Using SocketCAN/PF_CAN inside a docker container without exposing host net

General
1

Hi,

I am trying to have a docker container hosting an app with Socketcan access, but for security reasons I do not want to expose the hosts network stack. (e.g docker run --net=host …)

It seems that there might be some solution (after reading some news on wiki.automotivelinux.org, but I cant find any manual.

Maybe here somebody knows something more?

BR
tuxscreen

2

Have you found any solution? I’d be interested in this as well. Would like to run 2 programs inside a container which would communicate through Socketcan.

3

Hey,

As you can see, nobody seems to be interested.

My solution:

I dropped docker for this kind of use-case and use kind of a “proxy” on the host forwarding CAN-messages via mqtt :frowning:

BR
tuxscreen

4

Sure thanks for answering. Will probably do this myself with --network=host.

5

is there a possibility? with out using network_mode : host

6

I found a soultion! I got CAN working in a docker container using this docker plugin. Only works with docker on a host that has the vcan kernel module (aka Linux). Works for me in a debian VM.