Macvlan internal network should not change default gateway by lemrouch · Pull Request #2407 · moby/libnetwork

lemrouch · 2019-06-26T12:30:01Z

Since docker container can be connected to combination of several
internal and external networks change of default gateway of the internal
ones breaks communication via the external ones.

This fixes only macvlan network type

Signed-off-by: Pavel Matěja [email protected]

This should close #2406

Since docker container can be connected to combination of several internal and external networks change of default gateway of the internal ones breaks communication via the external ones. This fixes only macvlan network type Signed-off-by: Pavel Matěja <[email protected]>

Signed-off-by: Pavel Matěja <[email protected]>

lemrouch · 2019-08-08T06:09:43Z

What can I do to get this commit merged?

drivers/macvlan/macvlan_joinleave.go

arkodg · 2020-02-20T17:13:19Z

can you please make similar changes in https://github.com/docker/libnetwork/blob/6659f7f4d8c1ec7a412a33f8973423ad38d22982/drivers/ipvlan/ipvlan_joinleave.go#L53

Since docker container can be connected to combination of several internal and external networks change of default gateway of the internal ones breaks communication via the external ones. This fixes only ipvlan network type Signed-off-by: Pavel Matěja <[email protected]>

lemrouch · 2020-02-21T10:47:36Z

Done, can you check it pls?

arkodg · 2020-02-21T17:16:11Z

will containers connected/attached to a single internal network (mtacvlan/overlay) in a swarm be able to communicate to each other ? (maybe they will since the the bridge connected to the veth might be on the same subnet, this should be tested and verified though :) )

lemrouch · 2020-02-24T10:23:58Z

Yes it does work. Network example is taken from #2418 (comment)
Run container on 1st node and check it's ip:

root@apex1:~# docker run -it --rm --name pg_client --network db_net postgres:11 /bin/bash
root@apex1:~# nsenter --net=/proc/`docker inspect --format '{{.State.Pid}}' pg_client`/ns/net ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
25: eth0@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:0a:40:31:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.64.49.2/24 brd 10.64.49.255 scope global eth0
       valid_lft forever preferred_lft forever

Run container on 2nd node and try to ping container on 1st node:

root@apex2:~# docker run -it --rm --name pg_client --network db_net postgres:11 /bin/bash
root@apex2:~# nsenter --net=/proc/`docker inspect --format '{{.State.Pid}}' pg_client`/ns/net ping -c 1 10.64.49.2
PING 10.64.49.2 (10.64.49.2) 56(84) bytes of data.
64 bytes from 10.64.49.2: icmp_seq=1 ttl=64 time=0.484 ms

--- 10.64.49.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.484/0.484/0.484/0.000 ms

arkodg

LGTM thanks !
ptal @selansen

selansen

LGTM

moby#2419 and moby#2407 attempted to seperate out empty parent and internal for macvlan and ipvlan networks However it didnt pass the integration tests in moby moby/moby#40596 and exposed some more plumbing that needed to be done to make sure we seperate the two things If the -o parent is empty we create a dummylink and if internal is set we dont add a default gateway and make sure north-south communication cannot take place (only east-west / container-container can) Signed-off-by: Arko Dasgupta <[email protected]>

moby#2419 and moby#2407 attempted to seperate out empty parent and internal for macvlan and ipvlan networks However it didnt pass the integration tests in moby moby/moby#40596 and exposed some more plumbing that needed to be done to make sure we separate the two things If the -o parent is empty we create a dummylink and if internal is set we dont add a default gateway and make sure north-south communication cannot take place (only east-west / container-container can) Signed-off-by: Arko Dasgupta <[email protected]>

full diff: moby/libnetwork@264bffc...bf2bd42 relevant changes: - moby/libnetwork#2407 Macvlan internal network should not change default gateway - fixes moby/libnetwork#2406 Internal macvlan network overrides default gateway - vendor godbus/dbus v5 - Fix InhibitIPv4 nil panic - Cleanup VFP during overlay network removal - fixes VFP leak in windows overlay network deletion Signed-off-by: Sebastiaan van Stijn <[email protected]>

