2

I have a docker host (CentOs7) where I am running multiple dockerized applications and will be having even more in the future. The problem that I have an external service which I need to access from the host, which uses an 172.18.100.101 address.

Docker automatically assigns subnets for the bridge networks it creates, 172.18.x, 172.19.x, etc:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.x.x.x        0.0.0.0         UG    0      0        0 eth0
172.17.1.0      0.0.0.0         255.255.255.0   U     0      0        0 docker0
172.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-0a7f3df38b5c
172.19.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-636432c82f83

The options I see:
1. Tell Docker NOT to use the 172.18.0.0 subnet for the bridges. I don't think this is possible in docker.
2. For each docker container I could start specifying a subnet - but this becomes very problematic, as you need to ensure they don't clash, plus docker-compose.yml files are shared across hosts, so this is a management nightmare.
3. Try to route the required ip (172.18.100.101) differently on the host - while the 172.18.0.0 subnet is still there. I am not sure whether this is possible. I have tried it with adding routes, but no help, probably because it gets added after the 172.18.0.0 rule and not before it.

$ sudo route add -host 172.18.100.101 dev eth0
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.x.x.x        0.0.0.0         UG    0      0        0 eth0
172.17.1.0      0.0.0.0         255.255.255.0   U     0      0        0 docker0
172.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-0a7f3dfsudo ip route show to match 172.18.198.12038b5c
172.18.100.101  0.0.0.0         255.255.255.255 UH    0      0        0 eth0
172.19.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-636432c82f83

Any ideas? I guess the question is how to add an "exception" routing for a select ip (or subnet) and make sure that it is applied before the main rule.

EDIT (2018-06-21): The issue is not about trying to connect t a service in a Docker container. My problem is that on my network there is a service (on a different server, not owned/controlled by me) with ip 172.18.100.101, but I cannot connect to this service from this host, as on this host Docker automatically assigns the 172.18.0.0 range to a bridge network it creates, so any connection attempts to 172.18.100.101 gets sent to bridge Docker created and not to that external host.

  • I know that by adjusting the Metric I could achieve priority between the routing rules, but the problem is that the lowest Metric is the one with highest priority and I don't think I can set a non-zero priority for those bridges created by docker automatically. – Zoltan Fedor Jun 20 '18 at 20:52
2

The Docker bridge network is just one of many options for configuring the networking. The Docker network documentation lists many different network plugins you can use for communications with containers.

If you just need to connect to a service in a Docker container, messing with the network is a bit overkill as you are able to open a service port on the host attached to port in Docker. Docker calls this "publishing ports" and is used in the docker run command with the flag --publish or -p. There should be no need to connect to a Docker container directly.

Though, if you do want to connect directly to the container, Docker will certainly let you configure that.

EDIT: I misunderstood the original question was about host routing.

Regarding host routing, Docker does let you change the network ranges it uses. If you are using docker to create your networks, you can configure the docker0 interface to whatever range you want, make sure to pick one not currently in use on your network.

If you use docker-compose to create the networks, then you need to configure the network ranges in the docker-compose.yml file for that project.

  • 1
    I am sorry, probably my description wasn't clear. The issue is not about trying to connect a service in a Docker container. My problem is that on my network there is a service (on a different server, not owned/controlled by me) with ip 172.18.100.101, but I cannot connect to this service, as Docker automatically assigns the 172.18.0.0 range to a bridge network it creates. – Zoltan Fedor Jun 21 '18 at 14:29
  • 1
    ok, now I see the routes with overlapping subnets on 172.18.0.0/255.255.0.0 and understand the issue better. I have made an edit with some info that might help. – GracefulRestart Jun 21 '18 at 22:20
  • Thanks. Yes, we use docker-compose, which is why I was hoping to find something better than hardcoding into each project's docker-compose.yml file the network range to be used as with multiple projects deployed on multiple nodes that is a maintenance nightmare (to make sure that they never clash with each other). This is why I was hoping to find a more elegant solution. – Zoltan Fedor Jun 27 '18 at 18:39
0

Routes with larger prefixes (like your 172.18.100.101 host route) will have higher priority than routes with a smaller prefix (like the /16 routes added by docker). So, your initial approach should work. However, unless 172.18.100.101 is directly reachable on eth0, you will need to specify a gateway for it as well.

e.g:

ip route add 172.18.100.101/32 via 10.x.x.x dev eth0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.