Michael Maddern

I think you are correct that the checksum offloading causes the initial zeroed out checksum. But when you capture the traffic on the interface inside the container, hasn't a DNAT...

Sorry for the confusion, I'm referring to when you publish a port, Docker Desktop creates a NAT rule. Start a container with a published port: ``` docker run -p 19080:19080...

I don't want to over complicate this issue though. The problem is that any NAT rules inside the container will result in invalid tcp checksums for traffic from published ports...

Yes, if I update the network type in docker desktop to use vpnkit instead, this bug doesn't happen, the checksums are recalculated correctly. But when it's using gvisor the checksums...

I've also been seeing this problem for months, and annoyingly didn't find this bug report until now. My MacBook would ask me to install XCode developer tools to install git...