addresses of kind $1
+addrs_from_ip_addr_show() {
+    while read first second rest ; do
+        if [ "$first" != "${first%:}" ] ; then
+            iname="${second%:}"
+        elif [ "$first" = "$1" -a \( "$iname" = "weave" -o "$iname" != "${iname#ethwe}" \) ] ; then
+            echo $second
+        fi
+    done
+}
+
 # Call $1 for all containers, passing container ID, all MACs and all IPs
 with_container_addresses() {
     COMMAND=$1
@@ -1047,12 +1051,14 @@ with_container_addresses() {
         if [ "$CONTAINER_ID" = "weave:expose" ] ; then
             ADDRS_CMD="ip addr show dev $BRIDGE"
         else
-            ADDRS_CMD="with_container_netns $CONTAINER_ID container_weave_addrs"
+            ADDRS_CMD="with_container_netns $CONTAINER_ID container_ip_addr_show"
         fi
         if CONTAINER_ADDRS=$($ADDRS_CMD 2>/dev/null) ; then
-            CONTAINER_MAC=$(echo "$CONTAINER_ADDRS" | grep -o 'link/ether .*' | cut -d ' ' -f 2)
-            CONTAINER_IPS=$(echo "$CONTAINER_ADDRS" | grep -o 'inet .*'       | cut -d ' ' -f 2)
-            $COMMAND "$CONTAINER_ID" "$CONTAINER_MAC" "$CONTAINER_IPS"
+            CONTAINER_MAC=$(echo "$CONTAINER_ADDRS" | addrs_from_ip_addr_show 'link/ether')
+            CONTAINER_IPS=$(echo "$CONTAINER_ADDRS" | addrs_from_ip_addr_show 'inet')
+            if [ -n "$CONTAINER_MAC$CONTAINER_IPS" ] ; then
+                $COMMAND "$CONTAINER_ID" "$CONTAINER_MAC" "$CONTAINER_IPS"
+            fi
         fi
     done
 }
@@ -1181,7 +1187,7 @@ rewrite_etc_hosts() {
     CONTENTS="$(etc_hosts_contents $FQDN "$@")"
     # rewrite /etc/hosts, unlinking the file (so Docker does not modify it again) but
     # leaving it with valid contents...
-    docker run --rm --net=none --privileged \
+    docker run --rm --net=none -e WEAVE_CIDR=none --privileged \
         -v $CONTAINERS_PATH:$MNT \
         --entrypoint=sh \
         $EXEC_IMAGE -c "echo '$CONTENTS' > $MNT_HOSTS && rm -f $MNT_HOSTS && echo '$CONTENTS' > $MNT_HOSTS"
@@ -1290,7 +1296,7 @@ collect_dns_add_remove_args() {
 # with_container_addresses.
 ipam_reclaim() {
     for CIDR in $3 ; do
-        # NB: CONTAINER_IP is the IP of the weave container; it is set by wait_for_status.
+        # NB: CONTAINER_IP is the IP of the weave container.
         http_call $CONTAINER_IP:$HTTP_PORT PUT /ip/$1/${CIDR%/*}?noErrorOnUnknown=true
     done
 }
@@ -1466,11 +1472,13 @@ proxy_args() {
     PROXY_HOST=""
     proxy_parse_args "$@"
 
-    if [ -z "$PROXY_TLS_ENABLED" ] ; then
-      if [ -z "$PROXY_TLS_DETECTION_DISABLED" ] && ! proxy_parse_args $(docker_tls_args) ; then
-        echo "Unable to auto-detect TLS configuration, --no-detect-tls or TLS options are required." >&2
-        exit 1
-      fi
+    if [ -z "$PROXY_TLS_ENABLED" -a -z "$PROXY_TLS_DETECTION_DISABLED" ] && command_exists docker_tls_args ; then
+        if ! DOCKER_TLS_ARGS=$(docker_tls_args) ; then
+            echo "Unable to auto-detect proxy TLS configuration; you must launch the proxy with" >&2
+            echo "'weave launch-proxy' and supply '--no-detect-tls' or TLS options." >&2
+            exit 1
+        fi
+        proxy_parse_args $DOCKER_TLS_ARGS
     fi
     if [ -z "$PROXY_HOST" ] ; then
       case "$DOCKER_CLIENT_HOST" in
@@ -1486,7 +1494,7 @@ proxy_args() {
 }
 
