6 ms·
This is extremely tangential, but I was working on setting up some manual network namespaces recently, basically manually reproducing what docker does to fix so
by marginalia_nu 1y ago
This is extremely tangential, but I was working on setting up some manual network namespaces recently, basically manually reproducing what docker does to fix some of its faulty assumptions regarding containers having multiple IPs and a single name causing all sort of jank, and had to freshen up on a lot of Linux virtual networking concepts (namespaces, veths, bridge networks, macvlans and various other interfaces), made a ton of fairly informal notes to make myself sufficiently familiar with the thing to set it up.
Would anyone be interested if I polished it up and maybe added a refresher on the relevant layer 2 networking needed to reason about it? It's a fair bit of work and it's a niche topic, so I'm trying to poll a bit to see if the juice is worth the squeeze.
- manuelangel99 1y agoI would def. be interestred!
- msbhvn 1y agoPlease do it, I'm very biased but I think there would be lots of interest in seeing all that explained in one place in a coherant fashion (you will likely sharpen your own understanding in the process and have the perfect resource for when you next need to revisit these topics).
- MrResearcher 1y agoDon't forget to post the link here!
- HumanOstrich 1y agoI was actually going down rabbitholes today trying to figure out how to do a sane Docker setup where all the containers couldn't connect to each other. Your notes would be valuable at most any level of polish.
- esseph 1y agoIf you create each container in its own network namespace, they won't be able to.
- HumanOstrich 1y agoIt's a little more complex than that for any non-trivial layout where some containers do need to talk to other containers, but most don't.
- brirec 1y agoYou could also create a network for each pair of containers that need to communicate with one another.
- HumanOstrich 1y agoThat would create an excessive amount of bridges in my case. Also this is another trivial suggestion that anyone can find with a quick search or asking an LLM. Not helpful. I'm not sure why people are replying to my comment with solutioning and trivial suggestions. All I did was encourage the thread OP to publish their notes. FWIW I've already been through a lot of options for solving my issue, and I've settled on one for now.
- kortilla 1y ago> I'm not sure why people are replying to my comment with solutioning and trivial suggestions Because your comment didn’t say you solved it and you asked for notes without any polish as if that would help.
- HumanOstrich 1y agoI didn't say I settled on a solution for all time. I said "for now". I'm still interested in alternatives.
- marginalia_nu 1y agoIf you want point-to-point communication between two network namespaces, you should use veths[1]. I think virtual patch cables is a good mental model for veths. If you want multiple participants, you use bridges, which are roughly analogous to switches. [1] https://man7.org/linux/man-pages/man4/veth.4.html https://man7.org/linux/man-pages/man4/veth.4.html
- aryonoco 1y agoI put each docker container in a LXC container which effectively uses namespaces, cgroups etc to isolate them.
- ambicapter 1y agoI would absolutely be interested.
- globalnode 1y agoi await your write up!
- dfedbeef 1y agoYES
- sevg 1y agoYes please!
- teleforce 1y agoLooking forward to that. It's about time someone write a new linux networking book covering layer 2 and 3. Between switchdev, nftables and flowtables, there are many new information. The existing books are already more than two decades old namely Linux Routing and Linux Routers (2nd edition).
- pmontra 1y agoYes of course. It would be great.
- anbotero 1y agoMost definitely. Not just for myself, but for some of my peers here too.