cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Sitikantha Mission Specialist
Mission Specialist

About Docker Containers network connectivity

Does a container has a specific network interface like a virutal machine.

sitikantha_mishra
Labels (2)
0 Kudos
3 Replies
jordisola Cadet
Cadet

Re: About Docker Containers network connectivity

Hi Sitikantha 

Being a purist, a container does not "have" any network interface, because of a container (unlike a VM) is just a process and does not have any physical or virtual hardware.

But, like any other process, a container can "access" to networks interfaces provided by the underlying SO, as long as permissions are set to allow it.

Many container platforms (i.e. kubernetes) create a Software Defined Network (something like a virtual network) and grant permissions to managed containers.

Those containers can use this network to communicate with each other or, if allowed, to external resources.

Summarizing: containers "may have" a network interface if the underlying SO have it and grant the container permissions to use it.

Reply
Loading...
Flight Engineer littlebigfab Flight Engineer
Flight Engineer

Re: About Docker Containers network connectivity

Hi @Sitikantha,

If you have a Red Hat Learning Subscription, have a look at chapter 1.3, 1.4 and 7.2 of DO425 : Red Hat Security: Securing Containers and OpenShift.

Chapter 1.3 "Describing Multi-tenancy Isolation Technology" goes deep into the concept of namespaces (including network namespaces) and how they are leveraged to run containers. Chapter 1.4 is the related guided exercise.

At the beginning of guided exercise 7.2 "Implementing Network Isolation", you learn how to retrieve the mapping between a container's and host's network interfaces.

0 Kudos
Reply
Loading...
Moderator
Moderator

Re: About Docker Containers network connectivity

Hey, @jordisola,

Purist or not, there is a network interface per each container (or pod), otherwise it would be impossible for it to communicate with anyone because each container/pod lives in its own, isolated, network namespace. One can't use host networks in that kind of an environment.

If you have a closer look, all, Docker/Podman, and OpenShift create various sorts network interfaces for containers/pods to be able to communicate. While for OpenShift, the setup is a bit arcane and would take too long to explain here (nb: I just noticed @littlebigfab's pointer and it's very useful), it used to be tun and a bridge in Docker, and it now seems to be tap in Podman:

$ podman run -it --privileged registry.access.redhat.com/ubi8/ubi:8.0 bash
bash-4.4# cat /proc/net/dev
Inter-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
  tap0:       0       0    0    0    0     0          0         0      586       7    0    0    0     0       0          0
    lo:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
bash-4.4# yum install iproute
...
bash-4.4# ip ad sh tap0
2: tap0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
    link/ether 9e:7a:94:07:91:a1 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0
       valid_lft forever preferred_lft forever
    inet6 fe80::9c7a:94ff:fe07:91a1/64 scope link 
       valid_lft forever preferred_lft forever
bash-4.4# ip ro sh
default via 10.0.2.2 dev tap0
10.0.2.0/24 dev tap0 proto kernel scope link src 10.0.2.100

Cheers,
Grega

A black cat crossing the street signifies that the animal is going somewhere.
[don't forget to kudo a helpful post or mark it as a solution!]
Reply
Loading...
Join the conversation
You must log in to join this conversation.