 proxy_addrs() {
-    if addr="$(http_call_unix $PROXY_CONTAINER_NAME status.sock GET /status 2>&1)" ; then
+    if addr="$(http_call_unix $PROXY_CONTAINER_NAME status.sock GET /status 2>/dev/null)" ; then
       echo "$addr" | sed "s/0.0.0.0/$PROXY_HOST/g"
 
     else
@@ -1604,14 +1612,14 @@ launch_router() {
     if [ -z "$IPRANGE_SPECIFIED" ] ; then
         IPRANGE="10.32.0.0/12"
         if command_exists netcheck && ! netcheck --ignore-iface=$BRIDGE $IPRANGE ; then
-                echo "ERROR: Default --ipalloc-range $IPRANGE overlaps with existing route on host." >&2
-                echo "You must pick another range and set it on all hosts." >&2
+            echo "ERROR: Default --ipalloc-range $IPRANGE overlaps with existing route on host." >&2
+            echo "You must pick another range and set it on all hosts." >&2
             exit 1
-            fi
-        else
-            if [ -n "$IPRANGE" ] && command_exists netcheck && ! netcheck --ignore-iface=$BRIDGE $IPRANGE ; then
-                echo "WARNING: Specified --ipalloc-range $IPRANGE overlaps with existing route on host." >&2
-                echo "Unless this is deliberate, you must pick another range and set it on all hosts." >&2
+        fi
+    else
+        if [ -n "$IPRANGE" ] && command_exists netcheck && ! netcheck --ignore-iface=$BRIDGE $IPRANGE ; then
+            echo "WARNING: Specified --ipalloc-range $IPRANGE overlaps with existing route on host." >&2
+            echo "Unless this is deliberate, you must pick another range and set it on all hosts." >&2
         fi
     fi
 
@@ -1624,10 +1632,9 @@ launch_router() {
     # additional parameters, such as resource limits, to docker
     # when launching the weave container.
     ROUTER_CONTAINER=$(docker run --privileged -d --name=$CONTAINER_NAME \
-        $(docker_sock_volume_mount) \
+        $(docker_sock_options) \
         -p $PORT:$CONTAINER_PORT/tcp -p $PORT:$CONTAINER_PORT/udp \
         ${NETHOST_OPT:-$DNS_PORT_MAPPING} \
-        -e DOCKER_HOST \
         -e WEAVE_PASSWORD \
         -e WEAVE_CIDR=none \
         $WEAVE_DOCKER_ARGS $IMAGE $COVERAGE_ARGS \
@@ -1661,7 +1668,7 @@ attach_router() {
     if [ -z "$NO_DNS_OPT" ] ; then
         # Tell the newly-started weaveDNS about existing weave IPs
         for CONTAINER in $(docker ps -q --no-trunc) ; do
-            if CONTAINER_IPS=$(with_container_netns $CONTAINER container_weave_addrs 2>&1 | sed -n -e 's/inet \([^/]*\)\/\(.*\)/\1/p') ; then
+            if CONTAINER_IPS=$(with_container_netns $CONTAINER container_ip_addr_show 2>/dev/null | addrs_from_ip_addr_show 'inet') && [ -n "$CONTAINER_IPS" ] ; then
                 with_container_fqdn $CONTAINER put_dns_fqdn $CONTAINER_IPS
             fi
         done
@@ -1680,14 +1687,18 @@ launch_proxy() {
     docker_client_args $DOCKER_CLIENT_ARGS
     proxy_args "$@"
     mkdir -p /var/run/weave
+    # Create a data-only container to mount the weavewait files from
+    if ! docker inspect -f ' ' $VOLUMES_CONTAINER_NAME > /dev/null 2>&1 ; then
+       docker create -v /w -v /w-noop -v /w-nomcast --name=$VOLUMES_CONTAINER_NAME \
+           --label=weavevolumes --entrypoint=/bin/false $EXEC_IMAGE >/dev/null
+    fi
     PROXY_CONTAINER=$(docker run --privileged -d --name=$PROXY_CONTAINER_NAME --net=host \
         $PROXY_VOLUMES \
-        $(docker_sock_volume_mount) \
+        --volumes-from $VOLUMES_CONTAINER_NAME \
+        $(docker_sock_options) \
         -v /var/run/weave:/var/run/weave \
         -v /proc:/hostproc \
         -e PROCFS=/hostproc \
-        -e WEAVE_CIDR=none \
-        -e DOCKER_HOST \
         -e DOCKER_BRIDGE \
         -e WEAVE_DEBUG \
         -e COVERAGE \
@@ -1702,24 +1713,38 @@ stop_proxy() {
     stop $PROXY_CONTAINER_NAME "Proxy"
 }
 
