Docker Networking

Lesson 05
 [Link]

Objectives
• Docker Container Port Numbers
• Networking Drivers
 [Link]

Docker Containers – Port Numbers

• Use --publish-all or --publish with ‘docker container create’ OR
‘docker container run’
▫ --publish-all: Publish all exposed ports in image to random ports
▫ --publish: Publish a container’s port(s) to the host
• Using ‘web server’ from ‘nginx’ image
▫ Verify if nginx image is loaded. If not, then pull or load it
docker image ls
▫ Create and Start docker image instance (i.e. container)
docker run --name web_server -d --publish 9999:80 --
publish 8888:80 nginx
▫ Using ‘curl’ or ‘browser’ check for web server’s connectivity
curl [Link]
Note that, while using Docker Toolbox DOCKER_HOST is not set to localhost.
Hence use IP Address instead of localhost
docker-machine ip default # should return your IP
address.
▫ Stop the container ‘web_server’
docker container stop ‘web_server’
 [Link]

Networking Drivers
• Docker’s networking subsystem is pluggable, using
drivers. Several drivers exist by default, and provide core
networking functionality (docker network ls)
▫ bridge: The default network driver. If you don’t specify a driver,
this is the type of network you are creating.
▫ host: For standalone containers, remove network isolation
between the container and the Docker host, and use the host’s
networking directly.
▫ overlay: Overlay networks connect multiple Docker daemons
together and enable swarm services to communicate with each
other.
▫ none: For this container, disable all networking.
▫ macvlan: Macvlan networks allow you to assign a MAC address
to a container
 [Link]

When to use which driver?

• User-defined bridge networks are best when you need
multiple containers to communicate on the same Docker host.
• Host networks are best when the network stack should not
be isolated from the Docker host, but you want other aspects
of the container to be isolated.
• Overlay networks are best when you need containers
running on different Docker hosts to communicate, or when
multiple applications work together using swarm services.
• Macvlan networks are best when you are migrating from a
VM setup or need your containers to look like physical hosts
on your network, each with a unique MAC address.
• Third-party network plugins allow you to integrate Docker
with specialized network stacks.
 [Link]

Networking – Standalone Containers

• Use the default bridge network, roughly equivalent to NAT network
relying on ‘docker0’ virtual switch.
▫ List available networks
docker network ls
▫ Create two containers for ‘busybox’ image
docker run -dit --name busybox1 busybox sh
docker run -dit --name busybox2 busybox sh
▫ Verify if containers are created and are running
docker container ls
▫ Inspect ‘bridge’ network to check if containers are mapped with ‘bridge’ network.
docker network inspect bridge
▫ Attach to ‘busybox1’ image and check for Internet connectivity and other container
connectivity.
docker attach busybox1
# ping -c 2 [Link]
Try to ping ‘busybox2’ container IP Address, it works
Try to ping ‘busybox2’ container by name, it fails
▫ We will fix this in next demo.
▫ Detach from ‘busybox1’ image and stop both ‘busybox1’ and ‘busybox2’
containers, also delete ‘busybox1’ and ‘busybox2’ containers.
 [Link]

Networking – Standalone Containers

• Use user-defined bridge networks
▫ Create a network named ‘busybox-net’ relying on ‘bridge’ driver
docker network create --driver bridge busybox-net
docker network ls
docker network inspect busybox-net
▫ Create four containers of busybox image; bb1, bb2, bb4 mapped to
‘busybox-net’ network and ‘bb3’, ‘bb4’ mapped to ‘default bridge’
network.
docker run -dit --name bb1 --network busybox-net busybox sh
docker run -dit --name bb2 --network busybox-net busybox sh
docker run -dit --name bb3 busybox sh
docker run -dit --name bb4 --network busybox-net busybox sh
docker network connect bridge bb4
▫ Verify if containers are created and running.
docker container ls
▫ Inspect both ‘bridge’ and ‘busybox-net’ networks to verify if
containers are mapped properly
docker network inspect busybox-net
docker network inspect bridge
 [Link]

Networking – Standalone Containers

• Use user-defined bridge networks (continuation…)
▫ Attach to ‘bb1’ container and check for connectivity
docker attach bb1
# ping -c 2 bb2 (Succeeds)
# ping -c 2 bb3 (Fails) or # ping -c 2 <ip of bb3> (Fails)
# ping -c 2 bb4 (Succeeds)
▫ Attach to ‘bb4’ container and check connectivity
docker attach bb4
# ping -c 2 bb1
# ping -c 2 bb3 (Fails with name, but with IP Address works)
# ping -c 2 bb4
▫ Attach to each container and verify if Internet is accessing
docker attach …
# ping -c 2 [Link]
▫ Stop and Remove all containers bb1, bb2, bb3, bb4
▫ Remove network busybox-net
docker network rm busybox-net
 [Link]

Networking using the host network

• Purpose is to have standalone containers which bind
directly to the Docker host’s network, with no network
isolation.
• --publish options is not allowed with this type of network

• Create a container for ngix image

▫ docker run --rm -d --network host --name host_nginx nginx

• Using docker history identify which port is exposed

▫ docker history nginx

• Access web_server using curl or browser

([Link]

• Stop the container, because we used --rm container is

automatically deleted
▫ docker container stop host_nginx
 [Link]

Overlay Networks
• The overlay network driver creates a distributed network
among multiple Docker daemon hosts.
• The overlay network sits on top of the host-specific
networks, allowing containers connected to it to
communicate securely.
• We will understand this during Docker Swarm
Discussion
 [Link]

Disabling Network for container

• Achieved using --network none
• Within the container, only the loopback device is created.
• Create a container
▫ docker run --rm -dit
--network none
--name no-net-bbox busybox:latest sh
• Check the container’s network stack, notice eth0 is not
created.
▫ docker exec no-net-bbox ip link show
• Try accessing internet
▫ docker exec no-net-bbox ping [Link]
• Stop the container
▫ docker container stop no-net-bbox
 [Link]

Macvlan Networks
• Some applications, especially legacy applications or applications
which monitor network traffic, expect to be directly connected to the
physical network. In this type of situation, you can use the macvlan
network driver to assign a MAC address to each container’s virtual
network interface, making it appear to be a physical network
interface directly connected to the physical network.
▫ bridge mode - traffic goes through a physical device on the host.
▫ 802.1q trunk bridge mode - traffic goes through an 802.1q sub-interface
which Docker creates on the fly, allowing control of routing and filtering at
more granular level
 [Link]

Summary
• Docker Container Port Numbers
• Networking Drivers