How do I connect a docker container to multiple ips on the same macvlan network?

Question

When I attempt to add a second ip address to my docker container in the same macvlan network, using the create, docker network connect, start pattern it appears to override the first ip address.

Steps to reproduce:

1) Create a docker macvlan network:

docker network create -d macvlan \
    --subnet=192.168.100.1/24 \
    -o parent=eth0 pub_net

2) Create a docker container from an image, adding an ip address from the subnet to the container:

docker create \
    --network pub_net \
    --ip=192.168.100.2 \
    -h mycontainer \
    --name mycontainer \
    -ti \
    alpine \
    /bin/sh

3) Add a second ip address with an alias to the container

docker network connect \
    --ip 192.168.100.3 \
    --alias mycontainer-int2 \
    pub_net \
    mycontainer

(and just to be sure, the result of this command was 0 - success)

$ echo $?
0

4) Run it and open it to have a look

$ docker start mycontainer
mycontainer
$ docker attach mycontainer
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
   valid_lft forever preferred_lft forever
inet6 ::1/128 scope host 
   valid_lft forever preferred_lft forever
10: eth0@if2: <NO-CARRIER,BROADCAST,MULTICAST,UP,M-DOWN> mtu 1500 qdisc noqueue state LOWERLAYERDOWN 
    link/ether 02:42:c0:a8:c8:03 brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.3/24 scope global eth0
   valid_lft forever preferred_lft forever
/ # 

And...just to be sure:

$ docker network inspect pub_net
[
    {
        "Name": "pub_net",
        "Id": "578df6fd9929b0c44356e32a04043b358c2a052e11377ee7430743cd48566203",
        "Scope": "local",
        "Driver": "macvlan",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "192.168.100.1/24"
                }
            ]
        },
        "Internal": false,
        "Containers": {
            "7f2fd160b8f7340d75861c1c0f743820ee713b13738a1f09252b0b17da58f111": {
                "Name": "mycontainer",
                "EndpointID": "44af06571b1c6334001cbb13c15702640d93930e30f415052e684a96b0d0a893",
                "MacAddress": "02:42:c0:a8:c8:03",
                "IPv4Address": "192.168.100.3/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "parent": "eth0"
        },
        "Labels": {}
    }
]

How do I correctly add additional IPs (on the same or an additional virtual interface) in the same docker macvlan network to the same docker container?

Answer 1

As an interim answer to my question. It is possible to do this by making two changes:

1) Add --cap-add=NET_ADMIN to the create command, e.g.

docker create \
    --cap-add=NET_ADMIN
    --network pub_net \
    --ip=192.168.100.2 \
    -h mycontainer \
    --name mycontainer \
    -ti \
    alpine \
    /bin/sh

2) Skip step 3 and add the ip address within the docker container:

$ docker start mycontainer
mycontainer
$ docker attach mycontainer
/ # ip a a 192.168.100.3/24 dev eth0
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
   valid_lft forever preferred_lft forever
inet6 ::1/128 scope host 
   valid_lft forever preferred_lft forever
10: eth0@if2: <NO-CARRIER,BROADCAST,MULTICAST,UP,M-DOWN> mtu 1500 qdisc noqueue state LOWERLAYERDOWN 
    link/ether 02:42:c0:a8:c8:03 brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.2/24 scope global eth0
   valid_lft forever preferred_lft forever
    inet 192.168.100.3/24 scope global secondary eth0
   valid_lft forever preferred_lft forever
    / # 

This works, as I can now ping and access the same container via either IP.

However, the caveat is that the IPs must be manually managed. Only the original IP in the create command shows up in docker network inspect