This document discusses Docker's new multi-host networking capabilities introduced in version 1.9. It uses overlay networks with VXLAN transport and key-value stores for cluster discovery to allow containers on different Docker hosts to communicate securely over a virtual network without port mappings. The new networking model addresses challenges with the previous single-host approach and enables use cases like multi-tenancy, segmentation, and multi-cloud networks.
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
The New World of Docker Networking
1. The New World ofThe New World of
Docker NetworkingDocker Networking
2. 12
Nicola Kabar
|| nicola@docker.com
Solutions Architect at Docker
Help Customers Design Solutions based on Docker
CCIE (for those who care)
Favorite Moto : "Ping works. Not my problem !!!"
@nicolakabar
7. 7
The New Multi-Host NetworkingThe New Multi-Host Networking
Exited experimental in 1.9
Batteries included: `overlay` network driver + IPAM
New network API + UX
Network Driver + IPAM Plugins
Integration with Swarm and Compose ( --x-networking )
$ docker network --help
Usage: docker network [OPTIONS] COMMAND [OPTIONS]
Commands:
disconnect Disconnect container from a network
inspect Display detailed network information
ls List all networks
rm Remove a network
create Create a network
connect Connect container to a network
8. 8
Under the HoodUnder the Hood
1. VXLAN ==> Data Transport
Virtual eXtensible Local Area Networks
L2 Network over an L3 network ( overlay )
RFC7348
Invisible to the container
Host as VXLAN Tunnel End Point (VTEP)
Point-to-Multi-Point Tunnels
Proxy-ARP
9. 9
Under the HoodUnder the Hood
2. Key-Value Store ==> Cluster Discovery ( Strongly Consistent)
support etcd, zookeeper,consul,boltdb
store Network ID, Subnets, Nodes, VXLAN ID, IPAM...etc
3. Serf ==> Cluster Discovery (Eventually Consistent)
Gossip protocol
Propagates cluster updates(e.g MAC <> VTEP IP mapping)
10. 10
Under the HoodUnder the Hood
4 . Network Namespaces ==> Host + Container Networks
A Linux Bridge per Subnet per Overlay Network per Host
A VXLAN interface per Overlay Network per Host
1 Linux Bridge per Host for default traffic (docker_gwbridge)
Lazy creation ( Only if container is attached to network)
11. 11
RequirementsRequirements
Linux Kernel 3.16+
Docker Engine 1.9
Underlying Open TCP/UDP Ports
Docker Engine port (e.g TCP 2376)
VXLAN: UDP 4789
Serf: TCP + UDP 7946
Key-value store ( e.g for Consul TCP 8500)
Swarm 1.0
Compose 1.5
12. 12
Configuration WorkflowConfiguration Workflow
1. Create K/V Store
2. Configure Engines with `cluster-store` and `cluster-advertise`
3. Create Overlays with `docker network create -d oberlay BLUE`
4. Run containers with `--net BLUE`
$ docker network create -d overlay --subnet 10.10.10.0/24 BLUE
68478121f0a73b7c27854f5ac7a7750bcb4bd1400d2fc20f1c1303aa72a5dfd5
$ docker network ls
NETWORK ID NAME DRIVER
68478121f0a7 BLUE overlay
3748cf0d06c5 none null
c7be99c9c48f host host
418e521b16a0 bridge bridge