MACVlan Networks - unable to connect to HOST from Container

General
1

Hi,

I’m pretty new to docker, and I have a few containers going. It works amazing for the most part, but I noticed one issue and I’m hoping someone can help me figure it out.

I run my containers with a macvlan network, because I wanted to be able to run miltiple containers on port 80 (or other ports).

The problem I have is that I’m unable to connect to the docker host from one of the contianers. As an example:

+---------------Host (192.168.1.100)-------------+
|                                                |
| +---(192.168.1.102)--+  +--(192.168.1.103)---+ |
| |  Container 1       |  |  Container 2       | |
| +--------------------+  +--------------------+ |
+------------------------------------------------+

When I try to ping the Host (192.168.1.100) from Container 1 (192.168.1.102), I don’t get a response, no packets seem to reachable from any of the containers, but other machines on the network (outside of the host) work fine.

Is there a way I can configure MacVlan to allow talking to the host from the conatiner?

2

You can do this with the standard Docker networking setup easily enough:

docker run -d -p8000:80 --name web_1 whatever
docker run -d -p8001:80 --name web_2 whatever
...

The containers will be accessible via the host’s DNS name or IP address on ports 8000, 8001, or whatever is on the left-hand side of the -p option, even though the processes inside the container are serving on port 80 (the right-hand side of the -p option must match this but it’s under the process’s control).

You shouldn’t worry about the internal IP addresses containers happen to have; setting up routing for these is very difficult. If you’re communicating between containers, set up a non-default network (just docker network create net_name will do) and attach all the containers to that, and Docker will provide a DNS service so that you can refer to the other containers by name.

3

Thanks! I’ll give that a shot and see if that works out.

Additionally, Is there a reason the host is unreachable by the container? Rather than container - container communication, the container - host communication seems to be blocked.

4

Does anyone else have the same issue? Where containers can’t connect to the host? Is this by design or a bug?

5

Older versions of the Docker documentation pointed it out:

Note : In Macvlan you are not able to ping or communicate with the default namespace IP address. For example, if you create a container and try to ping the Docker host’s eth0 it will not work. That traffic is explicitly filtered by the kernel modules themselves to offer additional provider isolation and security.

Source: Macvlan network driver | Docker Docs

Though, there are ways to work around the limitation: