How Container Networking Works: Building a Bridge Network from Scratch
11 hours ago
- #Docker
- #Container Networking
- #Linux Networking
- Containers are isolated and restricted Linux processes, and networking is a key aspect of containerization.
- Single-host container networking can be set up using Linux tools like network namespaces (netns) and virtual Ethernet devices (veth).
- Network namespaces provide isolated network environments with their own devices, routes, and firewall rules, created using 'ip netns add'.
- Veth pairs (e.g., veth0 and ceth0) connect network namespaces, with one device in the root namespace and the other moved into a container namespace using 'ip link set'.
- A Linux bridge (br0) acts as a virtual switch, connecting multiple containers on the same L2 network to resolve routing conflicts.
- Connectivity between containers and the host is enabled by assigning an IP to the bridge, adding default routes in containers, and enabling IP forwarding ('echo 1 > /proc/sys/net/ipv4/ip_forward').
- NAT (using iptables masquerading) allows containers to access the internet by replacing their private IPs with the host's external address.
- Port publishing forwards external traffic to container ports via iptables DNAT rules (e.g., for HTTP servers).
- Docker network modes include 'host' (shared root namespace), 'none' (only loopback), and 'bridge' (default, similar to the tutorial setup).
- This foundational knowledge helps understand Docker and Kubernetes networking concepts like CNIs (e.g., Flannel, Calico).