Hello and welcome to this lecture. In this lecture
we look at networking in Docker.
We will start with a basic networking options in Docker and then try and related to the concepts around
networking name spaces.
Let’s start with a single Docker Host. A server with Docker installed on it.
It has an ethernet interface at eth0 that connects to the local network with the IP address 192.168.1.10.
When you run a container you have different networking options to choose from.
First, let’s see the none network. With the None network,
the docker container is not attached to any network.
The container cannot reach the outside world and no one from the outside world can reach the container.
If you run multiple containers they are all created without being part of any network and cannot talk
to each other or to the outside world.
Next is the Host network. With the host network,
the container is attached to the host’s network.
There is no network isolation between the host and the container.
If you deploy a web application listening on port 80 in the container then the web application is available
on port 80 on the host without having to do any additional port mapping.
If you try to run another instance of the same container that listens on the same port it won't work
as they share hosts networking and two processes cannot listen on the same port at the same time.
The third networking option is the bridge. In this case, an internal private network is created which
the docker host and containers attach to. The network has an address 172.17.0.0
by default and each device connecting to this network get their own internal private network address
on this network.
This is the network that we are most interested in. So we will take a deeper look at how exactly docker
creates and manages this network.
When Docker is installed on the host it creates an internal private network called bridge by default.
You can see this when you run the docker network
ls command. Now, docker calls the network by the name “bridge”. But on the host the network is created
by the name docker 0.
You can see this in the output of the ip link command. Docker internally uses a technique similar to
what we saw in the video on namespaces by running the IP link
add command with the type set to bridge. So remember, the name bridge in the docket network ls output
refers to the name docker 0 on the host.
They are one and the same thing.
Also note that the interface or network is currently down.
Now, remember we said that the bridge network is like an interface to the host, but a switch to the
namespaces or containers within the host.
So the interface docker0 on the host is assigned an IP 172.17.0.1.
You can see this in the output of the ip addr command.
Whenever a container is created Docker creates a network namespace for it just like how we created
network
namespaces in the previous video. Run the ip netns command to list the namespace.
Note that there is a minor hack to be done to get the ip netns command to list the namespaces
created by Docker.
Checkout the resources section of this lecture for information on that.
The namespace has the name starting b3165.
You can see the namespace associated with each container in the output of the docker inspect comment.
So how does docker attach the container or its network namespace to the bridge network? For the remainder
of this lecture.
container and network namespace mean the same thing. When I say container
I'm referring to the network namespace created by Docker for that container.
So how does docker attach the container to the bridge? As we did before
it creates a cable, a VIRTUAL cable, with two interfaces on each end.
Let's find out what Docker has created here.
If you run the ip link command on the docker host you see one end of the interface which is attached to
the local bridge Docker zero.
If you run the same command again this time with the –n option with the namespace, then it lists
the other end of the interface within the container namespace.
The interface also gets an IP assigned within the network.
You can view this by running the ip addr command but within the container's namespace. The container
gets assigned 172.17.0.3.
You can also view this by attaching to the container and looking at the IP address assigned to it that
way.
The same procedure is followed every time a new container is created. Docker creates a namespace. Creates
a pair of interfaces. Attaches one end to the container and another end to the present. The interface
pairs can be identified using their numbers.
Odd and even former pair 9 and 10 are one pair.
7 and 8 are another and 11 and 12 are one pair.
The containers are all part of the network now they can all communicate with each other.
Let us look at port mapping now. The container we created is nginx, so it’s a web application serving
web page on port 80. Since our container is within a private network inside the host.
Only other containers in the same network or the host itself can access this Web page.
If you tried to access the web page using curl with the IP of the container from within Docker host
on port 80 you will see the web page.
If you try to do the same thing outside the host, you cannot view the web page. To allow external users
to access the applications hosted on containers.
Docker provides a port publishing or port mapping option. When you run containers
Tell Docker to map port 8080 on the Docker host to port 80 on the container.
With that done, you could access the web application using the IP of the docker host and port 8080.
Any traffic to port 8080 on the docker host will be forwarded to port 80 on the container.
Now all of your external users and other applications or service can use this Url to access the application
deployed on the host.
But how does docker do that?
How does it forward traffic from one port to another?
What would you do?
Let's forget about Docker and everything else for a second.
The requirement is to forward traffic coming in on one port to another port on the server.
We talked about it in one of our prerequisite lectures.
We create a NAT rule for that. Using iptables we create an entry into the NAT table, to append a rule
to the PREROUTING chain to change the destination port from 8080 to 80. Docker does it the same way. Docker
adds the rule to the docker chain and sets destination to include the containers IP as well you can
see the rule docker creates when you list the rules in iptables.
Well that's it for this lecture in the next lecture.
We will talk about CNI and what container networking interface is.