About Docker Containers network connectivity

[Sitikantha]

Does a container has a specific network interface like a virutal machine.

[jordisola]

Hi Sitikantha 

Being a purist, a container does not "have" any network interface, because of a container (unlike a VM) is just a process and does not have any physical or virtual hardware.

But, like any other process, a container can "access" to networks interfaces provided by the underlying SO, as long as permissions are set to allow it.

Many container platforms (i.e. kubernetes) create a Software Defined Network (something like a virtual network) and grant permissions to managed containers.

Those containers can use this network to communicate with each other or, if allowed, to external resources.

Summarizing: containers "may have" a network interface if the underlying SO have it and grant the container permissions to use it.

[littlebigfab]

Hi @Sitikantha,

If you have a Red Hat Learning Subscription, have a look at chapter 1.3, 1.4 and 7.2 of DO425 : Red Hat Security: Securing Containers and OpenShift.

Chapter 1.3 "Describing Multi-tenancy Isolation Technology" goes deep into the concept of namespaces (including network namespaces) and how they are leveraged to run containers. Chapter 1.4 is the related guided exercise.

At the beginning of guided exercise 7.2 "Implementing Network Isolation", you learn how to retrieve the mapping between a container's and host's network interfaces.

[oldbenko]

Hey, @jordisola,

Purist or not, there is a network interface per each container (or pod), otherwise it would be impossible for it to communicate with anyone because each container/pod lives in its own, isolated, network namespace. One can't use host networks in that kind of an environment.

If you have a closer look, all, Docker/Podman, and OpenShift create various sorts network interfaces for containers/pods to be able to communicate. While for OpenShift, the setup is a bit arcane and would take too long to explain here (nb: I just noticed @littlebigfab's pointer and it's very useful), it used to be tun and a bridge in Docker, and it now seems to be tap in Podman:

$ podman run -it --privileged registry.access.redhat.com/ubi8/ubi:8.0 bash
bash-4.4# cat /proc/net/dev
Inter-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
  tap0:       0       0    0    0    0     0          0         0      586       7    0    0    0     0       0          0
    lo:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
bash-4.4# yum install iproute
...
bash-4.4# ip ad sh tap0
2: tap0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
    link/ether 9e:7a:94:07:91:a1 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0
       valid_lft forever preferred_lft forever
    inet6 fe80::9c7a:94ff:fe07:91a1/64 scope link 
       valid_lft forever preferred_lft forever
bash-4.4# ip ro sh
default via 10.0.2.2 dev tap0 
10.0.2.0/24 dev tap0 proto kernel scope link src 10.0.2.100 

Cheers,
Grega