Cannot access container with vlan ip

Docker Engine Compose
,
1

I am on an ubuntu server host and am trying to run an nginx server. I want to connect to it at 192.168.2.3:80 from a different device.

However, I am unable to connect to it at 192.168.2.3 or ping. To test I have tried:

  • Removing the vlan network - I can access it using the hosts ip address
  • Removing the default network - Same as if i have both networks, I am unable to access the website at all

Below is my docker compose configuration.

services:
  nginx:
    image: nginx
    networks:
      default:
      vlan:
         ipv4_address: "192.168.2.3"
    container_name: nginx
    cap_add:
      - NET_ADMIN
    ports:
       - 80:80
networks:
  default:
     driver: bridge
  vlan:
    driver: macvlan
    driver_opts:
      parent: enp0s8
    ipam:
     config:
        - subnet: "192.168.0.0/17"
          gateway: "192.168.5.202"

What steps can I take to ensure my configuration is correct?

2

Kernel security restrictions generally prevent macvlan parent and child interfaces to communicate with each other - this restriction does not come from docker, it just inherits it.

Try accessing the container ip (=macvlan child ip) from a different host than your docker host.

Note: The nginx container should not require NET_ADMIN. With kernels don’t require NET_ADMIN capabilities anymore to bind ports below 1024.

3

Thanks for your response. Using a second device, the results remain the same. I have also attempted to ping the container ip from the second device, but every request times out.

ping 192.168.2.3

Pinging 192.168.2.3 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.2.3:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
4

I never tried macvlan with a subnet other than /24.
And I always configured ip_range: x.x.x.x/y with a smaller cidr netmask than the subnet itself.

In my experience, as long as the router is within the specified subnet, the container should be reachable and should be able to reach other devices in the lan. [Update]: on a second thought the router is irrelevant if your client is in the same subnet. Macvlan acts pretty much like a network switch.[/update]

You might want to check if setting the parent interface to promiscuous mode, and/or disabling checksum offloading has an effect.

Personally, I stopped using macvlan years ago, as the hustle dealing with it was not worth the benefits.