8000 Merge pull request #4994 from robmry/47639_per-interface-sysctls · docker/cli@8ed44f9 · GitHub
[go: up one dir, main page]
Skip to content

Commit 8ed44f9

Browse files
akerouantonakerouanton
authored
Merge pull request #4994 from robmry/47639_per-interface-sysctls
Document CLI support for per interface sysctls
2 parents 4d28ae9 + d5d94e4 commit 8ed44f9

File tree

4 files changed

+124
-27
lines changed

4 files changed

+124
-27
lines changed

‎cli/command/network/connect_test.go‎

Lines changed: 27 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -43,27 +43,41 @@ func TestNetworkConnectErrors(t *testing.T) {
4343
}
4444

4545
func TestNetworkConnectWithFlags(t *testing.T) {
46-
expectedOpts := []network.IPAMConfig{
47-
{
48-
Subnet: "192.168.4.0/24",
49-
IPRange: "192.168.4.0/24",
50-
Gateway: "192.168.4.1/24",
51-
AuxAddress: map[string]string{},
46+
expectedConfig := &network.EndpointSettings{
47+
IPAMConfig: &network.EndpointIPAMConfig{
48+
IPv4Address: "192.168.4.1",
49+
IPv6Address: "fdef:f401:8da0:1234::5678",
50+
LinkLocalIPs: []string{"169.254.42.42"},
51+
},
52+
Links: []string{"otherctr"},
53+
Aliases: []string{"poor-yorick"},
54+
DriverOpts: map[string]string{
55+
"driveropt1": "optval1,optval2",
56+
"driveropt2": "optval4",
5257
},
5358
}
5459
cli := test.NewFakeCli(&fakeClient{
5560
networkConnectFunc: func(ctx context.Context, networkID, container string, config *network.EndpointSettings) error {
56-
assert.Check(t, is.DeepEqual(expectedOpts, config.IPAMConfig), "not expected driver error")
61+
assert.Check(t, is.DeepEqual(expectedConfig, config))
5762
return nil
5863
},
5964
})
60-
args := []string{"banana"}
61-
cmd := newCreateCommand(cli)
65+
args := []string{"mynet", "myctr"}
66+
cmd := newConnectCommand(cli)
6267

6368
cmd.SetArgs(args)
64-
cmd.Flags().Set("driver", "foo")
65-
cmd.Flags().Set("ip-range", "192.168.4.0/24")
66-
cmd.Flags().Set("gateway", "192.168.4.1/24")
67-
cmd.Flags().Set("subnet", "192.168.4.0/24")
69+
for _, opt := range []struct{ name, value string }{
70+
{"alias", "poor-yorick"},
71+
{"driver-opt", "\"driveropt1=optval1,optval2\""},
72+
{"driver-opt", "driveropt2=optval3"},
73+
{"driver-opt", "driveropt2=optval4"}, // replaces value
74+
{"ip", "192.168.4.1"},
75+
{"ip6", "fdef:f401:8da0:1234::5678"},
76+
{"link", "otherctr"},
77+
{"link-local-ip", "169.254.42.42"},
78+
} {
79+
err := cmd.Flags().Set(opt.name, opt.value)
80+
assert.Check(t, err)
81+
}
6882
assert.NilError(t, cmd.Execute())
6983
}

‎docs/reference/commandline/container_run.md‎

Lines changed: 63 additions & 14 deletions
< 6D38 /tr>
Original file line numberDiff line numberDiff line change
@@ -707,7 +707,24 @@ For additional information on working with labels, see
707707

708708
To start a container and connect it to a network, use the `--network` option.
709709

710-
The following commands create a network named `my-net` and adds a `busybox` container
710+
If you want to add a running container to a network use the `docker network connect` subcommand.
711+
712+
You can connect multiple containers to the same network. Once connected, the
713+
containers can communicate using only another container's IP address
714+
or name. For `overlay` networks or custom plugins that support multi-host
715+
connectivity, containers connected to the same multi-host network but launched
716+
from different Engines can also communicate in this way.
717+
718+
> **Note**
719+
>
720+
> The default bridge network only allows containers to communicate with each other using
721+
> internal IP addresses. User-created bridge networks provide DNS resolution between
722+
> containers using container names.
723+
724+
You can disconnect a container from a network using the `docker network
725+
disconnect` command.
726+
727+
The following commands create a network named `my-net` and add a `busybox` container
711728
to the `my-net` network.
712729

713730
```console
@@ -724,24 +741,56 @@ $ docker network create --subnet 192.0.2.0/24 my-net
724741
$ docker run -itd --network=my-net --ip=192.0.2.69 busybox
725742
```
726743

727-
If you want to add a running container to a network use the `docker network connect` subcommand.
744+
To connect the container to more than one network, repeat the `--network` option.
728745

