2

I have created two docker networks.

docker network create --subnet=172.18.0.0/16 Docker_network_1
docker network create --subnet=172.19.0.0/16 Docker_network_2

On each one of them I run two different containers:

docker run --rm -it --name Container_1 --net Docker_network_1  alpine /bin/sh
docker run --rm -it --name Container_2 --net Docker_network_2  alpine /bin/sh

Container_1 has IP 172.18.0.2 whereas Container_2 has IP 172.19.0.2.

From Container_1 I can ping the docker interface IP 172.19.0.1 which belongs to Docker_network_2 but I cannot ping Container_2 IP 172.19.0.2.

I don't understand why since "routing" on my host machine seems correct:

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG    1024   0        0 eth0
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
172.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-ea28cf2d7108
172.19.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-244606ad6705
4
  • Are you sure Container_1 is on Docker_network_2? From the IP it appears to be on Docker_network_2. – BMitch Feb 2 '17 at 21:44
  • Thanks, it was a copy and paste error. Indeed Container_1 belongs to Docker_network_1. I am still not able to route packets among these networks. – user Feb 2 '17 at 22:05
  • 1
    Please don't manipulate Docker Iptables-rules, just use the proper Docker command to link Containers together like described here and Docker does the iptables magic for you docs.docker.com/v1.5/articles/networking/… – Richard H. Sep 23 '18 at 13:23
  • Thanks, Richard. Based on the documentation you are referring, could you please provide an example in the answers? The example goal should be enabling communication between Container1 and Container2 in the scenario described in the question. – user Sep 24 '18 at 9:54
3

Tailing on @user 's answer. A little bit safer way to do is is to add rules to allow the networks to talk to each other instead of flushing everything.

This is what worked for me:

sudo iptables -I DOCKER-ISOLATION-STAGE-2 -o docker0 -i othernet -j ACCEPT
sudo iptables -I DOCKER-ISOLATION-STAGE-2 -o othernet -i docker0 -j ACCEPT

I have yet to find a non-hacky way to do this automatically.

1

Docker networks are not designed to route between each other, they are intentionally isolated so that you can create groups of applications that can only talk to each other. I suspect this is performed in the iptables rules, but don't quote me on that.

You can, however, add a container to multiple networks. Manually this is done with a docker network connect Docker_network_2 Container_1 command after the container is created (you can split the run command into a create and start command if you need to attach to the network before your entrypoint starts).

Docker compose is useful for wiring multiple containers together across various networks. It lets you define each of the networks each container belongs to, eliminating the need to run multiple docker network connect commands.

2
  • Actually, by using docker network connect Docker_network_2 Container_1, a new interface is created within Container_1 which is directly connected to Docker_network_2. This is not what I am really looking for. I need that packets are sent through the network bridge interface "br-XX" associated with the Docker_network. – user Feb 3 '17 at 0:11
  • still a good answer, didn't know about docker network connect. Thanks ! – Sébastien Nussbaumer Jul 18 '18 at 14:38
1

I have solved the issue by removing DOCKER-ISOLATION chain that Docker sets in iptables:

# iptables --flush DOCKER-ISOLATION

I am not sure if this is a right approach from the security perspective, but it does what I need.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.