• Home
  • Jobs
  • Courses
  • Questions
  • Teachers
  • For business
  • ES/EN

0

225
Views
How does docker container access Internet

I have docker installed (Docker for Mac). I start a new container with

docker run -it ubuntu

I can see that my newly created container has internet access by simply invoking

ping google.com

I see:

root@b06e1a46cc40:/# ping google.com
PING google.com (216.58.209.14) 56(84) bytes of data.
64 bytes from sof01s12-in-f14.1e100.net (216.58.209.14): icmp_seq=1 ttl=37 time=63.0 ms
64 bytes from sof01s12-in-f14.1e100.net (216.58.209.14): icmp_seq=2 ttl=37 time=63.7 ms
64 bytes from sof01s12-in-f14.1e100.net (216.58.209.14): icmp_seq=3 ttl=37 time=64.8 ms

Next, I checked the networks that my container is connected to:

root@b06e1a46cc40:/# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1
    link/ipip 0.0.0.0 brd 0.0.0.0
3: ip6tnl0@NONE: <NOARP> mtu 1452 qdisc noop state DOWN group default qlen 1
    link/tunnel6 :: brd ::
6: eth0@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
root@b06e1a46cc40:/#

As I understand, eth0 is used to access internet - it is a network 172.17.0.0/16.

When I look at network list of my host, I'm not connected to this network.

How does my container access internet then?

As I understand it, my container should access internet through my host, because, after all, my host is connected to internet, so this is the only way to access.

4 months ago ·

Santiago Trujillo

3 answers
Answer question

0

Docker for Mac employs the macOS Hypervisor framework to run a custom Linux distribution (CLD) in a virtual machine (VM).

Now, the CLD inside the VM has no network connectivity with the host OS (i.e. macOS), but Docker for Mac fills in the gap (literally) through VPNkit.

VPNkit uses a shared memory queue to send network packets between the host and the guest, and then injects them into the other side's network stack.

Here are some relevant articles that describe how these things work in details:

https://docs.docker.com/docker-for-mac/networking/ https://github.com/moby/vpnkit/blob/master/docs/ethernet.md https://github.com/moby/vpnkit/blob/master/docs/ports.md

So to answer your question directly - the networks/interfaces you can see inside your container have no counterparts on the host (macOS). Instead, when you run ping google.com, the resulting network packets are intercepted by VPNkit inside the VM, transferred to the host and injected to the host's network stack.

The same happens for inbound packets, but in the opposite direction.

4 months ago · Santiago Trujillo Report

0

From my understanding, Docker containers have an isolated network to which multiple containers can connect. Containers in the same network can immediately communicate with each other. This internal network can be made available to the internet. See this documentation: https://docs.docker.com/v17.09/engine/userguide/networking/#bridge-networks

4 months ago · Santiago Trujillo Report

0

Use host network at startup docker run -it --network host ubuntu

4 months ago · Santiago Trujillo Report
Answer question
Find remote jobs
Loading

Discover the new way to find a job!

Top jobs
Top job categories
Business
Post job Plans Our process Sales
Legal
Terms and conditions Privacy policy
© 2022 PeakU Inc. All Rights Reserved.