729-
You can connect multiple containers to the same network. Once connected, the
730-
containers can communicate using only another container's IP address
731-
or name. For `overlay` networks or custom plugins that support multi-host
732-
connectivity, containers connected to the same multi-host network but launched
733-
from different Engines can also communicate in this way.
746+
```console
747+
$ docker network create --subnet 192.0.2.0/24 my-net1
748+
$ docker network create --subnet 192.0.3.0/24 my-net2
749+
$ docker run -itd --network=my-net1 --network=my-net2 busybox
750+
```
751+
752+
To specify options when connecting to more than one network, use the extended syntax
753+
for the `--network` flag. Comma-separated options that can be specified in the extended
754+
`--network` syntax are:
755+
756+
| Option | Top-level Equivalent | Description |
757+
|-----------------|---------------------------------------|-------------------------------------------------|
758+
| `name` | | The name of the network (mandatory) |
759+
| `alias` | `--network-alias` | Add network-scoped alias for the container |
760+
| `ip` | `--ip` | IPv4 address (e.g., 172.30.100.104) |
761+
| `ip6` | `--ip6` | IPv6 address (e.g., 2001:db8::33) |
762+
| `mac-address` | `--mac-address` | Container MAC address (e.g., 92:d0:c6:0a:29:33) |
763+
| `link-local-ip` | `--link-local-ip` | Container IPv4/IPv6 link-local addresses |
764+
| `driver-opt` | `docker network connect --driver-opt` | Network driver options |
765+
766+
```console
767+
$ docker network create --subnet 192.0.2.0/24 my-net1
768+
$ docker network create --subnet 192.0.3.0/24 my-net2
769+
$ docker run -itd --network=name=my-net1,ip=192.0.2.42 --network=name=my-net2,ip=192.0.3.42 busybox
770+
```
771+
772+
`sysctl` settings that start with `net.ipv4.`, `net.ipv6.` or `net.mpls.` can be
773+
set per-interface using `driver-opt` label `com.docker.network.endpoint.sysctls`.
774+
The interface name must be the string `IFNAME`.
775+
776+
To set more than one `sysctl` for an interface, quote the whole `driver-opt` field,
777+
remembering to escape the quotes for the shell if necessary. For example, if the
778+
interface to `my-net` is given name `eth0`, the following example sets sysctls
779+
`net.ipv4.conf.eth0.log_martians=1` and `net.ipv4.conf.eth0.forwarding=0`, and
780+
assigns the IPv4 address `192.0.2.42`.
781+
782+
```console
783+
$ docker network create --subnet 192.0.2.0/24 my-net
784+
$ docker run -itd --network=name=my-net,\"driver-opt=com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1,net.ipv4.conf.IFNAME.forwarding=0\",ip=192.0.2.42 busybox
785+
```
734786

735787
> **Note**
736788
>
737-
> The default bridge network only allow containers to communicate with each other using
738-
> internal IP addresses. User-created bridge networks provide DNS resolution between
739-
> containers using container names.
740-
741-
You can disconnect a container from a network using the `docker network
742-
disconnect` command.
789+
> Network drivers may restrict the sysctl settings that can be modified and, to protect
790+
> the operation of the network, new restrictions may be added in the future.
743791
744-
For more information on connecting a container to a network when using the `run` command, see the ["*Docker network overview*"](https://docs.docker.com/network/).
792+
For more information on connecting a container to a network when using the `run` command,
793+
see the [Docker network overview](https://docs.docker.com/network/).
745794

746795
### <a name="volumes-from"></a> Mount volumes from container (--volumes-from)
747796

‎docs/reference/commandline/network_connect.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,26 @@ being connected to.
6565
$ docker network connect --alias db --alias mysql multi-host-network container2
6666
```
6767

68+
### <a name="sysctl"></a> Set sysctls for a container's interface (--driver-opt)
69+
70+
`sysctl` settings that start with `net.ipv4.` and `net.ipv6.` can be set per-interface
71+
using `--driver-opt` label `com.docker.network.endpoint.sysctls`. The name of the
72+
interface must be replaced by `IFNAME`.
73+
74+
To set more than one `sysctl` for an interface, quote the whole value of the
75+
`driver-opt` field, remembering to escape the quotes for the shell if necessary.
76+
For example, if the interface to `my-net` is given name `eth3`, the following example
77+
sets `net.ipv4.conf.eth3.log_martians=1` and `net.ipv4.conf.eth3.forwarding=0`.
78+
79+
```console
80+
$ docker network connect --driver-opt=\"com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1,net.ipv4.conf.IFNAME.forwarding=0\" multi-host-network container2
81+
```
82+
83+
> **Note**
84+
>
85+
> Network drivers may restrict the sysctl settings that can be modified and, to protect
86+
> the operation of the network, new restrictions may be added in the future.
87+
6888
### Network implications of stopping, pausing, or restarting containers
6989

7090
You can pause, restart, and stop containers that are connected to a network.

‎opts/network_test.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,20 @@ func TestNetworkOptAdvancedSyntax(t *testing.T) {
9898
},
9999
},
100100
},
101+
{
102+
value: "name=docknet1,\"driver-opt=com.docker.network.endpoint.sysctls=net.ipv6.conf.IFNAME.accept_ra=2,net.ipv6.conf.IFNAME.forwarding=1\"",
103+
expected: []NetworkAttachmentOpts{
104+
{
105+
Target: "docknet1",
106+
Aliases: []string{},
107+
DriverOpts: map[string]string{
108+
// The CLI converts IFNAME to ifname - it probably shouldn't, but the API
109+
// allows ifname to cater for this.
110+
"com.docker.network.endpoint.sysctls": "net.ipv6.conf.ifname.accept_ra=2,net.ipv6.conf.ifname.forwarding=1",
111+
},
112+
},
113+
},
114+
},
101115
}
102116
for _, tc := range testCases {
103117
tc := tc

0 commit comments

Comments
 (0)
0