Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CNI for Docker Containers with Weave and Calico

weave.works

Post reply on HN
Print view View original

11–20 of 20 posts

Re: CNI for Docker Containers with Weave and Calico

#11

Post by justincormack »

NetStrikeForce wrote: post #7

I've got a strong interest on overlay networking solutions like Weave, but I'm not an expert on Docker and other container solutions. What's the new thing here? If I understood correctly, it seems that you can connect your Docker host to an overlay network, so your containers can access other containers and resources through it. Am I correct to think this facilitates orchestration of the containers' network? Disclosu…

No, Docker already supports overlay networks, including Weave a default one that ships with it, and Calico.

Re: CNI for Docker Containers with Weave and Calico

#12

Post by vetrom »

I'm looking forward to setting up some trial deployments of calico at my workplace.

While there is an ease of understanding of bridged and/or overlayed networks, native end-to-end routing between containers with regular IP datagrams and container-level addressability has been on my wishlist for a long time.

Re: CNI for Docker Containers with Weave and Calico

#13

Post by vishvananda »

NetStrikeForce wrote: post #7

I've got a strong interest on overlay networking solutions like Weave, but I'm not an expert on Docker and other container solutions. What's the new thing here? If I understood correctly, it seems that you can connect your Docker host to an overlay network, so your containers can access other containers and resources through it. Am I correct to think this facilitates orchestration of the containers' network? Disclosu…

I haven't come across your project before. Any relation to my (similarly named) project https://github.com/vishvananda/wormhole ? I always thought that one of the most interesting piece of my project was easy ipsec tunnel setup. It turns out that setting ip ipsec tunnels is pretty tricky.

Re: CNI for Docker Containers with Weave and Calico

#14

Post by DanielDent »

politician wrote: post #9

Does Weave still have atrocious network performance?

For now, yes. https://github.com/weaveworks/weave/issues/1925 https://github.com/weaveworks/weave/issues/1931

The developers are friendly, helpful and responsive. But in my testing, Weave simply wasn't adequate. I hope they'll get there.

Re: CNI for Docker Containers with Weave and Calico

#15

Post by NetStrikeForce »

vishvananda wrote: post #13
NetStrikeForce wrote: post #7

I've got a strong interest on overlay networking solutions like Weave, but I'm not an expert on Docker and other container solutions. What's the new thing here? If I understood correctly, it seems that you can connect your Docker host to an overlay network, so your containers can access other containers and resources through it. Am I correct to think this facilitates orchestration of the containers' network? Disclosu…

I haven't come across your project before. Any relation to my (similarly named) project https://github.com/vishvananda/wormhole ? I always thought that one of the most interesting piece of my project was easy ipsec tunnel setup. It turns out that setting ip ipsec tunnels is pretty tricky.

Holy cr*p! haha! first time I see your project, too.

I think both are a bit different. My project is based on SoftEther and using an external server as a pivotal point, so all the members of the network only need outbound 443/TCP access. It's not point to point unfortunately. The idea is to make sure it works on as many scenarios as possible.

I'm just adding all the server management and simplification layer, but both server and clients are 100% SoftEther.

Re: CNI for Docker Containers with Weave and Calico

#17

Post by bboreham »

DanielDent wrote: post #14
politician wrote: post #9

Does Weave still have atrocious network performance?

For now, yes. https://github.com/weaveworks/weave/issues/1925 https://github.com/weaveworks/weave/issues/1931 The developers are friendly, helpful and responsive. But in my testing, Weave simply wasn't adequate. I hope they'll get there.

I think you were running with encryption turned on. This is a unique feature of Weave Net, but has some costs.

Without encryption, Weave Net uses the same VXLAN technology as Docker Overlay; goes at close to native speed.

(note I am a friendly Weave Net developer)

Re: CNI for Docker Containers with Weave and Calico

#18

Post by bboreham »

shykes wrote: post #5

I haven't looked at this in detail, but does this work with the standard networking features introduced in Docker 1.9 [1] and 1.10 [2]? Can I still use 'docker network create/connect' and the DNS service discovery features of Docker? Can containers interoperate regardless of the choice of Docker plugin, or will they only work on a plugin based on the weave proxy? The wording in the post leaves that ambiguous. [1] htt…

The networking features introduced in Docker are one "standard"; CNI is another "standard" [1].

Weave Net as a product ships with support for the former; the blog post describes work towards support for the latter.

No they do not interoperate; there is a detailed argument at http://blog.kubernetes.io/2016/01/why-Kubernetes-doesnt-use-...

[1] Scare-quotes because all of these things are only a few months old.

Re: CNI for Docker Containers with Weave and Calico

#19

Post by fons »

chrissnell wrote: post #6

Other than IPv6 support, is there a reason to use Calico/Weave over Flannel? We've been very happy with Flannel, especially using the clean CoreOS-Flannel integration.

In the case of Weave: encryption, multicast, fault tolerance (fully distributed through a CRDT mesh), integrates beautifully with containers (can be used as a Docker network plugin and provides out-of-the-box service discovery). More over, it's stupidly simple to use and setup (zero-conf, no kv-store required).

Full disclamer: I work at Weaveworks.

Re: CNI for Docker Containers with Weave and Calico

#20

Post by politician »

__monadic wrote: post #16
politician wrote: post #9

Does Weave still have atrocious network performance?

No. http://www.weave.works/weave-fast-datapath/

Nice work. VXLAN works well for cloud providers that can support it (all of the them afaik, except for Azure).
Post reply on HN