Hi all!
I’m running docker 17.03.0-ce in a swarm.
I have two services, lets call them Service-A and Service-B and they are deployed with docker-compose.
Both Service-A and B needs to connect to different backend networks where different backend services provides resources (for example Service-A needs a MySQL database and Service-B needs a NFS share).
The network is defined in the infrastructure (different ip-ranges and vlan) and is not routed, the only way to access the resources from the infrastructure point of view is to be on the same L2 network.
In docker, I don’t want either service to be able to reach a resource that exist on a network the service hasn’t been assigned to.
None of the Service-A or Service-B is able to connect to the service when I used the steps below:
First, define some variables to have a consistent naming convention.
NETNS=be01-ns
ExtIF=bond1.521
VETH=be01-eth
BR=be01-br
BRIP=10.5.21.11/24
DockerNet=be01-net
Setup the namespace and add veth’s
ip netns add $NETNS
ip link set $ExtIF netns $NETNS
ip link add $VETH-e0 type veth peer name $VETH-e1
ip link set $VETH-e1 netns $NETNS
Setup a bridge and interfaces in new namespace
ip netns exec $NETNS ip link add name $BR type bridge
ip netns exec $NETNS ip link set dev $VETH-e1 up
ip netns exec $NETNS ip link set dev $BR up
ip netns exec $NETNS ip link set dev $ExtIF up
ip netns exec $NETNS ip link set dev $ExtIF master $BR
ip netns exec $NETNS ip link set dev $VETH-e1 master $BR
ip netns exec $NETNS ip addr flush $ExtIF
ip netns exec $NETNS ip addr add $BRIP dev $BR
Test connectivity to a resource in the backend network
ip netns exec $NETNS ping 10.10.10.10
Setup a docker overlay network:
docker network create -d overlay -o parent=$VETH-e0 --subnet=10.10.10.0/24 --ip-range=10.10.10.128/27 $DockerNet
Deploy Service-A and just a simple oneliner to test connectivity from the docker instance to backend resource.
docker stack deploy -c docker-compose.yml helloworld
docker exec -it $(docker ps | awk '$(NF) ~ /helloworld-be/ {print $(1)}') ping 10.10.10.10
The docker-compose.yml looks like:
---
version: '3'
services:
helloworld-be:
image: dockercloud/hello-world
networks:
- traefik-net
- be01-net
networks:
traefik-net:
external:
name: traefik-net
be01-net:
external:
name: be01-net
```
I don't see any packets on any of the interfaces on the docker host.
Please let me know if I need to clarify the purpose or setup more, I really need help with this since it's a showstopper in our setup.