4 ms·

> > or you can manually create a new netns with "podman network create <name>" and then join all the containers to it with "--network=<name>". > I don’t think

> > or you can manually create a new netns with "podman network create <name>" and then join all the containers to it with "--network=<name>". > I don’t think this has the desired effect at all. Well I'm not entirely sure what effect you're wanting here, but I use this option for some of the containers that I run, and it makes it so that all containers in that network can reach each other, while anything outside that network can't. You can also use "--network=ns:/run/user/$UID/netns/<file-name>" to join a container to a manually created network namespace (created with "ip netns add <file-name>") if you need more control.

amluto 9mo ago
I think you are confusing a logical network with a network namespace. A logical network is a construct of Docker or CNI or Netavark or whatever that acts kind of like a LAN. A network namespace is a collection of processes that the kernel treats as being one logical machine for networking purposes. When you make a docker network that is attached three containers with hostnames a, b, and c, then those hostnames logically belong to the “network” (and your container engine may put considerable effort into making it possible for them to resolve each other and communicate), but there is one network namespace each for a, b, and c, for three total. In Podman, but apparently not Docker, you can do --network container:foo to join another container’s netns. I assume that the reason that Podman and containerd support this low-level feature is that they both support some form of pod.
- gucci-on-fleek 9mo ago
  I think that you're correct that I'm mistaken; thanks for the correction (and sorry for the mistake).
  - amluto 9mo ago
    No worries. And your reply caused me to re-remember the --network container:id podman feature, which I might actually try using. (I generally dislike podman because of stuff like this: https://github.com/containers/buildah/issues/6460#issuecomment-3590732617 https://github.com/containers/buildah/issues/6460#issuecomme... Podman is absolutely nicer than Docker in that it integrates better with systemd (if that’s your cup of tea) and it’s less painful to use for non-root development purposes.)
- nagaiaida 9mo ago
  > In Podman, but apparently not Docker, you can do --network container:foo to join another container’s netns that is precisely how you accomplish the same thing in docker https://docs.docker.com/engine/network/#container-networks https://docs.docker.com/engine/network/#container-networks

amluto 9mo ago

I think you are confusing a logical network with a network namespace. A logical network is a construct of Docker or CNI or Netavark or whatever that acts kind of like a LAN. A network namespace is a collection of processes that the kernel treats as being one logical machine for networking purposes. When you make a docker network that is attached three containers with hostnames a, b, and c, then those hostnames logically belong to the “network” (and your container engine may put considerable effort into making it possible for them to resolve each other and communicate), but there is one network namespace each for a, b, and c, for three total. In Podman, but apparently not Docker, you can do --network container:foo to join another container’s netns. I assume that the reason that Podman and containerd support this low-level feature is that they both support some form of pod.

gucci-on-fleek 9mo ago
I think that you're correct that I'm mistaken; thanks for the correction (and sorry for the mistake).
- amluto 9mo ago
  No worries. And your reply caused me to re-remember the --network container:id podman feature, which I might actually try using. (I generally dislike podman because of stuff like this: https://github.com/containers/buildah/issues/6460#issuecomment-3590732617 https://github.com/containers/buildah/issues/6460#issuecomme... Podman is absolutely nicer than Docker in that it integrates better with systemd (if that’s your cup of tea) and it’s less painful to use for non-root development purposes.)
nagaiaida 9mo ago
> In Podman, but apparently not Docker, you can do --network container:foo to join another container’s netns that is precisely how you accomplish the same thing in docker https://docs.docker.com/engine/network/#container-networks https://docs.docker.com/engine/network/#container-networks