4 ms·

It's a little more complex than that for any non-trivial layout where some containers do need to talk to other containers, but most don't.

brirec 11mo ago
You could also create a network for each pair of containers that need to communicate with one another.
- HumanOstrich 11mo ago
  That would create an excessive amount of bridges in my case. Also this is another trivial suggestion that anyone can find with a quick search or asking an LLM. Not helpful. I'm not sure why people are replying to my comment with solutioning and trivial suggestions. All I did was encourage the thread OP to publish their notes. FWIW I've already been through a lot of options for solving my issue, and I've settled on one for now.
  - kortilla 11mo ago
    > I'm not sure why people are replying to my comment with solutioning and trivial suggestions Because your comment didn’t say you solved it and you asked for notes without any polish as if that would help.
    - HumanOstrich 11mo ago
      I didn't say I settled on a solution for all time. I said "for now". I'm still interested in alternatives.
- marginalia_nu 11mo ago
  If you want point-to-point communication between two network namespaces, you should use veths[1]. I think virtual patch cables is a good mental model for veths. If you want multiple participants, you use bridges, which are roughly analogous to switches. [1] https://man7.org/linux/man-pages/man4/veth.4.html https://man7.org/linux/man-pages/man4/veth.4.html
esseph 11mo ago
That's a change from what was asked which was isolation between each. Yes, if they need to talk, share namespaces. If you don't want a generic but true answer, don't ask a generic question and then be upset when the responses don't have enough detail about your specific situation that you hadn't described :-)
- HumanOstrich 11mo ago
  I didn't ask a question and I wasn't upset. :-)
  - esseph 11mo ago
    If you need more / different isolation, you're going to need custom nftables/ebtables rules. In another model you could drop each bridge onto a unique vlan, and firewall them. There's tons of options out there. Anyway, if you had more specifics to go off of, there's plenty of network engineers and kubernetes/docker admins floating around willing to help - maybe start a Ask HN post?
    - HumanOstrich 11mo ago
      You're still offering suggestions I said I didn't ask for. I'm sure you're trying to help, but at this point you're coming across as passive-aggressive.
      - esseph 11mo ago
        You asked for the notes of somebody that's done isolation in different ways in docker. Your responses have confused me so much I showed them to my partner, who is also confused.
        HumanOstrich 11mo ago
        I asked the person I was replying to for their notes because they were asking if anyone was interested in them.

brirec 11mo ago

You could also create a network for each pair of containers that need to communicate with one another.

HumanOstrich 11mo ago
That would create an excessive amount of bridges in my case. Also this is another trivial suggestion that anyone can find with a quick search or asking an LLM. Not helpful. I'm not sure why people are replying to my comment with solutioning and trivial suggestions. All I did was encourage the thread OP to publish their notes. FWIW I've already been through a lot of options for solving my issue, and I've settled on one for now.
- kortilla 11mo ago
  > I'm not sure why people are replying to my comment with solutioning and trivial suggestions Because your comment didn’t say you solved it and you asked for notes without any polish as if that would help.
  - HumanOstrich 11mo ago
    I didn't say I settled on a solution for all time. I said "for now". I'm still interested in alternatives.
marginalia_nu 11mo ago
If you want point-to-point communication between two network namespaces, you should use veths[1]. I think virtual patch cables is a good mental model for veths. If you want multiple participants, you use bridges, which are roughly analogous to switches. [1] https://man7.org/linux/man-pages/man4/veth.4.html https://man7.org/linux/man-pages/man4/veth.4.html

esseph 11mo ago

That's a change from what was asked which was isolation between each. Yes, if they need to talk, share namespaces. If you don't want a generic but true answer, don't ask a generic question and then be upset when the responses don't have enough detail about your specific situation that you hadn't described :-)

HumanOstrich 11mo ago
I didn't ask a question and I wasn't upset. :-)
- esseph 11mo ago
  If you need more / different isolation, you're going to need custom nftables/ebtables rules. In another model you could drop each bridge onto a unique vlan, and firewall them. There's tons of options out there. Anyway, if you had more specifics to go off of, there's plenty of network engineers and kubernetes/docker admins floating around willing to help - maybe start a Ask HN post?
  - HumanOstrich 11mo ago
    You're still offering suggestions I said I didn't ask for. I'm sure you're trying to help, but at this point you're coming across as passive-aggressive.
    - esseph 11mo ago
      You asked for the notes of somebody that's done isolation in different ways in docker. Your responses have confused me so much I showed them to my partner, who is also confused.
      - HumanOstrich 11mo ago
        I asked the person I was replying to for their notes because they were asking if anyone was interested in them.