When using Docker on a host that has an IPv6 subnet available, it won't be used by default (as of 2025). This means on an IPv6-only host, there is no networking to the internet from inside a container. Here's how to fix this.

Using NAT

Yes, we will be using NAT for Ipv6. I know, it's not pretty, but it works on any IPv6 host, regardless of if they have a subnet or not, and it's simple.

Now we need to tell Docker about it, for this use your favourite editor like vim or nano and edit/create the file /etc/docker/daemon.json like this:

{
  "ipv6": true,
  "fixed-cidr-v6": "fd00::/64"
}

Now restart docker with systemctl restart docker and this assigns an IPv6 ULA address, meaning a local but probably still unique IP address. This is fine 🔥.

NLastly enter the following command (with root perms) to set up your system's networking stack to NAT this range, which is the thing that actually allows your containers to communicate with the internet:

$ ip6tables -t nat -A POSTROUTING -s fd00::/64 -j MASQUERADE

Lastly, we want this rule to be permanent. Right now it will be reset once the system restarts. To save it you will need different commands depending on your distro and if they use iptables. Be sure to search for something like "How to save iptables for IPv6 on <your_distro>".

On Debian, you can install iptables-persistent and then either select yes in the installation dialog or using this command:

ip6tables-save > /etc/iptables/rules.v6

Using your Subnet

Pretty much all VPS/VM providers throw a /64 at you. This means you own a ton of addresses (literally, these are 2^64 addresses, so 18,446,744,073,709,551,616 in total). So yes, you can use these to give each container their own true, globally unique IPv6 address.

How? idk, this isn't a finished guide. You will need to enter your subnet like above into the deamon.json and that will actually delegate addresses, but I am still missing something. I really don't know IPv6 that well, so my journey ended right here (after a couple annoying hours of debugging).