Network Setup With runC Containers

Note: This post is part of a series Beginner’s Guide to runC

So far we went through setting up basic containers with runC, managed them and even ran them without as regular users. What we are missing at this point is the big piece of networking. OF course containers can be used without any network connectivity but many use cases of containers need the containers to talk to the host and/or other containers.

We need to understand that when we start a runC container with the spec config, there is no network of any sort(except for the loopback interface which is not enough to talk to others) . We need to setup network inside the network namespace container runs with. For this we can use ‘ip’ command with ‘netns’ option. I’ll make the configuration commands in bold, os we can see those separately from the commands to check/verify the results. Let’s list our current network namespaces we created:

So there is nothing so far. So let’s create one and list again:

Then we add a veth pair which is basically a virtual network cable between the host and the container where anythign that goes in from one side comes out form the other side.

So here we now have 2 more network interfaces added to default namespace (which is used by the host). Let’s move the veth-alpine to the network namespace we created.

Alright. We moved the 3rd interface (veth-alpine) to another network namespace so we donot see it here. But is it where it is supposed to be?

As we can see here veth-alpine is now in alpine_network(-netns alpine_network option on the ip command tells ip command to use that space instead of default)

So we set an IP address on the interface and brought it up (We also brought up the lo-loopback address which we did not have to but it’s a good thing to have if the container will talk to itself on that) . The last command verifies this.

We should also bring up the other side of the veth(veth-host), so they can communicate.

So now, let’s setup routes on the host and the container to finish this setup.

We finished this network setup. Now let’s see if we can do the basic network test. Can I ping the container IP from the host?

Yay! We are now able to ping the container IP from the host.

Run our container in the new Network Namespace

So we have a network setup of a new network name space and an interface in it that we configured routes to talk to. Where is the container? It’s time to put a container in this new network space .

Network namespaces are defined under ‘/var/run/netns’ . Let’s check:

To set network namespace of container we modify config.json file as :

Let’s start an alpine container with this config and check interfaces/routes. Note that I’m not using -namespace option for the ‘ip’ commands inside the container:

Tomcat runC container with networking setup

In Quick start to runC with Tomcat container article, I had said “Of course at this point network is not configured, container is running without any network setup whatsoever, but this gives a good idea of running a simple container with runc” . So I’m going to revisit that Tomcat container again. Let’s change the config.json file of the Tomcat container to join this network namespace, with no other changes. We’re just adding the ‘path’ to the network namespace instead of a blank one:

Start the container:

So, the big test is can I reach tomcat from the host machine? In another window, I’m going to use ‘curl’ command line client to send an http request form the host to the Tomcat running inside the container.

Yes.

This series about runC continues here → runC and Docker Together

Happy containerizing…

Have been passionately working with computers since childhood. My first programming language was BASIC, my last one is Go. Now I’m mostly into containers :)