This is the first article i see on HN with (2020) in parens to show that it's a dated article
=\
Container networking is simple (2020)
11–20 of 68 posts
Re: Container networking is simple (2020)
#12This is...not simple. I agree that container networking is not all that much different from other Linux networking, but that doesn't make it simple. A lot of application developers are switching to working with containers and haven't historically had to do any manual network configuration. It's all new to them. Linux networking conventions change every few years and simplying keeping up with the basics is a chore. netplan is the current flavor of the week but it's still new to plenty of people who've never had to worry about anything more than auto-configured DHCP or cloud-provider-default VPS networking.
There are also important security considerations with container networking. Docker, by default, punches massive holes through your firewall in non-obvious ways. People don't realize that with a default Docker configuration, containers are ignoring any normal firewall rules you may have setup with iptables or ufw. Locking that down is only easy if you already know iptables well, and even if you do, managing it is a pain.
The article doesn't touch on Kubernetes, but that's a whole other can of worms. You have to pick a CNI and manually configure it; DNS doesn't just magically work; default CIDR allocations often conflict with existing networks; load balancer ingress for a development/single-host/non-cloud environment is a horror show.
This is a good and helpful article, but container networking is not simple by any stretch.
Re: Container networking is simple (2020)
#13This is...not simple. I agree that container networking is not all that much different from other Linux networking, but that doesn't make it simple. A lot of application developers are switching to working with containers and haven't historically had to do any manual network configuration. It's all new to them. Linux networking conventions change every few years and simplying keeping up with the basics is a chore. ne…
I hope k8s (or some managed subset) eventually provides a stable networking abstraction. There is so much to consider when it comes to network hardening and I'd like it to not have to constantly stress about it, feeling like I don't know enough.
Re: Container networking is simple (2020)
#14This is...not simple. I agree that container networking is not all that much different from other Linux networking, but that doesn't make it simple. A lot of application developers are switching to working with containers and haven't historically had to do any manual network configuration. It's all new to them. Linux networking conventions change every few years and simplying keeping up with the basics is a chore. ne…
I think it’s time for us to get past “X is simple” or “X is easy.” It’s a highly subjective thing to say, no matter the topic. It’s never helpful, it just makes other people feel bad.
Re: Container networking is simple (2020)
#15This is...not simple. I agree that container networking is not all that much different from other Linux networking, but that doesn't make it simple. A lot of application developers are switching to working with containers and haven't historically had to do any manual network configuration. It's all new to them. Linux networking conventions change every few years and simplying keeping up with the basics is a chore. ne…
> netplan is the current flavor of the week
... for Ubuntu, and Ubuntu only. It is an invention of Canonical not adopted by the rest of Linux distros (except Ubuntu derivatives), generally speaking.
Re: Container networking is simple (2020)
#16It is if you use: --net=host
Which defeats the purpose of containerization because now the container can sniff traffic on the host, hijack TCP connections, etc.
Re: Container networking is simple (2020)
#17It is if you use: --net=host
Which defeats the purpose of containerization because now the container can sniff traffic on the host, hijack TCP connections, etc.
I know many people use single tenant hardware to run containers, so I wouldn’t say that it defeats the purpose of containerization, just one of the benefits.
Re: Container networking is simple (2020)
#18Earlier quoted context omitted.
Which defeats the purpose of containerization because now the container can sniff traffic on the host, hijack TCP connections, etc.
I know many people use single tenant hardware to run containers, so I wouldn’t say that it defeats the purpose of containerization, just one of the benefits.
The confusion and disagreement on this topic is rooted in faulty assumptions about other organizations' requirements. Many people use containers with host networking, without uid namespaces, without pid namespaces, without bind mounts. What you think is "a container" may not be at all universal. Also the idea that host networking grants all processes CAP_NET_RAW is just weird and wrong.
Re: Container networking is simple (2020)
#19This is...not simple. I agree that container networking is not all that much different from other Linux networking, but that doesn't make it simple. A lot of application developers are switching to working with containers and haven't historically had to do any manual network configuration. It's all new to them. Linux networking conventions change every few years and simplying keeping up with the basics is a chore. ne…
I think it’s time for us to get past “X is simple” or “X is easy.” It’s a highly subjective thing to say, no matter the topic. It’s never helpful, it just makes other people feel bad.
Well, to be honest, some level of sarcasm was meant to be in this title because it precedes a 4000+ words explanation of the topic... But seems like I'm pretty bad at writing good titles. For sure I didn't mean to make anyone feel bad.
Re: Container networking is simple (2020)
#20Brilliant write up. Lots of this topic is so much easier to understand when it’s presented from first principles, without any of the LXC or Docker helpfulness hiding the details. (If the author is reading, thank you! I’ll likely use this material for the pupils in my computer club.) Managing an IPv6 stack alongside IPv4 is also very informative. IPv6 is still not widely deployed — SMTP is likely tied to v4 for all et…
Thank you very much for your feedback! I appreciate it a lot because at the end of the day that's what keeps me motivated!