dockurr/chrony as a container doesnt work as expected when host are using VRFs

[Apachez-]

I am currently using dockurr/chrony version 4.8 as a container in VyOS stream 2026.03 (who currently uses Podman 4.9.5).

After some troubleshooting (I am using allow-host-networks) it turns out that TCP-traffic will work out of the box when the host are using VRFs but not UDP-traffic

For UDP the process must bind to interface (or VRF name, seen by ip a or ifconfig -a at the host).

Can be verified by at the host run something like ss -atulpn.

When successfully binded the listenadress will look something like:

192.0.2.1%PROD:123

Workaround in dockurr/chrony is to utilize the NTP_DIRECTIVES environment variable like so:

set container name ntp environment NTP_DIRECTIVES value 'ratelimit\nrtcsync\nbindacqdevice MGMT\nbinddevice PROD'

The above workaround will also work when using ethX instead of MGMT/PROD.

For the above dockurr/chrony will fetch time using vrf MGT and share time using vrf PROD.

It would however be handy if VRF support could be made available as environment variables on its own?

Something like:

• NTP_SERVERS_VRF: , default empty - used by chrony when fetching time from NTP-servers. Will only work if 'host-networks' is enabled.
• NTP_CLIENTS_VRF: , default empty - used by chrony when sharing time to NTP-clients. Will only work if 'host-networks' is enabled.

Ref:

https://chrony-project.org/doc/latest/chrony.conf.html

binddevice interface

The binddevice directive binds the NTP and NTS-KE server sockets to a network device specified by the interface name. This directive can specify only one interface and it is supported on Linux only.

An example of the directive is:

binddevice eth0

and:

bindacqdevice interface

The bindacqdevice directive binds the client sockets to a network device specified by the interface name. This can be useful when the local address is dynamic, or to enable an NTP source specified with a link-local IPv6 address. This directive can specify only one interface and it is supported on Linux only.

An example of the directive is:

bindacqdevice eth0

There is also this variable but this doesnt need to get changed (since chronyc normally connects to 127.0.0.1 anyway):

bindcmddevice interface

The bindcmddevice directive binds the UDP command sockets to a network device specified by the interface name. This directive can specify only one interface and it is supported on Linux only.

An example of the directive is:

bindcmddevice eth0