Single Host Docker Networking

Single-Host Networking
@ Docker Barcelona
By Jeff Nickoloff

Who Am I?
 Jeff Nickoloff, author of Docker in Action
 On Twitter and Medium: @allingeek
 Engineer and a manager
 Formerly with Amazon.com
 Loves micro-services, API contracts, distributed systems, and
thinking about failure modes.

Our Topic in Brief
 Network Container Archetypes, Devices, and Topology
 Closed
 Bridged
 Joined
 Open
 NET Namespace and ICC
 Service Discovery
 DNS
 Container Linking

Network Container Archetypes
Controlled by the --net flag

Closed Containers
 --net none
 No Virtual Ethernet Interface
 No inbound network communication
 No outbound network communication
 Virtual Loopback Interface
 All processes in the same closed
container can communicate with each
other.

Bridged Containers
 [default] --net bridge
 Virtual Loopback Interface
 All processes in the same closed
container can communicate with each
other.
 Virtual Ethernet Interface!
 (really two interfaces)
 Bound to the bridge network (docker0)
 Bidirectional network access
 Customize:
 DNS, MAC

An Aside: docker0
 Creates a network where all bridged containers are bound
 Bridges the container network with the host’s network
 What can you change about the bridge?
 --bip
 -b

Joined Containers
 --net container:<container name|id>
 Create a new container reusing the
devices and namespace of an existing
container.
 A container could join a closed or
bridged container.
 Each container maintains other
isolation mechanisms.
 Uses:
 IP(C)C on loopback
 Kernel Tuning
 Monitoring

Open Containers
 --net host
 No private devices
 No read only copy of network related /proc and /sys
 Direct access to host network resources
 This includes virtual network devices for other containers
 Access to modify network related Kernel settings
 It is as though you are not running in a container at all

Routing Inbound Traffic
 Containers with a virtual Ethernet device (bridged) can bind
to ports on that interface.
 Forwarding rules created at container creation time
 -p=[], --publish=[]
 ip:hostPort:containerPort
 ip::containerPort
 hostPort:containerPort
 containerPort
 -P, --publish-all
 Rules based on the “exposed” ports (image metadata and --expose)

NET Namespace
 Closed and Bridged containers each have their own kernel
network namespace
 Joined containers reuse an existing namespace
 Open containers have no network namespace (or operate in
the host’s namespace)
 This is important to remember if you wanted to tune your
Kernel from a container (container only deployments)

Inter-Container Communication
 By default inter-container network communication is wide
open on the bridge network.
 Any bridged container can reach any port on any container.
Unless...
 You can disable ICC on the command line when you start the
docker daemon with “--icc=false”
 It will create a DENY rule for all container to container traffic
 See also: https://medium.com/on-docker
 Exploring Local Docker Bridge Networks
 Safer Local Docker Networks
 What if I want to communicate between containers?

Container Linking
 --link <container name|id>:<link alias>
 Links describe one-way dependencies
 Enable two-way communication if ICC is disabled
 ALLOW rules on dependency for exposed ports (--expose)
 Weave address information in on named environment
variables and hosts
 Created at container creation time
 Not updated with dependency termination / restarts (yet)

DNS
 Links create hosts entries
 Add one or more hosts entries at container creation time
 --add-host=[]
 Set DNS servers per container or as a default
 --dns=[]
 Set DNS Search Domains per container or as a default
 --dns-search=[]

Questions and Follow Up
 My articles on Docker – https://medium.com/on-docker
 Docker in Action – http://manning.com/nickoloff

Single Host Docker Networking

More Related Content

What's hot (19)

Viewers also liked (19)

Similar to Single Host Docker Networking (20)

More from allingeek (6)

Recently uploaded (20)

Single Host Docker Networking