Demystifying docker networking black magic - Lorenzo Fontana, Kiratech

Demystifying docker networking black magic - Lorenzo Fontana, Kiratech

• 1.
  Demystifying Docker Networking Practicalguide to black magic Lorenzo Fontana March 30, 2017
• 2.
  About Me Lorenzo Fontana DevOpsExpert @Kiratech Docker Maintainer http://fntlnz.wtf https://github.com/fntlnz https://twitter.com/fntlnz http://www.kiratech.it 1
• 3.
  Container Network Model
• 4.
  CNM: Container NetworkModel • Sandbox • Endpoint • Network 2
• 5.
  CNM: Container NetworkModel (cont’d) 3
• 6.
  Libnetwork is theNative implementation of CNM github.com/docker/libnetwork 4
• 7.
  Network Drivers 101
• 8.
  Null # docker run-it --network=none alpine sh 5
• 9.
  Default Bridge (docker0) #docker run -it alpine sh 6
• 10.
  Custom Bridge (mybridge) #docker network create -d bridge -o com.docker.network.bridge.name=mybridge mybridge # docker run -it --net mybridge alpine sh 7
• 11.
  Custom Bridge NetworkIPAM underlay (myunderbr) # docker network create -d bridge --subnet =192.168.10.0/24 --gateway =192.168.10.254 --aux -address DefaultGatewayIPv4 =192.168.10.1 -o com.docker.network.bridge.name=myunderbr myunderbr # brctl addif myunderbr enp5s0 # docker run -it --net myunderbr alpine sh # docker run -it --net myunderbr --ip 192.168.10.90 nginx :1.9 # ip a del 192.168.10.254/24 dev myunderbr 8
• 12.
  Macvlan & IPvlan 9
• 13.
  Macvlan modes: Bridged Bridged(default): switches packets inside the host 10
• 14.
  Macvlan modes: Private Privateblocks traffic between two MACVLAN interfaces on the same host 11
• 15.
  Macvlan modes: VEPA(Virtual Ethernet Port Aggregator) VEPA requires a downstream switch that supports VEPA 802.1bg that will hairpin traffic back to the host if the if the destination is on the same host 12
• 16.
  Macvlan modes: Passthru Passthruis similar to private but relies on an external switch not to hairpin the traffic back to the originating host 13
• 17.
  Overlay network (myoverlay) #docker network create -d overlay myoverlay # docker service create --network myoverlay nginx 14
• 18.
  Overlay network (cont’d) 15
• 19.
  IPVS
• 20.
  16
• 21.
  Conclusion: Happy promotion! Kiratech,the company I work for, is hiring! drop me a line at lo@linux.com 17
• 22.
  Questions? 17
• 23.
  Thanks for listening! Andthanks to all the organizers! 17