Container Networking
Container networking connects isolated containers to each other and to external networks. It covers bridge networks, overlay networks, port mapping, DNS-based service discovery, and the network namespaces that give each container its own network stack.
itVirtualization, containers, and orchestration | OpenSkills.info
Intro
Container Networking
Containers run isolated processes, but useful applications still need to exchange data. Container networking gives each workload a network view and connects that view to selected peers.
The central idea is simple. A container sees familiar network objects: interfaces, addresses, routes, ports, and DNS settings. The host or orchestrator builds and manages those objects outside the container.
The Linux mental model
A Linux network namespace is an isolated network stack. It has its own interfaces, routes, firewall rules, and port space.
A virtual Ethernet pair, or veth pair, acts like a cable with two ends. A common design places one end in the container's network namespace. The other end stays on the host and joins a bridge.
container process
|
network namespace
|
veth pair
|
host bridge ---- host routing and firewall ---- external network
The bridge connects endpoints on one host. Routing connects different IP networks. Network address translation can let private container addresses reach external networks through the host address.
This model is common, but it is not universal. Host networking removes the separate network boundary. Macvlan and ipvlan connect containers differently. Overlay networks carry traffic between hosts through an additional virtual network.
Four jobs that must happen
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://man7.org/linux/man-pages/man7/network_namespaces.7.html
Supports
- Network namespace isolation of devices, protocol stacks, routes, firewall rules, and ports
- Use of virtual Ethernet pairs between namespaces and host networking
- https://man7.org/linux/man-pages/man4/veth.4.html
Supports
- Virtual Ethernet devices as interconnected pairs
- Use of virtual Ethernet devices between network namespaces
- https://docs.docker.com/engine/network/
Supports
- Container interfaces, addresses, gateways, routes, DNS, and network drivers
- User-defined network name resolution and multiple network attachments
- Port publication, address allocation, outbound masquerading, and container network sharing
- https://docs.docker.com/engine/network/drivers/bridge/
Supports
- Single-host bridge connectivity and isolation
- Outbound masquerading and configurable bridge behavior
- https://docs.docker.com/engine/network/packet-filtering-firewalls/
Supports
- Packet filtering backends, host forwarding, and firewall behavior
- Relationship among bridge networking, masquerading, and firewall rules
- https://docs.docker.com/engine/network/drivers/overlay/
Supports
- Overlay networks connecting workloads across Docker hosts
- Encapsulation overhead and maximum transmission unit considerations
- https://github.com/containernetworking/cni/blob/main/SPEC.md
Supports
- CNI configuration format and runtime-to-plugin protocol
- Plugin chains, attachment parameters, results, address management delegation, checks, and deletion
- Runtime creation of a network namespace before plugin execution
- https://kubernetes.io/docs/concepts/workloads/pods/
Supports
- Shared network namespace, address, and port space for containers in one Pod
- Pod networking and localhost communication
- https://kubernetes.io/docs/concepts/services-networking/
Supports
- Cluster networking, Services, DNS, ingress, gateways, and network policy
- Higher-level Kubernetes networking abstractions