You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
59 lines
2.2 KiB
59 lines
2.2 KiB
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-container-networking">
|
|
<title>Container Networking</title>
|
|
|
|
<para>
|
|
When you create a container using <literal>nixos-container create</literal>,
|
|
it gets it own private IPv4 address in the range
|
|
<literal>10.233.0.0/16</literal>. You can get the container’s IPv4 address
|
|
as follows:
|
|
<screen>
|
|
<prompt># </prompt>nixos-container show-ip foo
|
|
10.233.4.2
|
|
|
|
<prompt>$ </prompt>ping -c1 10.233.4.2
|
|
64 bytes from 10.233.4.2: icmp_seq=1 ttl=64 time=0.106 ms
|
|
</screen>
|
|
</para>
|
|
|
|
<para>
|
|
Networking is implemented using a pair of virtual Ethernet devices. The
|
|
network interface in the container is called <literal>eth0</literal>, while
|
|
the matching interface in the host is called
|
|
<literal>ve-<replaceable>container-name</replaceable></literal> (e.g.,
|
|
<literal>ve-foo</literal>). The container has its own network namespace and
|
|
the <literal>CAP_NET_ADMIN</literal> capability, so it can perform arbitrary
|
|
network configuration such as setting up firewall rules, without affecting or
|
|
having access to the host’s network.
|
|
</para>
|
|
|
|
<para>
|
|
By default, containers cannot talk to the outside network. If you want that,
|
|
you should set up Network Address Translation (NAT) rules on the host to
|
|
rewrite container traffic to use your external IP address. This can be
|
|
accomplished using the following configuration on the host:
|
|
<programlisting>
|
|
<xref linkend="opt-networking.nat.enable"/> = true;
|
|
<xref linkend="opt-networking.nat.internalInterfaces"/> = ["ve-+"];
|
|
<xref linkend="opt-networking.nat.externalInterface"/> = "eth0";
|
|
</programlisting>
|
|
where <literal>eth0</literal> should be replaced with the desired external
|
|
interface. Note that <literal>ve-+</literal> is a wildcard that matches all
|
|
container interfaces.
|
|
</para>
|
|
|
|
<para>
|
|
If you are using Network Manager, you need to explicitly prevent it from
|
|
managing container interfaces:
|
|
<programlisting>
|
|
networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
|
|
</programlisting>
|
|
</para>
|
|
|
|
<para>
|
|
You may need to restart your system for the changes to take effect.
|
|
</para>
|
|
</section>
|
|
|