Container networking is simple (2020)
iximiuz.com
Container networking is simple (2020)
1–10 of 68 posts
Re: Container networking is simple (2020)
#2You can have a lot of fun with network namespaces in Linux, like running some programs in their own network/VPN.
Re: Container networking is simple (2020)
#3> Working with containers always feels like magic.
Containers are just application - which existed for many decades - in a single-process (roughly) operating system. Like MS DOS.
Nothing magical except containerized processes can't talk to each other directly - there are security boundaries.
Re: Container networking is simple (2020)
#4It is if you use:
--net=hostRe: Container networking is simple (2020)
#5> Working with containers always feels like magic. Containers are just application - which existed for many decades - in a single-process (roughly) operating system. Like MS DOS. Nothing magical except containerized processes can't talk to each other directly - there are security boundaries.
> in a single-process (roughly) operating system.
Containers don't (generally) run in their own operating system, just their own userland. It can actually be a source of security vulnerabilities to assume that containers are completely isolated from each other, such as running a root user container in production, assuming it can't get privileged access to the host. It's less similar to a bare-metal MS DOS application than it is a glorified chroot jail
Re: Container networking is simple (2020)
#6Indeed... VIMAGE and Crossbow are such great technologies for virtualizing container network stacks. Couldn't imagine life without them anymore.
Re: Container networking is simple (2020)
#7This blog post reminded me of the post [1] I wrote about 7 years ago o_O
Re: Container networking is simple (2020)
#8This blog post reminded me of the post [1] I wrote about 7 years ago o_O [1] https://cybernetist.com/2013/11/19/lxc-networking/
A lot of discussion around Docker in general is rehashing stuff that lxc did a long time ago, so this fits the mold.
Re: Container networking is simple (2020)
#9> Working with containers always feels like magic. Containers are just application - which existed for many decades - in a single-process (roughly) operating system. Like MS DOS. Nothing magical except containerized processes can't talk to each other directly - there are security boundaries.
> in a single-process (roughly) operating system. Containers don't (generally) run in their own operating system, just their own userland. It can actually be a source of security vulnerabilities to assume that containers are completely isolated from each other, such as running a root user container in production, assuming it can't get privileged access to the host. It's less similar to a bare-metal MS DOS application…
> Containers don't (generally) run in their own operating system
Right, but containerized application can't (ideally) talk to other applications on the same machine, that's how it's similar to a single-process OS with a single app running. Of course there are details like a single application may still contain multiple processes from OS standpoint, but the overall comparison stands.
> It's less similar to a bare-metal MS DOS application than it is a glorified chroot jail
These two cases are similar enough from containerized application standpoint (only OS services are different than those of MS DOS).
Re: Container networking is simple (2020)
#10Brilliant write up. Lots of this topic is so much easier to understand when it’s presented from first principles, without any of the LXC or Docker helpfulness hiding the details.
(If the author is reading, thank you! I’ll likely use this material for the pupils in my computer club.)
Managing an IPv6 stack alongside IPv4 is also very informative. IPv6 is still not widely deployed — SMTP is likely tied to v4 for all eternity — but it’s incredibly useful for managing multiple sites of inventory over the internet. Seeing RFC1918 style 10.x.y.z private addresses and IPAM in use by internal ops and IT in 2021 brings tears to my eyes.
Adding a section on using conntrack to watch the way in which the kernel handles MASQUERADE and DNAT would be illustrative as well.
I really like the diagrams too.