cancel
Showing results for 
Search instead for 
Did you mean: 
Sitikantha
Mission Specialist
Mission Specialist
  • 3,144 Views

About Docker Containers network connectivity

Does a container has a specific network interface like a virutal machine.

sitikantha_mishra
Labels (2)
3 Replies
jordisola
Flight Engineer
Flight Engineer
  • 3,138 Views

Hi Sitikantha 

Being a purist, a container does not "have" any network interface, because of a container (unlike a VM) is just a process and does not have any physical or virtual hardware.

But, like any other process, a container can "access" to networks interfaces provided by the underlying SO, as long as permissions are set to allow it.

Many container platforms (i.e. kubernetes) create a Software Defined Network (something like a virtual network) and grant permissions to managed containers.

Those containers can use this network to communicate with each other or, if allowed, to external resources.

Summarizing: containers "may have" a network interface if the underlying SO have it and grant the container permissions to use it.

littlebigfab
Starfighter Starfighter
Starfighter
  • 3,098 Views

Hi @Sitikantha,

If you have a Red Hat Learning Subscription, have a look at chapter 1.3, 1.4 and 7.2 of DO425 : Red Hat Security: Securing Containers and OpenShift.

Chapter 1.3 "Describing Multi-tenancy Isolation Technology" goes deep into the concept of namespaces (including network namespaces) and how they are leveraged to run containers. Chapter 1.4 is the related guided exercise.

At the beginning of guided exercise 7.2 "Implementing Network Isolation", you learn how to retrieve the mapping between a container's and host's network interfaces.

oldbenko
Moderator
Moderator
  • 2,920 Views

Hey, @jordisola,

Purist or not, there is a network interface per each container (or pod), otherwise it would be impossible for it to communicate with anyone because each container/pod lives in its own, isolated, network namespace. One can't use host networks in that kind of an environment.

If you have a closer look, all, Docker/Podman, and OpenShift create various sorts network interfaces for containers/pods to be able to communicate. While for OpenShift, the setup is a bit arcane and would take too long to explain here (nb: I just noticed @littlebigfab's pointer and it's very useful), it used to be tun and a bridge in Docker, and it now seems to be tap in Podman:

$ podman run -it --privileged registry.access.redhat.com/ubi8/ubi:8.0 bash
bash-4.4# cat /proc/net/dev
Inter-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
  tap0:       0       0    0    0    0     0          0         0      586       7    0    0    0     0       0          0
    lo:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
bash-4.4# yum install iproute
...
bash-4.4# ip ad sh tap0
2: tap0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
    link/ether 9e:7a:94:07:91:a1 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0
       valid_lft forever preferred_lft forever
    inet6 fe80::9c7a:94ff:fe07:91a1/64 scope link 
       valid_lft forever preferred_lft forever
bash-4.4# ip ro sh
default via 10.0.2.2 dev tap0
10.0.2.0/24 dev tap0 proto kernel scope link src 10.0.2.100

Cheers,
Grega

A black cat crossing the street signifies that the animal is going somewhere.
[don't forget to kudo a helpful post or mark it as a solution!]
Join the discussion
You must log in to join this conversation.