Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Communicating between Docker containers in different networks on the same host

Tags:

Any possibility to make containers in different networks within the same host to communicate? Please note that I am not using docker-compose at the moment.

The following is a summary of what I did. I created two networks using the following commands

docker network create --driver bridge mynetwork1    docker network create --driver bridge mynetwork2 

Then I ran two containers on each of these created networks using the commands:

docker run --net=mynetwork1 -it name=mynet1container1 mycontainerimage docker run --net=mynetwork1 -it name=mynet1container2 mycontainerimage docker run --net=mynetwork2 -it name=mynet2container1 mycontainerimage docker run --net=mynetwork2 -it name=mynet2container2 mycontainerimage 

I then identified the IP Addresses of each of the containers from the networks created using

docker network inspect mynetwork1 docker network inspect mynetwork2 

Using those I was able to communicate between the containers in the same network, but I could not communicate between the containers across the networks. Communication was possible only by adding the containers to the same network.

Much thanks...

like image 367
Abraham Jaison Avatar asked Mar 16 '16 12:03

Abraham Jaison


People also ask

When you have containers across multiple host and want the containers to communicate?

You can create user-defined overlay networks using docker network create , in the same way that you can create user-defined bridge networks. Services or containers can be connected to more than one network at a time. Services or containers can only communicate across networks they are each connected to.

Which network allows you to connect different Docker nodes across different hosts?

overlay : Overlay networks connect multiple Docker daemons together and enable swarm services to communicate with each other. You can also use overlay networks to facilitate communication between a swarm service and a standalone container, or between two standalone containers on different Docker daemons.

Can multiple users connect to the same Docker container?

Multiple users on the same host can use docker.


2 Answers

Containers in different networks can not communicate with each other because iptables drop such packets. This is shown in the DOCKER-ISOLATION-STAGE-1 and DOCKER-ISOLATION-STAGE-2 chains in the filter table.

    sudo iptables -t filter -vL 

Rules can be added to DOCKER-USER chain to allow communication between different networks. In the above scenario, the following commands will allow ANY container in mynetwork1 to communicate with ANY containers in mynetwork2.

The bridge interface names of the network (mynetwork1 and mynetwork2) need to be found first. Their names are usually look like br-07d0d51191df or br-85f51d1cfbf6 and they can be found using command "ifconfig" or "ip link show". Since there are multiple bridge interfaces, to identify the correct ones for the networks of interest, the inet address of the bridge interface (shown in ifconfig) should match the subnet address shown in command 'docker network inspect mynetwork1'

    sudo iptables -I DOCKER-USER -i br-########1 -o br-########2 -j ACCEPT     sudo iptables -I DOCKER-USER -i br-########2 -o br-########1 -j ACCEPT 

The rules can be fine tuned to allow only communications between specific IPs. E.g,

    sudo iptables -I DOCKER-USER -i br-########1 -o br-########2 -s 172.17.0.2 -d 172.19.0.2 -j ACCEPT     sudo iptables -I DOCKER-USER -i br-########2 -o br-########1 -s 172.19.0.2 -d 172.17.0.2 -j ACCEPT 
like image 96
Jay Avatar answered Oct 10 '22 21:10

Jay


Issue

Two containers cannot communicate because there are not on the same network.

Solution a)

Connect one container into the other network overlay (this may not meet the constraint you have).

Solution b)

Create a third network and plug both containers into this network.

How to

The command docker run accept only one occurrence of the option --net, what you have to do is to docker start the containers and then to docker network connect them to a shared network.


The answer you are looking for is here: https://stackoverflow.com/a/34038381/5321002

like image 28
Auzias Avatar answered Oct 10 '22 21:10

Auzias