I am setting up a server to host a number of LXC containers, for now just isolating web and db services. The server I am using has two NICs and I'd like to use one for host traffic and one for container traffic (as both containers have routable IPs) so that I can route the traffic through two different vlans on my switch.

Before I dive into actually doing all of this I'm trying to figure out if my way of thinking about how to do this is correct. The way I understand it is i'd create a bridge device in my hosts interfaces, say br0, that includes bridge_ports eth1. As far as I know this bridge shouldn't require any kind of IP (but I'm not really sure...)

On the containers I would then change the network interfaces to macvlan bridges linked to br0 with static IPs.

Is this even remotely right? I've not really worked with container network routing before... (also here is a neat illustration of what I think I'm doing)

         |                |                      
         | managed switch |                      
         |                |                      
           |          |                          
     +-----+          +-------+                  
     |                        |                  
 +---+----+                +--+-----+            
 |        |                |        |            
 | vlan 1 |                | vlan 2 |            
 |        |                |        |            
 +--+-----+                +--+-----+            
    |                         |                  
    | eth0                    +-------------+    
    |          eth1           |             |    
    |     +-------------------+             |    
    |     |                                 |    
+---+-----++            +---------------+   |    
|          |   lxc      |               |   |    
| lxc host +------+-----+ web container +---+ br0
|          |      |     |               |   |    
+----------+      |     +---------------+   |    
                  |                         |    
                  |     +--------------+    |    
                  |     |              |    |    
                  +-----+ db container +----+    
                        |              |         

You may use a bridge or a macvlan, but you do not need both. Since you appear to know about macvlans, I'll outline a macvlan approach.

You just need to create virtual network cards (VLANs) in your web container and bind them to the NIC dedicated to hosting container traffic.

The virtual network cards are then exposed the same as the container NICs and receive DHCP or you may use Static IPs.

Below are the core instructions, but detailed steps and background come from this Bonsai Framework article.

Create a Permanent macvlan on the Host

Add to the bottom of the /etc/network/interfaces file of the host,

# Creates a macvlan interface called macvlan0 without an IP address  
iface mvlan0 inet manual  
   pre-up ip link add mvlan0 link eth0 address 8a:38:2a:cc:d7:aa type macvlan mode bridge  
   post-down ip link del macvlan0  
auto mvlan0  

Reboot your system to have the change take effect. You will notice a mvlan0 now when viewing your network devices with ifconfig -a.

Connect Container to macvlan on Host by modifying the config file located in /var/lib/lxc/[container]/config.

The entries to add for your new network card,

# macvlan for external IP  
lxc.network.type = macvlan   
lxc.network.macvlan.mode = bridge  
lxc.network.flags = up  
lxc.network.link = mvlan0  
lxc.network.hwaddr = 00:16:3e:8d:4f:51  
lxc.network.name = eth0  

For the hwaddr, generate a unique locally administered unicast MAC Address via a free website like helion.org.

Finally, adjust the interfaces file within the container to bind via static or if you prefer use dynamic.

In my case, I adjust my home router so that to are not dynamically assigned and use static in my LXC.

So I modify my containers interfaces file as follows,

auto eth0  
iface eth0 inet static  

auto eth1  
iface eth1 inet dhcp  

Restart your Linux container.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.