Bind Docker Containers to Specific VLANs on Ubuntu
Docker is a powerful containerization platform that allows you to easily package, ship, and run applications in isolated environments. When deploying Docker containers in a network environment, it is often necessary to bind them to specific VLANs to ensure proper communication and security. In this article, we will explore how to bind Docker containers to specific VLANs on Ubuntu systems.
Prerequisites
To follow along with this article, you will need the following:
- An Ubuntu 20.04 or later system with Docker installed
- A basic understanding of networking concepts, including VLANs and subnets
Creating a VLAN Interface
Before you can bind Docker containers to a VLAN, you need to create a VLAN interface on your Ubuntu system. This can be done using the ip link add command with the appropriate flags for your VLAN ID and parent interface. For example, to create a VLAN interface with ID 100 on the eth0 interface, you can use the following command:
ip link add name vlan100 type vlan id 100 dev eth0Once the VLAN interface is created, you can set its IP address using the ip addr add command, like so:
ip addr add 192.168.100.1/24 dev vlan100Don't forget to enable the VLAN interface and set it up with the appropriate routing and firewall rules.
Binding Docker Containers to a VLAN
After creating a VLAN interface, you can bind Docker containers to it using the --network flag with the Docker run command. The format for this flag is --network=type=, where interface is the name of the VLAN interface you created earlier. For example, to run a container with the nginx image and bind it to the vlan100 interface, you can use the following command:
docker run --name nginx -d --network=type=vlan100 nginxBy default, Docker containers use the bridge network driver, which creates a separate network for each container. When binding a container to a VLAN, you must use a different network driver, such as the macvlan or ipvlan driver. These drivers allow you to assign a unique MAC address to each container, ensuring proper communication with other devices on the VLAN.
Configuring the Network Driver
To use the macvlan or ipvlan driver, you need to create a network configuration file. The format for this file is bridge=, where name is the name of the network. For example, to create a macvlan network named vlan100, you can use the following command:
cat > /etc/docker/daemon.json << EOF
{
"networks": {
"vlan100": {
"driver": "macvlan",
"driver_opts": {
"parent": "vlan100",
"macvlan_mode": "bridge"
}
}
}
EOFAfter creating the network configuration file, restart the Docker daemon to apply the changes. You can now use the --network flag with the appropriate network name when running containers.
In this article, we explored how to bind Docker containers to specific VLANs on Ubuntu systems. By creating a VLAN interface and configuring the network driver, you can ensure proper communication and security for your containers in a network environment. Here are some additional resources for further reading: