yes, the code is as follows in the broken veth: if (skb->ip_summed == CHECKSUM_NONE && rcv->features & NETIF_F_RXCSUM) checksum offloading is encapsulated in

yes, the code is as follows in the broken veth: if (skb->ip_summed == CHECKSUM_NONE && rcv->features & NETIF_F_RXCSUM) checksum offloading is encapsulated in the rcv-features bitmap, so disabling it will hide this bug. You can do something like this within your container to disable it (from memory, might be slightly off): $ ethtool --offload VETH_DEVICE_NAME rx off tx off $ ethtool -K VETH_DEVICE_NAME gso off