I have a docker host (CentOs7) where I am running multiple dockerized applications and will be having even more in the future. The problem that I have an external service which I need to access from the host, which uses an 172.18.100.101 address.
Docker automatically assigns subnets for the bridge networks it creates, 172.18.x, 172.19.x, etc:
Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.x.x.x 0.0.0.0 UG 0 0 0 eth0 172.17.1.0 0.0.0.0 255.255.255.0 U 0 0 0 docker0 172.18.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-0a7f3df38b5c 172.19.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-636432c82f83
The options I see:
1. Tell Docker NOT to use the 172.18.0.0 subnet for the bridges. I don't think this is possible in docker.
2. For each docker container I could start specifying a subnet - but this becomes very problematic, as you need to ensure they don't clash, plus docker-compose.yml files are shared across hosts, so this is a management nightmare.
3. Try to route the required ip (172.18.100.101) differently on the host - while the 172.18.0.0 subnet is still there. I am not sure whether this is possible. I have tried it with adding routes, but no help, probably because it gets added after the 172.18.0.0 rule and not before it.
$ sudo route add -host 172.18.100.101 dev eth0 Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.x.x.x 0.0.0.0 UG 0 0 0 eth0 172.17.1.0 0.0.0.0 255.255.255.0 U 0 0 0 docker0 172.18.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-0a7f3dfsudo ip route show to match 172.18.198.12038b5c 172.18.100.101 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 172.19.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-636432c82f83
Any ideas? I guess the question is how to add an "exception" routing for a select ip (or subnet) and make sure that it is applied before the main rule.
EDIT (2018-06-21): The issue is not about trying to connect t a service in a Docker container. My problem is that on my network there is a service (on a different server, not owned/controlled by me) with ip 172.18.100.101, but I cannot connect to this service from this host, as on this host Docker automatically assigns the 172.18.0.0 range to a bridge network it creates, so any connection attempts to 172.18.100.101 gets sent to bridge Docker created and not to that external host.