-launch_plugin() {
+launch_plugin_if_not_running() {
+    retval=0
+    check_not_running plugin $PLUGIN_CONTAINER_NAME $BASE_PLUGIN_IMAGE || retval=$?
+    # If an existing plugin is running (we start it with restart=always), return its ID
+    [ $retval = 1 ] && PLUGIN_CONTAINER=$(container_id $PLUGIN_CONTAINER_NAME) && return 0
+    # Any other kind of error code from check_not_running is a failure.
+    [ $retval -gt 0 ] && return $retval
+
     PLUGIN_CONTAINER=$(docker run --privileged -d --name=$PLUGIN_CONTAINER_NAME \
         --restart=always \
         --net=host \
-        $(docker_sock_volume_mount) \
+        $(docker_sock_options) \
         -v /run/docker/plugins:/run/docker/plugins \
-        -e DOCKER_HOST \
         $PLUGIN_IMAGE "$@")
 }
 
+plugin_disabled() {
+    [ -n "$WEAVE_NO_PLUGIN" ] || ! check_docker_server_api_version 1.21
+}
+
 remove_plugin_network() {
     docker run --rm --net=host \
         -v /var/run/docker.sock:/var/run/docker.sock \
         $PLUGIN_IMAGE --remove-network
 }
 
+warn_plugin_active() {
+    echo "WARNING: docker may hang in this state; re-launch weave and remove attached containers before shutting down" >&2
+}
+
 stop_plugin() {
-    remove_plugin_network
+    remove_plugin_network || warn_plugin_active
     stop $PLUGIN_CONTAINER_NAME "Plugin"
 }
 
@@ -1810,6 +1835,9 @@ deprecation_warnings() {
             -no-default-ipam|--no-default-ipam)
                 deprecation_warning $1 "--no-default-ipalloc"
                 ;;
+            --with-dns)
+                echo "Warning: $1 has been removed; DNS is on by default" >&2
+                ;;
         esac
         shift
     done
@@ -1829,6 +1857,7 @@ case "$COMMAND" in
         [ $# -eq 0 ] || usage
         ask_version $CONTAINER_NAME $IMAGE || true
         ask_version $PROXY_CONTAINER_NAME $EXEC_IMAGE --entrypoint=/home/weave/weaveproxy || true
+        ask_version $PLUGIN_CONTAINER_NAME $PLUGIN_IMAGE || true
         ;;
     # intentionally undocumented since it assumes knowledge of weave
     # internals
@@ -1850,19 +1879,17 @@ EOF
         ;;
     launch)
         deprecation_warnings "$@"
-        check_not_running $CONTAINER_NAME       $BASE_IMAGE
-        check_not_running $PROXY_CONTAINER_NAME $BASE_EXEC_IMAGE
+        check_not_running router $CONTAINER_NAME        $BASE_IMAGE
+        check_not_running proxy  $PROXY_CONTAINER_NAME  $BASE_EXEC_IMAGE
+        # Don't check the plugin here, since we start it with `--restart=always`
         COMMON_ARGS=$(common_launch_args "$@")
         launch_router "$@"
         launch_proxy  $COMMON_ARGS
-        if [ -z $WEAVE_NO_PLUGIN ] && check_docker_server_api_version 1.21 ; then
-            check_not_running $PLUGIN_CONTAINER_NAME $BASE_PLUGIN_IMAGE
-            launch_plugin $COMMON_ARGS
-        fi
+        plugin_disabled || launch_plugin_if_not_running $COMMON_ARGS
         ;;
     launch-router)
         deprecation_warnings "$@"
-        check_not_running $CONTAINER_NAME $BASE_IMAGE
+        check_not_running router $CONTAINER_NAME $BASE_IMAGE
         launch_router "$@"
         echo $ROUTER_CONTAINER
         ;;
@@ -1876,19 +1903,19 @@ EOF
         ;;
     launch-proxy)
         deprecation_warnings "$@"
-        check_not_running $PROXY_CONTAINER_NAME $BASE_EXEC_IMAGE
+        check_not_running proxy $PROXY_CONTAINER_NAME $BASE_EXEC_IMAGE
         launch_proxy "$@"
         echo $PROXY_CONTAINER
         ;;
     launch-plugin)
-        check_not_running $PLUGIN_CONTAINER_NAME $BASE_PLUGIN_IMAGE
-        launch_plugin "$@"
+        launch_plugin_if_not_running "$@"
         echo $PLUGIN_CONTAINER
         ;;
     env|proxy-env)
         [ "$COMMAND" = "env" ] || deprecation_warning "$COMMAND" "'weave env'"
         if PROXY_ADDR=$(proxy_addr) ; then
-            echo "export DOCKER_HOST=$PROXY_ADDR ORIG_DOCKER_HOST=$DOCKER_CLIENT_HOST"
+            [ "$PROXY_ADDR" = "$DOCKER_CLIENT_HOST" ] || RESTORE="ORIG_DOCKER_HOST=$DOCKER_CLIENT_HOST"
+            echo "export DOCKER_HOST=$PROXY_ADDR $RESTORE"
         fi
         ;;
     config|proxy-config)
@@ -2135,7 +2162,7 @@ EOF
         ;;
     stop)
         [ $# -eq 0 ] || usage
-        stop_plugin
+        plugin_disabled || stop_plugin
         stop_router
         stop_proxy
         ;;
@@ -2153,13 +2180,15 @@ EOF
         ;;
     reset)
         [ $# -eq 0 ] || usage
-        remove_plugin_network || echo "WARNING: docker may hang in this state; re-launch weave and remove attached containers before shutting down" >&2
+        plugin_disabled || remove_plugin_network || warn_plugin_active
         warn_if_stopping_proxy_in_env
         call_weave DELETE /peer >/dev/null 2>&1 || true
         for NAME in $PLUGIN_CONTAINER_NAME $CONTAINER_NAME $PROXY_CONTAINER_NAME ; do
             docker stop  $NAME >/dev/null 2>&1 || true
             docker rm -f $NAME >/dev/null 2>&1 || true
         done
+        VOLUME_CONTAINERS=$(docker ps -qa --filter label=weavevolumes)
+        [ -n "$VOLUME_CONTAINERS" ] && docker rm -v $VOLUME_CONTAINERS  >/dev/null 2>&1 || true
         conntrack -D -p udp --dport $PORT >/dev/null 2>&1 || true
         destroy_bridge
         for LOCAL_IFNAME in $(ip link show | grep v${CONTAINER_IFNAME}pl | cut -d ' ' -f 2 | tr -d ':') ; do