full diff: moby/libnetwork@264bffc...bf2bd42 relevant changes: - moby/libnetwork#2407 Macvlan internal network should not change default gateway - fixes moby/libnetwork#2406 Internal macvlan network overrides default gateway - vendor godbus/dbus v5 - Fix InhibitIPv4 nil panic - Cleanup VFP during overlay network removal - fixes VFP leak in windows overlay network deletion Signed-off-by: Sebastiaan van Stijn <[email protected]> Upstream-commit: e1710b42d3104e0c807dd670c260be48fdecc203 Component: engine

moby#2419 and moby#2407 attempted to seperate out empty parent and internal for macvlan and ipvlan networks However it didnt pass the integration tests in moby moby/moby#40596 and exposed some more plumbing that needed to be done to make sure we separate the two things If the -o parent is empty we create a dummylink and if internal is set we dont add a default gateway and make sure north-south communication cannot take place (only east-west / container-container can) Signed-off-by: Arko Dasgupta <[email protected]>

moby/libnetwork#2419 and moby/libnetwork#2407 attempted to seperate out empty parent and internal for macvlan and ipvlan networks However it didnt pass the integration tests in moby moby#40596 and exposed some more plumbing that needed to be done to make sure we separate the two things If the -o parent is empty we create a dummylink and if internal is set we dont add a default gateway and make sure north-south communication cannot take place (only east-west / container-container can) Signed-off-by: Arko Dasgupta <[email protected]>

lemrouch added 2 commits June 26, 2019 14:23

Log when endpoint joins internal macvlan network

e2c5ecb

Signed-off-by: Pavel Matěja <[email protected]>

lemrouch mentioned this pull request Feb 18, 2020

Fix internal macvlan network to work in swarm #2419

Merged

arkodg reviewed Feb 20, 2020

View reviewed changes

drivers/macvlan/macvlan_joinleave.go Show resolved Hide resolved

lemrouch force-pushed the 2406-fix branch from 2d3a15f to d5f5553 Compare February 20, 2020 17:49

arkodg approved these changes Feb 24, 2020

View reviewed changes

selansen approved these changes Feb 26, 2020

View reviewed changes

arkodg merged commit 8d1f97e into moby:master Feb 26, 2020

lemrouch deleted the 2406-fix branch February 26, 2020 18:23

lemrouch mentioned this pull request Feb 27, 2020

Containers can't communicate over macvlan internal network in swarm moby/moby#39392

Closed

thaJeztah mentioned this pull request Feb 28, 2020

vendor: bump libnetwork bf2bd42abc0a3734f12b5ec724e571434e42c669 moby/moby#40596

Merged

arkodg mentioned this pull request Mar 3, 2020

Macvlan: Separate empty parent and internal #2523

Merged

SamWhited mentioned this pull request Mar 11, 2020

[19.03] Macvlan: Separate empty parent and internal #2534

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Macvlan internal network should not change default gateway#2407

Macvlan internal network should not change default gateway#2407
arkodg merged 3 commits intomoby:masterfrom
lemrouch:2406-fix

lemrouch commented Jun 26, 2019

Uh oh!

lemrouch commented Aug 8, 2019

Uh oh!

Uh oh!

arkodg commented Feb 20, 2020

Uh oh!

lemrouch commented Feb 21, 2020

Uh oh!

arkodg commented Feb 21, 2020

Uh oh!

lemrouch commented Feb 24, 2020

Uh oh!

arkodg left a comment

Uh oh!

selansen left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

lemrouch commented Jun 26, 2019

Uh oh!

lemrouch commented Aug 8, 2019

Uh oh!

Uh oh!

arkodg commented Feb 20, 2020

Uh oh!

lemrouch commented Feb 21, 2020

Uh oh!

arkodg commented Feb 21, 2020

Uh oh!

lemrouch commented Feb 24, 2020

Uh oh!

arkodg left a comment

Choose a reason for hiding this comment

Uh oh!

selansen left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants