0

My Linux host has a bridge device br0, and I have created an arch Linux container but it isn't able to access the internet.

When the container is started the veth device appears on the host:

[host]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
    link/ether 74:d4:35:70:0b:2f brd ff:ff:ff:ff:ff:ff
    inet6 fe80::76d4:35ff:fe70:b2f/64 scope link 
       valid_lft forever preferred_lft forever
3: tap0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast master br0 state DOWN group default qlen 1000
    link/ether be:b3:74:db:60:5f brd ff:ff:ff:ff:ff:ff
4: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 74:d4:35:70:0b:2f brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.44/24 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::76d4:35ff:fe70:b2f/64 scope link 
       valid_lft forever preferred_lft forever
37: veth2G6SCA@if36: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UP group default qlen 1000
    link/ether fe:5d:8a:48:81:74 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 169.254.192.90/16 brd 169.254.255.255 scope global noprefixroute veth2G6SCA
       valid_lft forever preferred_lft forever
    inet6 fe80::fc5d:8aff:fe48:8174/64 scope link 
       valid_lft forever preferred_lft forever

and the following routes (with *** next to them) appear:

[host]# ip route
default via 192.168.1.254 dev br0 proto static 
default dev veth2G6SCA scope link src 169.254.192.90 metric 237 ***
169.254.0.0/16 dev veth2G6SCA scope link src 169.254.192.90 metric 237 ***
192.168.1.0/24 dev br0 proto kernel scope link src 192.168.1.44 

Inside the container

[container]# ip addr
38: eth0@if39: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:16:3e:86:c2:9f brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::216:3eff:fe86:c29f/64 scope link 
       valid_lft forever preferred_lft forever
[container]# ip route

The container isn't able to ping ip addresses or domains.

systemctl shows networkd and resolved failed:

[container]# systemctl
...
● systemd-networkd.service          loaded failed failed    Network Service                                                              
● systemd-resolved.service          loaded failed failed    Network Name Resolution                                                      

Using journalctl -r I could find some errors but I didn't understand them.

Feb 03 20:04:53 archie systemd[1]: Stopped Network Service.
Feb 03 20:04:53 archie systemd[1]: systemd-networkd.service: Scheduled restart job, restart counter is at 5.
Feb 03 20:04:53 archie systemd[1]: systemd-networkd.service: Service has no hold-off time (RestartSec=0), scheduling restart.
Feb 03 20:04:53 archie systemd[1]: Failed to start Network Service.
Feb 03 20:04:53 archie systemd[1]: systemd-networkd.service: Failed with result 'exit-code'.
Feb 03 20:04:53 archie systemd[1]: systemd-networkd.service: Main process exited, code=exited, status=226/NAMESPACE
Feb 03 20:04:53 archie systemd[29]: systemd-networkd.service: Failed at step NAMESPACE spawning /usr/lib/systemd/systemd-networkd: Permission>
Feb 03 20:04:53 archie systemd[29]: systemd-networkd.service: Failed to set up mount namespacing: Permission denied
Feb 03 20:04:53 archie systemd[1]: Starting Network Service...

I looked up that 169.254 ip addresses are a result of failed DHCP.

I tried to edit the systemd-networkd config file in the container to use a static IP address like the example from here: https://wiki.archlinux.org/index.php/systemd-networkd#Usage_with_containers

[container]# cat /etc/systemd/network/eth0.network
[Match]
Name=eth0

[Network]
Address=192.168.1.77/24
Gateway=192.168.1.254
DNS=8.8.8.8

but networking still does not work and the same errors occur.

How can I get networking to work inside the container?

Thanks!

0

I'm used to make this run using opensvc agent managing my lxc containers.

Please find below a sample service configuration :

[DEFAULT]
nodes = {clusternodes}
encapnodes = {container#1.name}
nodes@encapnodes = {container#1.name}

[disk#1]
type = zpool
name = {env.zfspool}
scsireserv = true
shared = true

[fs#root]
dev = {env.zfspool}
mnt = /srv/{svcname}
type = zfs
shared = true

[fs#container]
dev = {env.zfspool}/rootfs
mnt = {fs#root.mnt}/rootfs
type = zfs
shared = true

[container#1]
name = {env.lxcname}
type = lxc
rootfs = {fs#container.mnt}
shared = true

[ip#1]
type = netns
ipdev = {env.ipdev}
ipname = {env.ipname}
netmask = {env.netmask}
gateway = {env.gateway}
netns = container#1
shared = true

[env]
zfspool = {svcname}
lxcname = {svcname}
ipdev = br0
ipname = lxc.acme.com
netmask = 24
gateway = 10.11.12.1

As you can see in the ip#1 section, there is a reference to container#1 section; it means that when the opensvc service will start, the opensvc agent will inject the ip configuration into the container referenced.

{svcname} is a reference to the actual opensvc service name.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.