Docker container with multiple networks route table not expected #49414
Replies: 1 comment 3 replies
-
|
Hi @kevinmatthe,
The next moby and compose releases will have a With a bit of luck, moby 28.0 will ship this week. I'm not sure about the release date for Compose but it'll also be soon. (At the moment, the gateway network is the one that sorts first alphabetically. So, at-least it is deterministic.)
I'm not able to reproduce that. For me, the ping works without needing to add the route ... which seems right, with the macvlan network using its default "-o macvlan_mode bridge". Pinging the host's address from the container on the same L2-network shouldn't need a route or gateway - it should just ARP, get a response, then send packets directly. I guess that's not happening in your case - but it's all kernel routing, not something docker is directly involved in once the networks are configured. Do you have any default network options set up in your |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for your reply, here's my daemon.json, maybe it will help: {
"ipv6": true,
"fixed-cidr-v6": "fd00::/80",
"experimental": true,
"ip6tables": true
}
That's weird since I cannot ping target IP unless I create a route rule mannually |
Beta Was this translation helpful? Give feedback.
-
Maybe you can check the route table, because in my case, the macvlan(192.168.31.0/24) is not registered as the first network even it has a smaller alphabet score(seems that it is also related to network creation time or running status). So the default route table is just the bridge network, not macvlan, and it leads to route via 0.0.0.0, which is the ip container itself. I noticed |
Beta Was this translation helpful? Give feedback.
-
|
Ah ok - I can repro now ... I think I was using docker-in-docker running under Docker Desktop before, and it's all a bit different. Running moby on a Linux VM, I see the same behaviour as you. But, from some Google searching, it seems that's expected kernel behaviour - a macvlan device doesn't allow communication with host interfaces. Various folks suggest creating another macvlan interface and adding a route to it (for example https://forums.docker.com/t/host-and-containers-cannot-communicate-macvlan/112968). But, if the route you're adding works for you, it's probably simpler. For me, it doesn't work - my network switch just returns an ICMP redirect to the host address ... which doesn't work, but the switch doesn't know that. (There wouldn't normally be any need for a route or bouncing off the switch for an IP address in the same subnet as the sender, the sender would normally be able to ARP then send directly to the MAC address.) The upcoming |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
For my typical usage, I need to create a container over 2 docker networks:
Pre-Info
Networks:
test_bridge: this is a bridge network to allowworkload_container<=docker-dns=>other_containeramcnet: this is a macvlan network to publish a static ip in LAN, this is for some device to directly access by LAN ip locally, for example theworkload_containerhere goes192.168.31.180Problem
Steps to reproduce
1. Create test_bridge and amcnet networks:
2. Create dockerfile and compose.yaml file
3. Build & Run the container
1. ping 192.168.31.74
docker compose run \ --rm \ --build \ --remove-orphans \ network_test \ /bin/bash -c "route && ping 192.168.31.74"output:
2. Add route then ping
docker compose run \ --rm \ --build \ --remove-orphans \ network_test \ /bin/bash -c "route add -net 192.168.31.0/24 gw 192.168.31.1 && route && ping 192.168.31.74"Output:
Summary
The only difference I saw here is in route table:
defaultin route table is not working?Beta Was this translation helpful? Give feedback.
All reactions