2014-08-24 18:18:18 +01:00
|
|
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
|
|
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
|
|
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
|
|
|
|
version="5.0"
|
|
|
|
|
|
xml:id="sec-container-networking">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<title>Container Networking</title>
|
|
|
|
|
|
|
|
|
|
|
|
<para>When you create a container using <literal>nixos-container
|
|
|
|
|
|
create</literal>, it gets it own private IPv4 address in the range
|
|
|
|
|
|
<literal>10.233.0.0/16</literal>. You can get the container’s IPv4
|
|
|
|
|
|
address as follows:
|
|
|
|
|
|
|
|
|
|
|
|
<screen>
|
2016-06-01 15:23:32 +01:00
|
|
|
|
# nixos-container show-ip foo
|
2014-08-24 18:18:18 +01:00
|
|
|
|
10.233.4.2
|
|
|
|
|
|
|
|
|
|
|
|
$ ping -c1 10.233.4.2
|
|
|
|
|
|
64 bytes from 10.233.4.2: icmp_seq=1 ttl=64 time=0.106 ms
|
|
|
|
|
|
</screen>
|
|
|
|
|
|
|
|
|
|
|
|
</para>
|
|
|
|
|
|
|
|
|
|
|
|
<para>Networking is implemented using a pair of virtual Ethernet
|
|
|
|
|
|
devices. The network interface in the container is called
|
|
|
|
|
|
<literal>eth0</literal>, while the matching interface in the host is
|
|
|
|
|
|
called <literal>ve-<replaceable>container-name</replaceable></literal>
|
|
|
|
|
|
(e.g., <literal>ve-foo</literal>). The container has its own network
|
|
|
|
|
|
namespace and the <literal>CAP_NET_ADMIN</literal> capability, so it
|
|
|
|
|
|
can perform arbitrary network configuration such as setting up
|
|
|
|
|
|
firewall rules, without affecting or having access to the host’s
|
|
|
|
|
|
network.</para>
|
|
|
|
|
|
|
|
|
|
|
|
<para>By default, containers cannot talk to the outside network. If
|
|
|
|
|
|
you want that, you should set up Network Address Translation (NAT)
|
|
|
|
|
|
rules on the host to rewrite container traffic to use your external
|
|
|
|
|
|
IP address. This can be accomplished using the following configuration
|
|
|
|
|
|
on the host:
|
|
|
|
|
|
|
|
|
|
|
|
<programlisting>
|
|
|
|
|
|
networking.nat.enable = true;
|
|
|
|
|
|
networking.nat.internalInterfaces = ["ve-+"];
|
|
|
|
|
|
networking.nat.externalInterface = "eth0";
|
|
|
|
|
|
</programlisting>
|
|
|
|
|
|
where <literal>eth0</literal> should be replaced with the desired
|
|
|
|
|
|
external interface. Note that <literal>ve-+</literal> is a wildcard
|
|
|
|
|
|
that matches all container interfaces.</para>
|
|
|
|
|
|
|
2016-11-10 21:53:43 +00:00
|
|
|
|
<para>If you are using Network Manager, you need to explicitly prevent
|
|
|
|
|
|
it from managing container interfaces:
|
|
|
|
|
|
|
|
|
|
|
|
<programlisting>
|
|
|
|
|
|
networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
|
|
|
|
|
|
</programlisting>
|
|
|
|
|
|
</para>
|
|
|
|
|
|
|
2016-06-01 15:23:32 +01:00
|
|
|
|
</section>
|
