1

On my Ubuntu 22.04 host, I've created a Docker network with the bridge driver and started up a container within that network.

Running ip addr on my host, I see these two interfaces:

5: br-fc7599764562: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:d4:4f:b9:39 brd ff:ff:ff:ff:ff:ff
    inet 172.21.0.1/16 brd 172.21.255.255 scope global br-fc7599764562
        valid_lft forever preferred_lft forever
    inet6 fe80::42:d4ff:fe4f:b939/64 scope link
        valid_lftforever preferred_lft forever
6: vethe6879a0@if14: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-fc7599764562 state UP group default
    link/ether e2:e8:0f:5b:37:a0 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::e0e8:fff:fe5b:37a0/64 scope link
        valid_lft forever preferred_lft forever

Clearly, these two interfaces are related as the second lists the first as "master". What is the relationship?

Some context for the question: I actually have two Docker networks with one container inside each. Using iptables, I've set up NAT between them (or, at least, I think I have) and am trying to ping one container from the other. Running Wireshark on the host, I see the ICMP packet come in on the bridge interface and going out on the veth interface (instead of the other bridge).

1 Answer 1

4

A bridge device is a virtual switch. A veth interface is a virtual ethernet cable that connects the container to the "switch": when you create a veth device, you get two interfaces; Docker puts one interface inside the container (that becomes eth0 in the container), and the other end of the device is attached to the bridge.

This article has some additional details on veth devices and a general overview of various other virtual interface types.

6
  • So, is veth what is used to connect the container to my host's network (so that it can access, e.g., the internet)? Commented Apr 27, 2023 at 19:01
  • 1
    A veth device is what connects your container to the bridge device. After that, it becomes a matter of routing: your system's routing table and netfilter ("iptables") rules control what happens to packets that come in on the bridge interface (and if you're on MacOS or Windows, there are additional layers caused by the fact that docker is running inside a virtual machine).
    – larsks
    Commented Apr 27, 2023 at 19:13
  • 1
    @DanielWalker when you create veths, they are always created in pairs. They are used to connect 2 things. Image it like being a cable, it has two ends. You put the first end in the container network namespace (as eth0) and the other end is connected to the bridge. The Docker bridge is a special kind of virtual network that let's you use your host as the router for other virtual devices. So basically, your host is the router for the containers. Remember that a router can have multiple subnets, so the bridge is the (virtual) subnet to which the (virutal devices) containers are attached.
    – AFP_555
    Commented Sep 22, 2023 at 0:59
  • @DanielWalker And now that the containers are attached to the bridge, they are configured to see your host as the gateway. That's why the host always has the "x.x.x.1" IP in the bridge network, because it is literally the router/gateway. The same way your home router IP is something like "192.168.1.1". The containers send the traffic to the host and then the host decides where to route the traffic to... To the internet? To other containers? The routing table and firewall rules in the host will determine what happens to the packets.
    – AFP_555
    Commented Sep 22, 2023 at 1:06
  • 1
    @AFP_555, want to post that as its own answer? Commented Sep 28, 2023 at 15:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .