diff --git a/about/index.html b/about/index.html index ef7c36c..45d8b47 100644 --- a/about/index.html +++ b/about/index.html @@ -1,109 +1,12 @@ - - - - - - -About me - 1533B4dC0.de - - - - - - - - - - - - - - - - -Skip to main content -
-
-
-

-1533B4dC0.de -

- -
-

About me

My name’s Peter. I’m a passionate software developer especially interested in all kind of networking stuff but also asynchronous data processing, software architecture, testing and automatic software quality analysis and many more.

I’m the author of InetMock and Goveal (more on projects) but I’m also trying to contribute to other open source projects.

https://www.1533b4dc0.de/about/ +Peter Kurfer
comments powered by Disqus
\ No newline at end of file diff --git a/articles/index.html b/articles/index.html index dd8bd25..3d2b5f7 100644 --- a/articles/index.html +++ b/articles/index.html @@ -1 +1 @@ -https://www.1533b4dc0.de/post/ \ No newline at end of file +https://www.1533b4dc0.de/post/ \ No newline at end of file diff --git a/blog/index.html b/blog/index.html index dd8bd25..3d2b5f7 100644 --- a/blog/index.html +++ b/blog/index.html @@ -1 +1 @@ -https://www.1533b4dc0.de/post/ \ No newline at end of file +https://www.1533b4dc0.de/post/ \ No newline at end of file diff --git a/categories/index.html b/categories/index.html index 23832ef..d681f62 100644 --- a/categories/index.html +++ b/categories/index.html @@ -1,95 +1,8 @@ - - - - - - -Categories - 1533B4dC0.de - - - - - - - - - - - - - - - - - -Skip to main content -
-
-
-

-1533B4dC0.de -

- -
-

Categories

\ No newline at end of file diff --git a/docs/index.html b/docs/index.html index dd8bd25..3d2b5f7 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1 +1 @@ -https://www.1533b4dc0.de/post/ \ No newline at end of file +https://www.1533b4dc0.de/post/ \ No newline at end of file diff --git a/index.html b/index.html index 8f0c5aa..2244d4d 100644 --- a/index.html +++ b/index.html @@ -1,117 +1,10 @@ - - - - - - - -1533B4dC0.de - - - - - - - - - - - - - - - - - -Skip to main content -
-
-
-

-1533B4dC0.de -

- -
-

Libvirt & Podman: network 'mesh'

Disclaimer: I tested all this with Podman 3.x even though Podman 4.0 is already announced but the CNI driver is still available with Podman 4.0 and as soon as I get my hands on 4.0 I’ll give Netavark a try, too! +When playing around with containers and VMs one might ask if it’s possible to bring VMs and containers into a common network segment. I see ‘why the hell would I need a VM anyway when already having containers’ or something similar I almost see on your face 😜
2022-02-24
https://www.1533b4dc0.de/post/libvirt-podman-network-mesh/ +Peter Kurfer
\ No newline at end of file diff --git a/index.xml b/index.xml index 3fa3d0f..bcc600c 100644 --- a/index.xml +++ b/index.xml @@ -6,7 +6,7 @@ </a> </span> </h2><p><a href="https://gitlab.com/inetmock/inetmock">INetMock</a> started as an resource/container friendly alternative to <a href="https://www.inetsim.org/">INetSim</a>. -While working on a project we tried to reduce analysis complexity coming from &lsquo;noise&rsquo; in the network traffic recorded to a central INetSim cluster we were running. +While working on a project we tried to reduce analysis complexity coming from &rsquo;noise&rsquo; in the network traffic recorded to a central INetSim cluster we were running. We decided to decentralize the internet simulation, put it into a container image and run directly on every host multiple times in virtual networks. Unfortunately INetSim has a relatively huge memory footprint (~1GB) which alone wouldn&rsquo;t been a showstopper but in combination with a relatively long startup time I felt having something smaller could be beneficial so I started to implement a prototype in Go.</p> <p>2 years later INetMock has grown to kind of a full router (supporting DNS and DHCP) with support for faking HTTP/s (direct or proxy requests) requests. @@ -40,29 +40,29 @@ So if you try to implement for example your own DHCP server you might want to is </span> </h2><p>Okay now that I came around with <em>some</em> arguments - if they&rsquo;re convincing or not is not important - how does this work?</p> <p>Assuming you&rsquo;ve Libvirt and Podman already installed on your system without any modification and you run</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">virsh net-list -</code></pre></div><p>you should have at least the <code>default</code> network already.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>virsh net-list +</span></span></code></pre></div><p>you should have at least the <code>default</code> network already.</p> <p>The definition of all networks (as of every other component of libvirt) is in XML. <code>virsh</code> comes with a <code>net-dumpxml</code> command to export the configuration of a network:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">virsh net-dumpxml default -</code></pre></div><p>The output should look (more or less) like in the following snippet:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-xml" data-lang="xml"><span style="color:#f92672">&lt;network&gt;</span> -<span style="color:#f92672">&lt;name&gt;</span>default<span style="color:#f92672">&lt;/name&gt;</span> -<span style="color:#f92672">&lt;uuid&gt;</span>8d2028ed-cc9a-4eae-9883-b59b673d560d<span style="color:#f92672">&lt;/uuid&gt;</span> -<span style="color:#f92672">&lt;forward</span> <span style="color:#a6e22e">mode=</span><span style="color:#e6db74">&#39;nat&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;nat&gt;</span> -<span style="color:#f92672">&lt;port</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;1024&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;65535&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/nat&gt;</span> -<span style="color:#f92672">&lt;/forward&gt;</span> -<span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;virbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;63:b3:d8:75:53:6b&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;192.168.122.1&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;dhcp&gt;</span> -<span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;192.168.122.2&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;192.168.122.254&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/dhcp&gt;</span> -<span style="color:#f92672">&lt;/ip&gt;</span> -<span style="color:#f92672">&lt;/network&gt;</span> -</code></pre></div><p>So we&rsquo;ve a <code>&lt;network/&gt;</code> that is defined by:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>virsh net-dumpxml default +</span></span></code></pre></div><p>The output should look (more or less) like in the following snippet:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-xml" data-lang="xml"><span style="display:flex;"><span><span style="color:#f92672">&lt;network&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;name&gt;</span>default<span style="color:#f92672">&lt;/name&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;uuid&gt;</span>8d2028ed-cc9a-4eae-9883-b59b673d560d<span style="color:#f92672">&lt;/uuid&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;forward</span> <span style="color:#a6e22e">mode=</span><span style="color:#e6db74">&#39;nat&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;nat&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;port</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;1024&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;65535&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/nat&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/forward&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;virbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;63:b3:d8:75:53:6b&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;192.168.122.1&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;192.168.122.2&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;192.168.122.254&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/ip&gt;</span> +</span></span><span style="display:flex;"><span><span style="color:#f92672">&lt;/network&gt;</span> +</span></span></code></pre></div><p>So we&rsquo;ve a <code>&lt;network/&gt;</code> that is defined by:</p> <ul> <li>a <code>&lt;name/&gt;</code></li> <li>a <code>&lt;uuid/&gt;</code></li> @@ -78,18 +78,18 @@ So if you try to implement for example your own DHCP server you might want to is <p>The complete reference for the XML schema can be found <a href="https://libvirt.org/formatnetwork.html">here</a>.</p> <p>Before we have a closer look how to bring Podman containers into a Libvirt network, let&rsquo;s define a new <code>containers</code> network. The following snippet contains the definition I&rsquo;ll use:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-xml" data-lang="xml"><span style="color:#f92672">&lt;network&gt;</span> -<span style="color:#f92672">&lt;name&gt;</span>containers<span style="color:#f92672">&lt;/name&gt;</span> -<span style="color:#f92672">&lt;uuid&gt;</span>929b7b7d-bd82-452d-96b7-12f0cf1a4b17<span style="color:#f92672">&lt;/uuid&gt;</span> -<span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;conbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;af:af:13:ed:c6:41&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;10.10.1.42&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;dhcp&gt;</span> -<span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;10.10.1.100&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;10.10.1.150&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/dhcp&gt;</span> -<span style="color:#f92672">&lt;/ip&gt;</span> -<span style="color:#f92672">&lt;/network&gt;</span> -</code></pre></div><p>It&rsquo;s quite similar except I made a few adoptions:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-xml" data-lang="xml"><span style="display:flex;"><span><span style="color:#f92672">&lt;network&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;name&gt;</span>containers<span style="color:#f92672">&lt;/name&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;uuid&gt;</span>929b7b7d-bd82-452d-96b7-12f0cf1a4b17<span style="color:#f92672">&lt;/uuid&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;conbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;af:af:13:ed:c6:41&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;10.10.1.42&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;10.10.1.100&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;10.10.1.150&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/ip&gt;</span> +</span></span><span style="display:flex;"><span><span style="color:#f92672">&lt;/network&gt;</span> +</span></span></code></pre></div><p>It&rsquo;s quite similar except I made a few adoptions:</p> <ul> <li>remove the <code>&lt;forward/&gt;</code> block</li> <li>change the <code>&lt;name/&gt;</code> and the <code>&lt;uuid/&gt;</code> (with the help of <code>uuidgen</code>)</li> @@ -100,18 +100,21 @@ The following snippet contains the definition I&rsquo;ll use:</p> <p>You may use any private network - as far as I can tell it shouldn&rsquo;t matter if you&rsquo;re using a class B, C or D private network as long as you don&rsquo;t have any conflicts with your LAN or any other virtual interfaces of your environment.</p> <p>When done safe your network definition as <code>.xml</code> file. To import the configuration you can use <code>virsh net-define</code> like in the following snippet (assuming the network definition is in <code>containers.xml</code>):</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-define containers.xml -&gt; Network containers defined from containers.xml -</code></pre></div><p><em>Note: this only works because the XML already contains an <code>&lt;uuid/&gt;</code>. Otherwise you&rsquo;d have to use <code>virsh net-create</code> and a few more extra steps to make the network actually persistent.</em></p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-define containers.xml +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers defined from containers.xml +</span></span></code></pre></div><p><em>Note: this only works because the XML already contains an <code>&lt;uuid/&gt;</code>. Otherwise you&rsquo;d have to use <code>virsh net-create</code> and a few more extra steps to make the network actually persistent.</em></p> <p>If you now check with <code>virsh net-list</code> you&rsquo;d be disappointed because there&rsquo;s no network! Checking again with <code>virsh net-list --all</code> explains why our <code>containers</code> network wasn&rsquo;t in the output previously because it is by default <em>inactive</em>. To activate it we&rsquo;ve to start it like so:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-start containers -&gt; Network containers started -</code></pre></div><p>If you don&rsquo;t mind the extra adapter and wish to use the network frequently in the future you might consider to autostart it:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-autostart containers -&gt; Network containers marked as autostarted -</code></pre></div><p>With our custom Libvirt network in place we&rsquo;re good to go to configure Podman.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-start containers +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers started +</span></span></code></pre></div><p>If you don&rsquo;t mind the extra adapter and wish to use the network frequently in the future you might consider to autostart it:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-autostart containers +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers marked as autostarted +</span></span></code></pre></div><p>With our custom Libvirt network in place we&rsquo;re good to go to configure Podman.</p> <h2 id="part-2-podman-cni-network" >Part 2: Podman CNI network <span> <a href="#part-2-podman-cni-network"> @@ -126,70 +129,70 @@ You should find the default network as <code>87-podman.conflist</code> in We will define our own <code>libvirt</code> network to join Podman containers into the previously created Libvirt network. You can either use <code>podman network create</code> to create the network (at least more or less) or you can copy for example the default network and make some adjustments.</p> <p>To create the new network from the CLI you can use the following command:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">podman network create <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --disable-dns <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --internal <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --gateway 10.10.2.37 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --ip-range 10.10.2.160/29 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --subnet 10.10.2.0/24 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> libvirt -</code></pre></div><p>Note that I used a different IP range as in the Libvirt network! Otherwise Podman will complain that the IP range is already in use at an adapter. +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>podman network create <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --disable-dns <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --internal <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --gateway 10.10.2.37 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --ip-range 10.10.2.160/29 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --subnet 10.10.2.0/24 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> libvirt +</span></span></code></pre></div><p>Note that I used a different IP range as in the Libvirt network! Otherwise Podman will complain that the IP range is already in use at an adapter. You can use this command to create the required file in <code>/etc/cni/net.d/</code> but you&rsquo;ve to update the <code>ranges</code> accordingly before creating a container in the network.</p> <p>Because we&rsquo;ve to edit the <code>.conflist</code> either way copy the default one is also fine.</p> <p>The <code>.conflist</code> I&rsquo;m using looks like this:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-json" data-lang="json">{ -<span style="color:#f92672">&#34;cniVersion&#34;</span>: <span style="color:#e6db74">&#34;0.4.0&#34;</span>, -<span style="color:#f92672">&#34;name&#34;</span>: <span style="color:#e6db74">&#34;libvirt&#34;</span>, -<span style="color:#f92672">&#34;plugins&#34;</span>: [ -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;bridge&#34;</span>, -<span style="color:#f92672">&#34;bridge&#34;</span>: <span style="color:#e6db74">&#34;conbr0&#34;</span>, -<span style="color:#f92672">&#34;isGateway&#34;</span>: <span style="color:#66d9ef">false</span>, -<span style="color:#f92672">&#34;hairpinMode&#34;</span>: <span style="color:#66d9ef">true</span>, -<span style="color:#f92672">&#34;ipam&#34;</span>: { -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;host-local&#34;</span>, -<span style="color:#f92672">&#34;routes&#34;</span>: [ -{ -<span style="color:#f92672">&#34;dst&#34;</span>: <span style="color:#e6db74">&#34;0.0.0.0/0&#34;</span> -} -], -<span style="color:#f92672">&#34;ranges&#34;</span>: [ -[ -{ -<span style="color:#f92672">&#34;subnet&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.0/24&#34;</span>, -<span style="color:#f92672">&#34;rangeStart&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.151&#34;</span>, -<span style="color:#f92672">&#34;rangeEnd&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.160&#34;</span>, -<span style="color:#f92672">&#34;gateway&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.42&#34;</span> -} -] -] -} -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;portmap&#34;</span>, -<span style="color:#f92672">&#34;capabilities&#34;</span>: { -<span style="color:#f92672">&#34;portMappings&#34;</span>: <span style="color:#66d9ef">true</span> -} -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;firewall&#34;</span>, -<span style="color:#f92672">&#34;backend&#34;</span>: <span style="color:#e6db74">&#34;&#34;</span> -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;tuning&#34;</span> -} -] -} -</code></pre></div><p>Interestingly the <code>rangeStart</code> and <code>rangeEnd</code> are actually IP addresses and not tight to some IP networks but unfortunately there&rsquo;s no equivalent for <code>podman network create</code> hence I update both to a range after the DHCP range of the Libvirt network to make sure that no duplicate IPs are assigned.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-json" data-lang="json"><span style="display:flex;"><span>{ +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;cniVersion&#34;</span>: <span style="color:#e6db74">&#34;0.4.0&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;name&#34;</span>: <span style="color:#e6db74">&#34;libvirt&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;plugins&#34;</span>: [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;bridge&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;bridge&#34;</span>: <span style="color:#e6db74">&#34;conbr0&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;isGateway&#34;</span>: <span style="color:#66d9ef">false</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;hairpinMode&#34;</span>: <span style="color:#66d9ef">true</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;ipam&#34;</span>: { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;host-local&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;routes&#34;</span>: [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;dst&#34;</span>: <span style="color:#e6db74">&#34;0.0.0.0/0&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ], +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;ranges&#34;</span>: [ +</span></span><span style="display:flex;"><span> [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;subnet&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.0/24&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;rangeStart&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.151&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;rangeEnd&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.160&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;gateway&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.42&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;portmap&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;capabilities&#34;</span>: { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;portMappings&#34;</span>: <span style="color:#66d9ef">true</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;firewall&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;backend&#34;</span>: <span style="color:#e6db74">&#34;&#34;</span> +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;tuning&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span>} +</span></span></code></pre></div><p>Interestingly the <code>rangeStart</code> and <code>rangeEnd</code> are actually IP addresses and not tight to some IP networks but unfortunately there&rsquo;s no equivalent for <code>podman network create</code> hence I update both to a range after the DHCP range of the Libvirt network to make sure that no duplicate IPs are assigned.</p> <p>I tend to declare the network as <code>host-local</code> but this shouldn&rsquo;t be critical. The <strong>most important</strong> part is to update the <code>bridge</code> to the same interface like in the Libvirt network definition (in my case <code>conbr0</code>).</p> <p>After this we&rsquo;re ready to go and you can for instance start a Nginx container in the <code>libvirt</code> network and you should be able to reach it from a VM in the Libvirt network:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">podman run <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --rm <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> -d <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --name nginx <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --network libvirt <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --ip 10.10.1.151 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> docker.io/nginx:alpine -</code></pre></div><p>A nice option for <code>podman run</code> is <code>--ip</code>. -You&rsquo;ve to choose an IP from the previously configured <code>range</code> but you can skip the <code>podman inspect</code> or <code>ip a</code> to get the container IP and the container will have the IP every time you start it, if you like 😉 and speaking of &lsquo;nice&rsquo; <code>podman run</code> options: you do know <code>--replace</code>, don&rsquo;t you?</p> \ No newline at end of file +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>podman run <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --rm <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> -d <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --name nginx <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --network libvirt <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --ip 10.10.1.151 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> docker.io/nginx:alpine +</span></span></code></pre></div><p>A nice option for <code>podman run</code> is <code>--ip</code>. +You&rsquo;ve to choose an IP from the previously configured <code>range</code> but you can skip the <code>podman inspect</code> or <code>ip a</code> to get the container IP and the container will have the IP every time you start it, if you like 😉 and speaking of &rsquo;nice&rsquo; <code>podman run</code> options: you do know <code>--replace</code>, don&rsquo;t you?</p> \ No newline at end of file diff --git a/js/script.min.510c781c39dbb21b4c76d85c82e2bdf4689220adbb7cd61e49e9d293e442fb42.js b/js/script.min.510c781c39dbb21b4c76d85c82e2bdf4689220adbb7cd61e49e9d293e442fb42.js deleted file mode 100644 index 3876006..0000000 --- a/js/script.min.510c781c39dbb21b4c76d85c82e2bdf4689220adbb7cd61e49e9d293e442fb42.js +++ /dev/null @@ -1 +0,0 @@ -document.addEventListener("DOMContentLoaded",function(h){'use strict';if(!document.queryCommandSupported('copy'))return;let a='',d='',e='';function b(b,c){b.innerHTML=c,setTimeout(()=>{b.innerHTML=a},1e3)}function f(a){let b=window.getSelection(),c=document.createRange();return a.childElementCount===2?c.selectNodeContents(a.children[1]):c.selectNodeContents(a),b.removeAllRanges(),b.addRange(c),b}function c(g){let c=document.createElement("button");c.className="highlight-copy-btn",c.innerHTML=a;let h=g.firstElementChild;c.addEventListener('click',()=>{try{let a=f(h);document.execCommand('copy'),a.removeAllRanges(),b(c,d)}catch(a){console&&console.log(a),b(c,e)}}),g.appendChild(c)}let g=document.getElementsByClassName('highlight');Array.prototype.forEach.call(g,c)},!1) \ No newline at end of file diff --git a/js/script.min.a65afe903825231554d9b55b073eb144da4ccf2d2823b216dcbc6cc656c9de76.js b/js/script.min.a65afe903825231554d9b55b073eb144da4ccf2d2823b216dcbc6cc656c9de76.js new file mode 100644 index 0000000..7ac0f35 --- /dev/null +++ b/js/script.min.a65afe903825231554d9b55b073eb144da4ccf2d2823b216dcbc6cc656c9de76.js @@ -0,0 +1 @@ +document.addEventListener("DOMContentLoaded",function(){'use strict';if(!document.queryCommandSupported("copy"))return;let e='',s='',o='';function t(t,n){t.innerHTML=n,setTimeout(()=>{t.innerHTML=e},1e3)}function i(e){let t=window.getSelection(),n=document.createRange();return e.childElementCount===2?n.selectNodeContents(e.children[1]):n.selectNodeContents(e),t.removeAllRanges(),t.addRange(n),t}function n(a){let n=document.createElement("button");n.className="highlight-copy-btn",n.innerHTML=e;let r=a.firstElementChild;n.addEventListener("click",()=>{try{let e=i(r);document.execCommand("copy"),e.removeAllRanges(),t(n,s)}catch(e){console&&console.log(e),t(n,o)}}),a.appendChild(n)}let a=document.getElementsByClassName("highlight");Array.prototype.forEach.call(a,n)},!1) \ No newline at end of file diff --git a/page/1/index.html b/page/1/index.html index 93372d2..1fa1c63 100644 --- a/page/1/index.html +++ b/page/1/index.html @@ -1 +1 @@ -https://www.1533b4dc0.de/ \ No newline at end of file +https://www.1533b4dc0.de/ \ No newline at end of file diff --git a/post/index.html b/post/index.html index 57af963..d8c2887 100644 --- a/post/index.html +++ b/post/index.html @@ -1,113 +1,9 @@ - - - - - - -Posts - 1533B4dC0.de - - - - - - - - - - - - - - - - - -Skip to main content -
-
-
-

-1533B4dC0.de -

- -
-

Posts

Libvirt & Podman: network 'mesh'

2022-02-24
https://www.1533b4dc0.de/post/libvirt-podman-network-mesh/ +Peter Kurfer
\ No newline at end of file diff --git a/post/index.xml b/post/index.xml index 65a7f7b..0fd370b 100644 --- a/post/index.xml +++ b/post/index.xml @@ -14,29 +14,29 @@ So if you try to implement for example your own DHCP server you might want to is </span> </h2><p>Okay now that I came around with <em>some</em> arguments - if they&rsquo;re convincing or not is not important - how does this work?</p> <p>Assuming you&rsquo;ve Libvirt and Podman already installed on your system without any modification and you run</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">virsh net-list -</code></pre></div><p>you should have at least the <code>default</code> network already.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>virsh net-list +</span></span></code></pre></div><p>you should have at least the <code>default</code> network already.</p> <p>The definition of all networks (as of every other component of libvirt) is in XML. <code>virsh</code> comes with a <code>net-dumpxml</code> command to export the configuration of a network:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">virsh net-dumpxml default -</code></pre></div><p>The output should look (more or less) like in the following snippet:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-xml" data-lang="xml"><span style="color:#f92672">&lt;network&gt;</span> -<span style="color:#f92672">&lt;name&gt;</span>default<span style="color:#f92672">&lt;/name&gt;</span> -<span style="color:#f92672">&lt;uuid&gt;</span>8d2028ed-cc9a-4eae-9883-b59b673d560d<span style="color:#f92672">&lt;/uuid&gt;</span> -<span style="color:#f92672">&lt;forward</span> <span style="color:#a6e22e">mode=</span><span style="color:#e6db74">&#39;nat&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;nat&gt;</span> -<span style="color:#f92672">&lt;port</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;1024&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;65535&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/nat&gt;</span> -<span style="color:#f92672">&lt;/forward&gt;</span> -<span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;virbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;63:b3:d8:75:53:6b&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;192.168.122.1&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;dhcp&gt;</span> -<span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;192.168.122.2&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;192.168.122.254&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/dhcp&gt;</span> -<span style="color:#f92672">&lt;/ip&gt;</span> -<span style="color:#f92672">&lt;/network&gt;</span> -</code></pre></div><p>So we&rsquo;ve a <code>&lt;network/&gt;</code> that is defined by:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>virsh net-dumpxml default +</span></span></code></pre></div><p>The output should look (more or less) like in the following snippet:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-xml" data-lang="xml"><span style="display:flex;"><span><span style="color:#f92672">&lt;network&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;name&gt;</span>default<span style="color:#f92672">&lt;/name&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;uuid&gt;</span>8d2028ed-cc9a-4eae-9883-b59b673d560d<span style="color:#f92672">&lt;/uuid&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;forward</span> <span style="color:#a6e22e">mode=</span><span style="color:#e6db74">&#39;nat&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;nat&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;port</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;1024&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;65535&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/nat&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/forward&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;virbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;63:b3:d8:75:53:6b&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;192.168.122.1&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;192.168.122.2&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;192.168.122.254&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/ip&gt;</span> +</span></span><span style="display:flex;"><span><span style="color:#f92672">&lt;/network&gt;</span> +</span></span></code></pre></div><p>So we&rsquo;ve a <code>&lt;network/&gt;</code> that is defined by:</p> <ul> <li>a <code>&lt;name/&gt;</code></li> <li>a <code>&lt;uuid/&gt;</code></li> @@ -52,18 +52,18 @@ So if you try to implement for example your own DHCP server you might want to is <p>The complete reference for the XML schema can be found <a href="https://libvirt.org/formatnetwork.html">here</a>.</p> <p>Before we have a closer look how to bring Podman containers into a Libvirt network, let&rsquo;s define a new <code>containers</code> network. The following snippet contains the definition I&rsquo;ll use:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-xml" data-lang="xml"><span style="color:#f92672">&lt;network&gt;</span> -<span style="color:#f92672">&lt;name&gt;</span>containers<span style="color:#f92672">&lt;/name&gt;</span> -<span style="color:#f92672">&lt;uuid&gt;</span>929b7b7d-bd82-452d-96b7-12f0cf1a4b17<span style="color:#f92672">&lt;/uuid&gt;</span> -<span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;conbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;af:af:13:ed:c6:41&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;10.10.1.42&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;dhcp&gt;</span> -<span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;10.10.1.100&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;10.10.1.150&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/dhcp&gt;</span> -<span style="color:#f92672">&lt;/ip&gt;</span> -<span style="color:#f92672">&lt;/network&gt;</span> -</code></pre></div><p>It&rsquo;s quite similar except I made a few adoptions:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-xml" data-lang="xml"><span style="display:flex;"><span><span style="color:#f92672">&lt;network&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;name&gt;</span>containers<span style="color:#f92672">&lt;/name&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;uuid&gt;</span>929b7b7d-bd82-452d-96b7-12f0cf1a4b17<span style="color:#f92672">&lt;/uuid&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;conbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;af:af:13:ed:c6:41&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;10.10.1.42&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;10.10.1.100&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;10.10.1.150&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/ip&gt;</span> +</span></span><span style="display:flex;"><span><span style="color:#f92672">&lt;/network&gt;</span> +</span></span></code></pre></div><p>It&rsquo;s quite similar except I made a few adoptions:</p> <ul> <li>remove the <code>&lt;forward/&gt;</code> block</li> <li>change the <code>&lt;name/&gt;</code> and the <code>&lt;uuid/&gt;</code> (with the help of <code>uuidgen</code>)</li> @@ -74,18 +74,21 @@ The following snippet contains the definition I&rsquo;ll use:</p> <p>You may use any private network - as far as I can tell it shouldn&rsquo;t matter if you&rsquo;re using a class B, C or D private network as long as you don&rsquo;t have any conflicts with your LAN or any other virtual interfaces of your environment.</p> <p>When done safe your network definition as <code>.xml</code> file. To import the configuration you can use <code>virsh net-define</code> like in the following snippet (assuming the network definition is in <code>containers.xml</code>):</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-define containers.xml -&gt; Network containers defined from containers.xml -</code></pre></div><p><em>Note: this only works because the XML already contains an <code>&lt;uuid/&gt;</code>. Otherwise you&rsquo;d have to use <code>virsh net-create</code> and a few more extra steps to make the network actually persistent.</em></p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-define containers.xml +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers defined from containers.xml +</span></span></code></pre></div><p><em>Note: this only works because the XML already contains an <code>&lt;uuid/&gt;</code>. Otherwise you&rsquo;d have to use <code>virsh net-create</code> and a few more extra steps to make the network actually persistent.</em></p> <p>If you now check with <code>virsh net-list</code> you&rsquo;d be disappointed because there&rsquo;s no network! Checking again with <code>virsh net-list --all</code> explains why our <code>containers</code> network wasn&rsquo;t in the output previously because it is by default <em>inactive</em>. To activate it we&rsquo;ve to start it like so:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-start containers -&gt; Network containers started -</code></pre></div><p>If you don&rsquo;t mind the extra adapter and wish to use the network frequently in the future you might consider to autostart it:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-autostart containers -&gt; Network containers marked as autostarted -</code></pre></div><p>With our custom Libvirt network in place we&rsquo;re good to go to configure Podman.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-start containers +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers started +</span></span></code></pre></div><p>If you don&rsquo;t mind the extra adapter and wish to use the network frequently in the future you might consider to autostart it:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-autostart containers +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers marked as autostarted +</span></span></code></pre></div><p>With our custom Libvirt network in place we&rsquo;re good to go to configure Podman.</p> <h2 id="part-2-podman-cni-network" >Part 2: Podman CNI network <span> <a href="#part-2-podman-cni-network"> @@ -100,70 +103,70 @@ You should find the default network as <code>87-podman.conflist</code> in We will define our own <code>libvirt</code> network to join Podman containers into the previously created Libvirt network. You can either use <code>podman network create</code> to create the network (at least more or less) or you can copy for example the default network and make some adjustments.</p> <p>To create the new network from the CLI you can use the following command:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">podman network create <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --disable-dns <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --internal <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --gateway 10.10.2.37 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --ip-range 10.10.2.160/29 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --subnet 10.10.2.0/24 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> libvirt -</code></pre></div><p>Note that I used a different IP range as in the Libvirt network! Otherwise Podman will complain that the IP range is already in use at an adapter. +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>podman network create <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --disable-dns <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --internal <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --gateway 10.10.2.37 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --ip-range 10.10.2.160/29 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --subnet 10.10.2.0/24 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> libvirt +</span></span></code></pre></div><p>Note that I used a different IP range as in the Libvirt network! Otherwise Podman will complain that the IP range is already in use at an adapter. You can use this command to create the required file in <code>/etc/cni/net.d/</code> but you&rsquo;ve to update the <code>ranges</code> accordingly before creating a container in the network.</p> <p>Because we&rsquo;ve to edit the <code>.conflist</code> either way copy the default one is also fine.</p> <p>The <code>.conflist</code> I&rsquo;m using looks like this:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-json" data-lang="json">{ -<span style="color:#f92672">&#34;cniVersion&#34;</span>: <span style="color:#e6db74">&#34;0.4.0&#34;</span>, -<span style="color:#f92672">&#34;name&#34;</span>: <span style="color:#e6db74">&#34;libvirt&#34;</span>, -<span style="color:#f92672">&#34;plugins&#34;</span>: [ -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;bridge&#34;</span>, -<span style="color:#f92672">&#34;bridge&#34;</span>: <span style="color:#e6db74">&#34;conbr0&#34;</span>, -<span style="color:#f92672">&#34;isGateway&#34;</span>: <span style="color:#66d9ef">false</span>, -<span style="color:#f92672">&#34;hairpinMode&#34;</span>: <span style="color:#66d9ef">true</span>, -<span style="color:#f92672">&#34;ipam&#34;</span>: { -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;host-local&#34;</span>, -<span style="color:#f92672">&#34;routes&#34;</span>: [ -{ -<span style="color:#f92672">&#34;dst&#34;</span>: <span style="color:#e6db74">&#34;0.0.0.0/0&#34;</span> -} -], -<span style="color:#f92672">&#34;ranges&#34;</span>: [ -[ -{ -<span style="color:#f92672">&#34;subnet&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.0/24&#34;</span>, -<span style="color:#f92672">&#34;rangeStart&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.151&#34;</span>, -<span style="color:#f92672">&#34;rangeEnd&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.160&#34;</span>, -<span style="color:#f92672">&#34;gateway&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.42&#34;</span> -} -] -] -} -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;portmap&#34;</span>, -<span style="color:#f92672">&#34;capabilities&#34;</span>: { -<span style="color:#f92672">&#34;portMappings&#34;</span>: <span style="color:#66d9ef">true</span> -} -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;firewall&#34;</span>, -<span style="color:#f92672">&#34;backend&#34;</span>: <span style="color:#e6db74">&#34;&#34;</span> -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;tuning&#34;</span> -} -] -} -</code></pre></div><p>Interestingly the <code>rangeStart</code> and <code>rangeEnd</code> are actually IP addresses and not tight to some IP networks but unfortunately there&rsquo;s no equivalent for <code>podman network create</code> hence I update both to a range after the DHCP range of the Libvirt network to make sure that no duplicate IPs are assigned.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-json" data-lang="json"><span style="display:flex;"><span>{ +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;cniVersion&#34;</span>: <span style="color:#e6db74">&#34;0.4.0&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;name&#34;</span>: <span style="color:#e6db74">&#34;libvirt&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;plugins&#34;</span>: [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;bridge&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;bridge&#34;</span>: <span style="color:#e6db74">&#34;conbr0&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;isGateway&#34;</span>: <span style="color:#66d9ef">false</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;hairpinMode&#34;</span>: <span style="color:#66d9ef">true</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;ipam&#34;</span>: { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;host-local&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;routes&#34;</span>: [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;dst&#34;</span>: <span style="color:#e6db74">&#34;0.0.0.0/0&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ], +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;ranges&#34;</span>: [ +</span></span><span style="display:flex;"><span> [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;subnet&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.0/24&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;rangeStart&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.151&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;rangeEnd&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.160&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;gateway&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.42&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;portmap&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;capabilities&#34;</span>: { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;portMappings&#34;</span>: <span style="color:#66d9ef">true</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;firewall&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;backend&#34;</span>: <span style="color:#e6db74">&#34;&#34;</span> +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;tuning&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span>} +</span></span></code></pre></div><p>Interestingly the <code>rangeStart</code> and <code>rangeEnd</code> are actually IP addresses and not tight to some IP networks but unfortunately there&rsquo;s no equivalent for <code>podman network create</code> hence I update both to a range after the DHCP range of the Libvirt network to make sure that no duplicate IPs are assigned.</p> <p>I tend to declare the network as <code>host-local</code> but this shouldn&rsquo;t be critical. The <strong>most important</strong> part is to update the <code>bridge</code> to the same interface like in the Libvirt network definition (in my case <code>conbr0</code>).</p> <p>After this we&rsquo;re ready to go and you can for instance start a Nginx container in the <code>libvirt</code> network and you should be able to reach it from a VM in the Libvirt network:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">podman run <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --rm <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> -d <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --name nginx <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --network libvirt <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --ip 10.10.1.151 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> docker.io/nginx:alpine -</code></pre></div><p>A nice option for <code>podman run</code> is <code>--ip</code>. -You&rsquo;ve to choose an IP from the previously configured <code>range</code> but you can skip the <code>podman inspect</code> or <code>ip a</code> to get the container IP and the container will have the IP every time you start it, if you like 😉 and speaking of &lsquo;nice&rsquo; <code>podman run</code> options: you do know <code>--replace</code>, don&rsquo;t you?</p> \ No newline at end of file +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>podman run <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --rm <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> -d <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --name nginx <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --network libvirt <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --ip 10.10.1.151 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> docker.io/nginx:alpine +</span></span></code></pre></div><p>A nice option for <code>podman run</code> is <code>--ip</code>. +You&rsquo;ve to choose an IP from the previously configured <code>range</code> but you can skip the <code>podman inspect</code> or <code>ip a</code> to get the container IP and the container will have the IP every time you start it, if you like 😉 and speaking of &rsquo;nice&rsquo; <code>podman run</code> options: you do know <code>--replace</code>, don&rsquo;t you?</p> \ No newline at end of file diff --git a/post/libvirt-podman-network-mesh/index.html b/post/libvirt-podman-network-mesh/index.html index 3b263be..05743b0 100644 --- a/post/libvirt-podman-network-mesh/index.html +++ b/post/libvirt-podman-network-mesh/index.html @@ -1,281 +1,122 @@ - - - - - - -Libvirt & Podman: network 'mesh' - 1533B4dC0.de - - - - - - - - - - - - - - - - - - -Skip to main content -
-
-
-

-1533B4dC0.de -

- -
-

Libvirt & Podman: network 'mesh'

Disclaimer: I tested all this with Podman 3.x even though Podman 4.0 is already announced but the CNI driver is still available with Podman 4.0 and as soon as I get my hands on 4.0 I’ll give Netavark a try, too!

When playing around with containers and VMs one might ask if it’s possible to bring VMs and containers into a common network segment. +I see ‘why the hell would I need a VM anyway when already having containers’ or something similar I almost see on your face 😜

Well 1st of all, not everything can be solved with containers. +For instance windows applications can be run in Windows containers but I’m not aware of how to run a Windows container on my Linux desktop.

But also in pure Linux environments there are cases where a VM is probably a better fit for the problem. As you might know I’m a bit of network 🤓 and I love playing around with ‘weird’ stuff almost no one else does even think about if not forced to. -So if you try to implement for example your own DHCP server you might want to isolate your experiments (especially at the beginning) to avoid discussion about “why’s Netflix on the TV not working?!” 😄 or also if you try to implement your own ‘firewall’ with DNAT support (stay tuned - post’s following!).

-

Part 1: Libvirt preparation - - - - -

Okay now that I came around with some arguments - if they’re convincing or not is not important - how does this work?

-

Assuming you’ve Libvirt and Podman already installed on your system without any modification and you run

-
virsh net-list
-

you should have at least the default network already.

-

The definition of all networks (as of every other component of libvirt) is in XML. -virsh comes with a net-dumpxml command to export the configuration of a network:

-
virsh net-dumpxml default
-

The output should look (more or less) like in the following snippet:

-
<network>
-  <name>default</name>
-  <uuid>8d2028ed-cc9a-4eae-9883-b59b673d560d</uuid>
-  <forward mode='nat'>
-    <nat>
-      <port start='1024' end='65535'/>
-    </nat>
-  </forward>
-  <bridge name='virbr0' stp='on' delay='0'/>
-  <mac address='63:b3:d8:75:53:6b'/>
-  <ip address='192.168.122.1' netmask='255.255.255.0'>
-    <dhcp>
-      <range start='192.168.122.2' end='192.168.122.254'/>
-    </dhcp>
-  </ip>
-</network>
-

So we’ve a <network/> that is defined by:

-
    -
  • a <name/>
    • -
  • a <uuid/>
    • -
  • a optional <forward/> node
    • -
  • a <bridge/> interface
    • -
  • the <mac/> for the bridge interface (of the host)
    • -
  • the <ip/> of the host on the bridge interface -
      -
    • an optional <dhcp/> range definition
      • -
    -
    • -
-

The complete reference for the XML schema can be found here.

-

Before we have a closer look how to bring Podman containers into a Libvirt network, let’s define a new containers network. -The following snippet contains the definition I’ll use:

-
<network>
-  <name>containers</name>
-  <uuid>929b7b7d-bd82-452d-96b7-12f0cf1a4b17</uuid>
-  <bridge name='conbr0' stp='on' delay='0'/>
-  <mac address='af:af:13:ed:c6:41'/>
-  <ip address='10.10.1.42' netmask='255.255.255.0'>
-    <dhcp>
-      <range start='10.10.1.100' end='10.10.1.150'/>
-    </dhcp>
-  </ip>
-</network>
-

It’s quite similar except I made a few adoptions:

-
    -
  • remove the <forward/> block
    • -
  • change the <name/> and the <uuid/> (with the help of uuidgen)
    • -
  • change the name="" of the <bridge/>
    • -
  • change the address="" attribute of the <mac/> (use any mac address generator)
    • -
  • change the address="" attribute of the <ip/> and start="" and end="" of the DHCP range accordingly
    • -
-

You may use any private network - as far as I can tell it shouldn’t matter if you’re using a class B, C or D private network as long as you don’t have any conflicts with your LAN or any other virtual interfaces of your environment.

-

When done safe your network definition as .xml file. -To import the configuration you can use virsh net-define like in the following snippet (assuming the network definition is in containers.xml):

-
$ virsh net-define containers.xml
-
-> Network containers defined from containers.xml
-

Note: this only works because the XML already contains an <uuid/>. Otherwise you’d have to use virsh net-create and a few more extra steps to make the network actually persistent.

-

If you now check with virsh net-list you’d be disappointed because there’s no network! +So if you try to implement for example your own DHCP server you might want to isolate your experiments (especially at the beginning) to avoid discussion about “why’s Netflix on the TV not working?!” 😄 or also if you try to implement your own ‘firewall’ with DNAT support (stay tuned - post’s following!).

Part 1: Libvirt preparation +

Okay now that I came around with some arguments - if they’re convincing or not is not important - how does this work?

Assuming you’ve Libvirt and Podman already installed on your system without any modification and you run

virsh net-list
+

you should have at least the default network already.

The definition of all networks (as of every other component of libvirt) is in XML. +virsh comes with a net-dumpxml command to export the configuration of a network:

virsh net-dumpxml default
+

The output should look (more or less) like in the following snippet:

<network>
+  <name>default</name>
+  <uuid>8d2028ed-cc9a-4eae-9883-b59b673d560d</uuid>
+  <forward mode='nat'>
+    <nat>
+      <port start='1024' end='65535'/>
+    </nat>
+  </forward>
+  <bridge name='virbr0' stp='on' delay='0'/>
+  <mac address='63:b3:d8:75:53:6b'/>
+  <ip address='192.168.122.1' netmask='255.255.255.0'>
+    <dhcp>
+      <range start='192.168.122.2' end='192.168.122.254'/>
+    </dhcp>
+  </ip>
+</network>
+

So we’ve a <network/> that is defined by:

  • a <name/>
  • a <uuid/>
  • a optional <forward/> node
  • a <bridge/> interface
  • the <mac/> for the bridge interface (of the host)
  • the <ip/> of the host on the bridge interface
    • an optional <dhcp/> range definition

The complete reference for the XML schema can be found here.

Before we have a closer look how to bring Podman containers into a Libvirt network, let’s define a new containers network. +The following snippet contains the definition I’ll use:

<network>
+  <name>containers</name>
+  <uuid>929b7b7d-bd82-452d-96b7-12f0cf1a4b17</uuid>
+  <bridge name='conbr0' stp='on' delay='0'/>
+  <mac address='af:af:13:ed:c6:41'/>
+  <ip address='10.10.1.42' netmask='255.255.255.0'>
+    <dhcp>
+      <range start='10.10.1.100' end='10.10.1.150'/>
+    </dhcp>
+  </ip>
+</network>
+

It’s quite similar except I made a few adoptions:

  • remove the <forward/> block
  • change the <name/> and the <uuid/> (with the help of uuidgen)
  • change the name="" of the <bridge/>
  • change the address="" attribute of the <mac/> (use any mac address generator)
  • change the address="" attribute of the <ip/> and start="" and end="" of the DHCP range accordingly

You may use any private network - as far as I can tell it shouldn’t matter if you’re using a class B, C or D private network as long as you don’t have any conflicts with your LAN or any other virtual interfaces of your environment.

When done safe your network definition as .xml file. +To import the configuration you can use virsh net-define like in the following snippet (assuming the network definition is in containers.xml):

$ virsh net-define containers.xml
+
+> Network containers defined from containers.xml
+

Note: this only works because the XML already contains an <uuid/>. Otherwise you’d have to use virsh net-create and a few more extra steps to make the network actually persistent.

If you now check with virsh net-list you’d be disappointed because there’s no network! Checking again with virsh net-list --all explains why our containers network wasn’t in the output previously because it is by default inactive. -To activate it we’ve to start it like so:

-
$ virsh net-start containers
-
-> Network containers started
-

If you don’t mind the extra adapter and wish to use the network frequently in the future you might consider to autostart it:

-
$ virsh net-autostart containers
-
-> Network containers marked as autostarted
-

With our custom Libvirt network in place we’re good to go to configure Podman.

-

Part 2: Podman CNI network - - - - -

Note: this only works with rootfull Podman because rootless Podman does not use CNI but another network stack.

-

A clean Podman installation without any custom network created comes with the default network podman. +To activate it we’ve to start it like so:

$ virsh net-start containers
+
+> Network containers started
+

If you don’t mind the extra adapter and wish to use the network frequently in the future you might consider to autostart it:

$ virsh net-autostart containers
+
+> Network containers marked as autostarted
+

With our custom Libvirt network in place we’re good to go to configure Podman.

Part 2: Podman CNI network +

Note: this only works with rootfull Podman because rootless Podman does not use CNI but another network stack.

A clean Podman installation without any custom network created comes with the default network podman. Rootfull Podman network configs are by default stored in /etc/cni/net.d. -You should find the default network as 87-podman.conflist in the aforementioned directory.

-

Every Podman network is defined as JSON file. +You should find the default network as 87-podman.conflist in the aforementioned directory.

Every Podman network is defined as JSON file. We will define our own libvirt network to join Podman containers into the previously created Libvirt network. -You can either use podman network create to create the network (at least more or less) or you can copy for example the default network and make some adjustments.

-

To create the new network from the CLI you can use the following command:

-
podman network create \
-    --disable-dns \
-    --internal \
-    --gateway 10.10.2.37 \
-    --ip-range 10.10.2.160/29 \
-    --subnet 10.10.2.0/24 \
-    libvirt
-

Note that I used a different IP range as in the Libvirt network! Otherwise Podman will complain that the IP range is already in use at an adapter. -You can use this command to create the required file in /etc/cni/net.d/ but you’ve to update the ranges accordingly before creating a container in the network.

-

Because we’ve to edit the .conflist either way copy the default one is also fine.

-

The .conflist I’m using looks like this:

-
{
-   "cniVersion": "0.4.0",
-   "name": "libvirt",
-   "plugins": [
-      {
-         "type": "bridge",
-         "bridge": "conbr0",
-         "isGateway": false,
-         "hairpinMode": true,
-         "ipam": {
-            "type": "host-local",
-            "routes": [
-               {
-                  "dst": "0.0.0.0/0"
-               }
-            ],
-            "ranges": [
-               [
-                  {
-                     "subnet": "10.10.1.0/24",
-                     "rangeStart": "10.10.1.151",
-                     "rangeEnd": "10.10.1.160",
-                     "gateway": "10.10.1.42"
-                  }
-               ]
-            ]
-         }
-      },
-      {
-         "type": "portmap",
-         "capabilities": {
-            "portMappings": true
-         }
-      },
-      {
-         "type": "firewall",
-         "backend": ""
-      },
-      {
-         "type": "tuning"
-      }
-   ]
-}
-

Interestingly the rangeStart and rangeEnd are actually IP addresses and not tight to some IP networks but unfortunately there’s no equivalent for podman network create hence I update both to a range after the DHCP range of the Libvirt network to make sure that no duplicate IPs are assigned.

-

I tend to declare the network as host-local but this shouldn’t be critical. -The most important part is to update the bridge to the same interface like in the Libvirt network definition (in my case conbr0).

-

After this we’re ready to go and you can for instance start a Nginx container in the libvirt network and you should be able to reach it from a VM in the Libvirt network:

-
podman run \
-    --rm \
-    -d \
-    --name nginx \
-    --network libvirt \
-    --ip 10.10.1.151 \
-    docker.io/nginx:alpine
-

A nice option for podman run is --ip. -You’ve to choose an IP from the previously configured range but you can skip the podman inspect or ip a to get the container IP and the container will have the IP every time you start it, if you like 😉 and speaking of ‘nice’ podman run options: you do know --replace, don’t you?

-
-
-
2022-02-24
-https://www.1533b4dc0.de/post/libvirt-podman-network-mesh/ -Peter Kurfer -
- -
-
-
-
- -
- - \ No newline at end of file +You can either use podman network create to create the network (at least more or less) or you can copy for example the default network and make some adjustments.

To create the new network from the CLI you can use the following command:

podman network create \
+    --disable-dns \
+    --internal \
+    --gateway 10.10.2.37 \
+    --ip-range 10.10.2.160/29 \
+    --subnet 10.10.2.0/24 \
+    libvirt
+

Note that I used a different IP range as in the Libvirt network! Otherwise Podman will complain that the IP range is already in use at an adapter. +You can use this command to create the required file in /etc/cni/net.d/ but you’ve to update the ranges accordingly before creating a container in the network.

Because we’ve to edit the .conflist either way copy the default one is also fine.

The .conflist I’m using looks like this:

{
+   "cniVersion": "0.4.0",
+   "name": "libvirt",
+   "plugins": [
+      {
+         "type": "bridge",
+         "bridge": "conbr0",
+         "isGateway": false,
+         "hairpinMode": true,
+         "ipam": {
+            "type": "host-local",
+            "routes": [
+               {
+                  "dst": "0.0.0.0/0"
+               }
+            ],
+            "ranges": [
+               [
+                  {
+                     "subnet": "10.10.1.0/24",
+                     "rangeStart": "10.10.1.151",
+                     "rangeEnd": "10.10.1.160",
+                     "gateway": "10.10.1.42"
+                  }
+               ]
+            ]
+         }
+      },
+      {
+         "type": "portmap",
+         "capabilities": {
+            "portMappings": true
+         }
+      },
+      {
+         "type": "firewall",
+         "backend": ""
+      },
+      {
+         "type": "tuning"
+      }
+   ]
+}
+

Interestingly the rangeStart and rangeEnd are actually IP addresses and not tight to some IP networks but unfortunately there’s no equivalent for podman network create hence I update both to a range after the DHCP range of the Libvirt network to make sure that no duplicate IPs are assigned.

I tend to declare the network as host-local but this shouldn’t be critical. +The most important part is to update the bridge to the same interface like in the Libvirt network definition (in my case conbr0).

After this we’re ready to go and you can for instance start a Nginx container in the libvirt network and you should be able to reach it from a VM in the Libvirt network:

podman run \
+    --rm \
+    -d \
+    --name nginx \
+    --network libvirt \
+    --ip 10.10.1.151 \
+    docker.io/nginx:alpine
+

A nice option for podman run is --ip. +You’ve to choose an IP from the previously configured range but you can skip the podman inspect or ip a to get the container IP and the container will have the IP every time you start it, if you like 😉 and speaking of ’nice’ podman run options: you do know --replace, don’t you?

2022-02-24
https://www.1533b4dc0.de/post/libvirt-podman-network-mesh/ +Peter Kurfer
comments powered by Disqus \ No newline at end of file diff --git a/posts/index.html b/posts/index.html index dd8bd25..3d2b5f7 100644 --- a/posts/index.html +++ b/posts/index.html @@ -1 +1 @@ -https://www.1533b4dc0.de/post/ \ No newline at end of file +https://www.1533b4dc0.de/post/ \ No newline at end of file diff --git a/projects/index.html b/projects/index.html index c5834ca..0daf398 100644 --- a/projects/index.html +++ b/projects/index.html @@ -1,128 +1,19 @@ - - - - - - -Projects - 1533B4dC0.de - - - - - - - - - - - - - - - - -Skip to main content -
-
-
-

-1533B4dC0.de -

- -
-

Projects

INetMock +

INetMock started as an resource/container friendly alternative to INetSim. +While working on a project we tried to reduce analysis complexity coming from ’noise’ in the network traffic recorded to a central INetSim cluster we were running. We decided to decentralize the internet simulation, put it into a container image and run directly on every host multiple times in virtual networks. -Unfortunately INetSim has a relatively huge memory footprint (~1GB) which alone wouldn’t been a showstopper but in combination with a relatively long startup time I felt having something smaller could be beneficial so I started to implement a prototype in Go.

-

2 years later INetMock has grown to kind of a full router (supporting DNS and DHCP) with support for faking HTTP/s (direct or proxy requests) requests. -Furthermore it is able to record PCAP files for further analysis and it emits events for every handled request.

-

It comes with a descriptive configuration language (embedded in a YAML configuration) to setup the behavior of all components and to define health checks/integration tests to validate your configuration.

-

Apart from working as a router it can also be used e.g. for integration tests of HTTP APIs, DNS/DoT/DoH clients and most likely other things I haven’t even thought about.

-

Goveal - - - - -

Goveal is similar to reveal-md or previously GitPitch but obviously in Go. +Unfortunately INetSim has a relatively huge memory footprint (~1GB) which alone wouldn’t been a showstopper but in combination with a relatively long startup time I felt having something smaller could be beneficial so I started to implement a prototype in Go.

2 years later INetMock has grown to kind of a full router (supporting DNS and DHCP) with support for faking HTTP/s (direct or proxy requests) requests. +Furthermore it is able to record PCAP files for further analysis and it emits events for every handled request.

It comes with a descriptive configuration language (embedded in a YAML configuration) to setup the behavior of all components and to define health checks/integration tests to validate your configuration.

Apart from working as a router it can also be used e.g. for integration tests of HTTP APIs, DNS/DoT/DoH clients and most likely other things I haven’t even thought about.

Goveal +

Goveal is similar to reveal-md or previously GitPitch but obviously in Go. Originally I used GitPitch but then the author decided to go with a commercial license. The commercial license made sense when I was working at the university but after that it didn’t really make sense any more. -So I decided to replace it with a small custom CLI rendering the markdown into a static HTML file and serving it as a local web server (basically).

-

Later on I refined it more and more. -Currently I’m working on a rewrite which adds e.g. 1st class support for mermaid-js diagrams in slides.

-
-
-https://www.1533b4dc0.de/projects/ -Peter Kurfer -
-
-
-
-
- -
- - \ No newline at end of file +So I decided to replace it with a small custom CLI rendering the markdown into a static HTML file and serving it as a local web server (basically).

Later on I refined it more and more. +Currently I’m working on a rewrite which adds e.g. 1st class support for mermaid-js diagrams in slides.

https://www.1533b4dc0.de/projects/ +Peter Kurfer
comments powered by Disqus \ No newline at end of file diff --git a/showcase/index.html b/showcase/index.html index dd8bd25..3d2b5f7 100644 --- a/showcase/index.html +++ b/showcase/index.html @@ -1 +1 @@ -https://www.1533b4dc0.de/post/ \ No newline at end of file +https://www.1533b4dc0.de/post/ \ No newline at end of file diff --git a/tags/index.html b/tags/index.html index 751d819..1ec2570 100644 --- a/tags/index.html +++ b/tags/index.html @@ -1,107 +1,11 @@ - - - - - - -Tags - 1533B4dC0.de - - - - - - - - - - - - - - - - - -Skip to main content -
-
-
-

-1533B4dC0.de -

- -
-

Tags

\ No newline at end of file diff --git a/tags/index/index.html b/tags/index/index.html index f47cf8c..b1b652a 100644 --- a/tags/index/index.html +++ b/tags/index/index.html @@ -1,112 +1,9 @@ - - - - - - -index - 1533B4dC0.de - - - - - - - - - - - - - - - - - -Skip to main content -
-
-
-

-1533B4dC0.de -

- -
-

Tag: index

To all tags
\ No newline at end of file diff --git a/tags/index/page/1/index.html b/tags/index/page/1/index.html index 8db1729..b459a22 100644 --- a/tags/index/page/1/index.html +++ b/tags/index/page/1/index.html @@ -1 +1 @@ -https://www.1533b4dc0.de/tags/index/ \ No newline at end of file +https://www.1533b4dc0.de/tags/index/ \ No newline at end of file diff --git a/tags/libvirt/index.html b/tags/libvirt/index.html index c9c0d40..663a441 100644 --- a/tags/libvirt/index.html +++ b/tags/libvirt/index.html @@ -1,116 +1,10 @@ - - - - - - -libvirt - 1533B4dC0.de - - - - - - - - - - - - - - - - - -Skip to main content -
-
-
-

-1533B4dC0.de -

- -
-

Tag: libvirt

To all tags

Libvirt & Podman: network 'mesh'

Disclaimer: I tested all this with Podman 3.x even though Podman 4.0 is already announced but the CNI driver is still available with Podman 4.0 and as soon as I get my hands on 4.0 I’ll give Netavark a try, too! +When playing around with containers and VMs one might ask if it’s possible to bring VMs and containers into a common network segment. I see ‘why the hell would I need a VM anyway when already having containers’ or something similar I almost see on your face 😜
2022-02-24
https://www.1533b4dc0.de/post/libvirt-podman-network-mesh/ +Peter Kurfer
\ No newline at end of file diff --git a/tags/libvirt/index.xml b/tags/libvirt/index.xml index ed8e218..37fbfee 100644 --- a/tags/libvirt/index.xml +++ b/tags/libvirt/index.xml @@ -14,29 +14,29 @@ So if you try to implement for example your own DHCP server you might want to is </span> </h2><p>Okay now that I came around with <em>some</em> arguments - if they&rsquo;re convincing or not is not important - how does this work?</p> <p>Assuming you&rsquo;ve Libvirt and Podman already installed on your system without any modification and you run</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">virsh net-list -</code></pre></div><p>you should have at least the <code>default</code> network already.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>virsh net-list +</span></span></code></pre></div><p>you should have at least the <code>default</code> network already.</p> <p>The definition of all networks (as of every other component of libvirt) is in XML. <code>virsh</code> comes with a <code>net-dumpxml</code> command to export the configuration of a network:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">virsh net-dumpxml default -</code></pre></div><p>The output should look (more or less) like in the following snippet:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-xml" data-lang="xml"><span style="color:#f92672">&lt;network&gt;</span> -<span style="color:#f92672">&lt;name&gt;</span>default<span style="color:#f92672">&lt;/name&gt;</span> -<span style="color:#f92672">&lt;uuid&gt;</span>8d2028ed-cc9a-4eae-9883-b59b673d560d<span style="color:#f92672">&lt;/uuid&gt;</span> -<span style="color:#f92672">&lt;forward</span> <span style="color:#a6e22e">mode=</span><span style="color:#e6db74">&#39;nat&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;nat&gt;</span> -<span style="color:#f92672">&lt;port</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;1024&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;65535&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/nat&gt;</span> -<span style="color:#f92672">&lt;/forward&gt;</span> -<span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;virbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;63:b3:d8:75:53:6b&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;192.168.122.1&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;dhcp&gt;</span> -<span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;192.168.122.2&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;192.168.122.254&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/dhcp&gt;</span> -<span style="color:#f92672">&lt;/ip&gt;</span> -<span style="color:#f92672">&lt;/network&gt;</span> -</code></pre></div><p>So we&rsquo;ve a <code>&lt;network/&gt;</code> that is defined by:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>virsh net-dumpxml default +</span></span></code></pre></div><p>The output should look (more or less) like in the following snippet:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-xml" data-lang="xml"><span style="display:flex;"><span><span style="color:#f92672">&lt;network&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;name&gt;</span>default<span style="color:#f92672">&lt;/name&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;uuid&gt;</span>8d2028ed-cc9a-4eae-9883-b59b673d560d<span style="color:#f92672">&lt;/uuid&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;forward</span> <span style="color:#a6e22e">mode=</span><span style="color:#e6db74">&#39;nat&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;nat&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;port</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;1024&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;65535&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/nat&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/forward&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;virbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;63:b3:d8:75:53:6b&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;192.168.122.1&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;192.168.122.2&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;192.168.122.254&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/ip&gt;</span> +</span></span><span style="display:flex;"><span><span style="color:#f92672">&lt;/network&gt;</span> +</span></span></code></pre></div><p>So we&rsquo;ve a <code>&lt;network/&gt;</code> that is defined by:</p> <ul> <li>a <code>&lt;name/&gt;</code></li> <li>a <code>&lt;uuid/&gt;</code></li> @@ -52,18 +52,18 @@ So if you try to implement for example your own DHCP server you might want to is <p>The complete reference for the XML schema can be found <a href="https://libvirt.org/formatnetwork.html">here</a>.</p> <p>Before we have a closer look how to bring Podman containers into a Libvirt network, let&rsquo;s define a new <code>containers</code> network. The following snippet contains the definition I&rsquo;ll use:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-xml" data-lang="xml"><span style="color:#f92672">&lt;network&gt;</span> -<span style="color:#f92672">&lt;name&gt;</span>containers<span style="color:#f92672">&lt;/name&gt;</span> -<span style="color:#f92672">&lt;uuid&gt;</span>929b7b7d-bd82-452d-96b7-12f0cf1a4b17<span style="color:#f92672">&lt;/uuid&gt;</span> -<span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;conbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;af:af:13:ed:c6:41&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;10.10.1.42&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;dhcp&gt;</span> -<span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;10.10.1.100&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;10.10.1.150&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/dhcp&gt;</span> -<span style="color:#f92672">&lt;/ip&gt;</span> -<span style="color:#f92672">&lt;/network&gt;</span> -</code></pre></div><p>It&rsquo;s quite similar except I made a few adoptions:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-xml" data-lang="xml"><span style="display:flex;"><span><span style="color:#f92672">&lt;network&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;name&gt;</span>containers<span style="color:#f92672">&lt;/name&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;uuid&gt;</span>929b7b7d-bd82-452d-96b7-12f0cf1a4b17<span style="color:#f92672">&lt;/uuid&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;conbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;af:af:13:ed:c6:41&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;10.10.1.42&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;10.10.1.100&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;10.10.1.150&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/ip&gt;</span> +</span></span><span style="display:flex;"><span><span style="color:#f92672">&lt;/network&gt;</span> +</span></span></code></pre></div><p>It&rsquo;s quite similar except I made a few adoptions:</p> <ul> <li>remove the <code>&lt;forward/&gt;</code> block</li> <li>change the <code>&lt;name/&gt;</code> and the <code>&lt;uuid/&gt;</code> (with the help of <code>uuidgen</code>)</li> @@ -74,18 +74,21 @@ The following snippet contains the definition I&rsquo;ll use:</p> <p>You may use any private network - as far as I can tell it shouldn&rsquo;t matter if you&rsquo;re using a class B, C or D private network as long as you don&rsquo;t have any conflicts with your LAN or any other virtual interfaces of your environment.</p> <p>When done safe your network definition as <code>.xml</code> file. To import the configuration you can use <code>virsh net-define</code> like in the following snippet (assuming the network definition is in <code>containers.xml</code>):</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-define containers.xml -&gt; Network containers defined from containers.xml -</code></pre></div><p><em>Note: this only works because the XML already contains an <code>&lt;uuid/&gt;</code>. Otherwise you&rsquo;d have to use <code>virsh net-create</code> and a few more extra steps to make the network actually persistent.</em></p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-define containers.xml +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers defined from containers.xml +</span></span></code></pre></div><p><em>Note: this only works because the XML already contains an <code>&lt;uuid/&gt;</code>. Otherwise you&rsquo;d have to use <code>virsh net-create</code> and a few more extra steps to make the network actually persistent.</em></p> <p>If you now check with <code>virsh net-list</code> you&rsquo;d be disappointed because there&rsquo;s no network! Checking again with <code>virsh net-list --all</code> explains why our <code>containers</code> network wasn&rsquo;t in the output previously because it is by default <em>inactive</em>. To activate it we&rsquo;ve to start it like so:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-start containers -&gt; Network containers started -</code></pre></div><p>If you don&rsquo;t mind the extra adapter and wish to use the network frequently in the future you might consider to autostart it:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-autostart containers -&gt; Network containers marked as autostarted -</code></pre></div><p>With our custom Libvirt network in place we&rsquo;re good to go to configure Podman.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-start containers +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers started +</span></span></code></pre></div><p>If you don&rsquo;t mind the extra adapter and wish to use the network frequently in the future you might consider to autostart it:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-autostart containers +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers marked as autostarted +</span></span></code></pre></div><p>With our custom Libvirt network in place we&rsquo;re good to go to configure Podman.</p> <h2 id="part-2-podman-cni-network" >Part 2: Podman CNI network <span> <a href="#part-2-podman-cni-network"> @@ -100,70 +103,70 @@ You should find the default network as <code>87-podman.conflist</code> in We will define our own <code>libvirt</code> network to join Podman containers into the previously created Libvirt network. You can either use <code>podman network create</code> to create the network (at least more or less) or you can copy for example the default network and make some adjustments.</p> <p>To create the new network from the CLI you can use the following command:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">podman network create <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --disable-dns <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --internal <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --gateway 10.10.2.37 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --ip-range 10.10.2.160/29 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --subnet 10.10.2.0/24 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> libvirt -</code></pre></div><p>Note that I used a different IP range as in the Libvirt network! Otherwise Podman will complain that the IP range is already in use at an adapter. +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>podman network create <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --disable-dns <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --internal <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --gateway 10.10.2.37 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --ip-range 10.10.2.160/29 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --subnet 10.10.2.0/24 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> libvirt +</span></span></code></pre></div><p>Note that I used a different IP range as in the Libvirt network! Otherwise Podman will complain that the IP range is already in use at an adapter. You can use this command to create the required file in <code>/etc/cni/net.d/</code> but you&rsquo;ve to update the <code>ranges</code> accordingly before creating a container in the network.</p> <p>Because we&rsquo;ve to edit the <code>.conflist</code> either way copy the default one is also fine.</p> <p>The <code>.conflist</code> I&rsquo;m using looks like this:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-json" data-lang="json">{ -<span style="color:#f92672">&#34;cniVersion&#34;</span>: <span style="color:#e6db74">&#34;0.4.0&#34;</span>, -<span style="color:#f92672">&#34;name&#34;</span>: <span style="color:#e6db74">&#34;libvirt&#34;</span>, -<span style="color:#f92672">&#34;plugins&#34;</span>: [ -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;bridge&#34;</span>, -<span style="color:#f92672">&#34;bridge&#34;</span>: <span style="color:#e6db74">&#34;conbr0&#34;</span>, -<span style="color:#f92672">&#34;isGateway&#34;</span>: <span style="color:#66d9ef">false</span>, -<span style="color:#f92672">&#34;hairpinMode&#34;</span>: <span style="color:#66d9ef">true</span>, -<span style="color:#f92672">&#34;ipam&#34;</span>: { -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;host-local&#34;</span>, -<span style="color:#f92672">&#34;routes&#34;</span>: [ -{ -<span style="color:#f92672">&#34;dst&#34;</span>: <span style="color:#e6db74">&#34;0.0.0.0/0&#34;</span> -} -], -<span style="color:#f92672">&#34;ranges&#34;</span>: [ -[ -{ -<span style="color:#f92672">&#34;subnet&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.0/24&#34;</span>, -<span style="color:#f92672">&#34;rangeStart&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.151&#34;</span>, -<span style="color:#f92672">&#34;rangeEnd&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.160&#34;</span>, -<span style="color:#f92672">&#34;gateway&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.42&#34;</span> -} -] -] -} -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;portmap&#34;</span>, -<span style="color:#f92672">&#34;capabilities&#34;</span>: { -<span style="color:#f92672">&#34;portMappings&#34;</span>: <span style="color:#66d9ef">true</span> -} -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;firewall&#34;</span>, -<span style="color:#f92672">&#34;backend&#34;</span>: <span style="color:#e6db74">&#34;&#34;</span> -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;tuning&#34;</span> -} -] -} -</code></pre></div><p>Interestingly the <code>rangeStart</code> and <code>rangeEnd</code> are actually IP addresses and not tight to some IP networks but unfortunately there&rsquo;s no equivalent for <code>podman network create</code> hence I update both to a range after the DHCP range of the Libvirt network to make sure that no duplicate IPs are assigned.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-json" data-lang="json"><span style="display:flex;"><span>{ +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;cniVersion&#34;</span>: <span style="color:#e6db74">&#34;0.4.0&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;name&#34;</span>: <span style="color:#e6db74">&#34;libvirt&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;plugins&#34;</span>: [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;bridge&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;bridge&#34;</span>: <span style="color:#e6db74">&#34;conbr0&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;isGateway&#34;</span>: <span style="color:#66d9ef">false</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;hairpinMode&#34;</span>: <span style="color:#66d9ef">true</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;ipam&#34;</span>: { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;host-local&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;routes&#34;</span>: [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;dst&#34;</span>: <span style="color:#e6db74">&#34;0.0.0.0/0&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ], +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;ranges&#34;</span>: [ +</span></span><span style="display:flex;"><span> [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;subnet&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.0/24&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;rangeStart&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.151&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;rangeEnd&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.160&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;gateway&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.42&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;portmap&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;capabilities&#34;</span>: { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;portMappings&#34;</span>: <span style="color:#66d9ef">true</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;firewall&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;backend&#34;</span>: <span style="color:#e6db74">&#34;&#34;</span> +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;tuning&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span>} +</span></span></code></pre></div><p>Interestingly the <code>rangeStart</code> and <code>rangeEnd</code> are actually IP addresses and not tight to some IP networks but unfortunately there&rsquo;s no equivalent for <code>podman network create</code> hence I update both to a range after the DHCP range of the Libvirt network to make sure that no duplicate IPs are assigned.</p> <p>I tend to declare the network as <code>host-local</code> but this shouldn&rsquo;t be critical. The <strong>most important</strong> part is to update the <code>bridge</code> to the same interface like in the Libvirt network definition (in my case <code>conbr0</code>).</p> <p>After this we&rsquo;re ready to go and you can for instance start a Nginx container in the <code>libvirt</code> network and you should be able to reach it from a VM in the Libvirt network:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">podman run <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --rm <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> -d <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --name nginx <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --network libvirt <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --ip 10.10.1.151 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> docker.io/nginx:alpine -</code></pre></div><p>A nice option for <code>podman run</code> is <code>--ip</code>. -You&rsquo;ve to choose an IP from the previously configured <code>range</code> but you can skip the <code>podman inspect</code> or <code>ip a</code> to get the container IP and the container will have the IP every time you start it, if you like 😉 and speaking of &lsquo;nice&rsquo; <code>podman run</code> options: you do know <code>--replace</code>, don&rsquo;t you?</p> \ No newline at end of file +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>podman run <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --rm <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> -d <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --name nginx <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --network libvirt <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --ip 10.10.1.151 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> docker.io/nginx:alpine +</span></span></code></pre></div><p>A nice option for <code>podman run</code> is <code>--ip</code>. +You&rsquo;ve to choose an IP from the previously configured <code>range</code> but you can skip the <code>podman inspect</code> or <code>ip a</code> to get the container IP and the container will have the IP every time you start it, if you like 😉 and speaking of &rsquo;nice&rsquo; <code>podman run</code> options: you do know <code>--replace</code>, don&rsquo;t you?</p> \ No newline at end of file diff --git a/tags/libvirt/page/1/index.html b/tags/libvirt/page/1/index.html index 755ee6a..f97c8cd 100644 --- a/tags/libvirt/page/1/index.html +++ b/tags/libvirt/page/1/index.html @@ -1 +1 @@ -https://www.1533b4dc0.de/tags/libvirt/ \ No newline at end of file +https://www.1533b4dc0.de/tags/libvirt/ \ No newline at end of file diff --git a/tags/podman/index.html b/tags/podman/index.html index fae59eb..1b0fd31 100644 --- a/tags/podman/index.html +++ b/tags/podman/index.html @@ -1,116 +1,10 @@ - - - - - - -podman - 1533B4dC0.de - - - - - - - - - - - - - - - - - -Skip to main content -
-
-
-

-1533B4dC0.de -

- -
-

Tag: podman

To all tags

Libvirt & Podman: network 'mesh'

Disclaimer: I tested all this with Podman 3.x even though Podman 4.0 is already announced but the CNI driver is still available with Podman 4.0 and as soon as I get my hands on 4.0 I’ll give Netavark a try, too! +When playing around with containers and VMs one might ask if it’s possible to bring VMs and containers into a common network segment. I see ‘why the hell would I need a VM anyway when already having containers’ or something similar I almost see on your face 😜
2022-02-24
https://www.1533b4dc0.de/post/libvirt-podman-network-mesh/ +Peter Kurfer
\ No newline at end of file diff --git a/tags/podman/index.xml b/tags/podman/index.xml index 706a962..891e338 100644 --- a/tags/podman/index.xml +++ b/tags/podman/index.xml @@ -14,29 +14,29 @@ So if you try to implement for example your own DHCP server you might want to is </span> </h2><p>Okay now that I came around with <em>some</em> arguments - if they&rsquo;re convincing or not is not important - how does this work?</p> <p>Assuming you&rsquo;ve Libvirt and Podman already installed on your system without any modification and you run</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">virsh net-list -</code></pre></div><p>you should have at least the <code>default</code> network already.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>virsh net-list +</span></span></code></pre></div><p>you should have at least the <code>default</code> network already.</p> <p>The definition of all networks (as of every other component of libvirt) is in XML. <code>virsh</code> comes with a <code>net-dumpxml</code> command to export the configuration of a network:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">virsh net-dumpxml default -</code></pre></div><p>The output should look (more or less) like in the following snippet:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-xml" data-lang="xml"><span style="color:#f92672">&lt;network&gt;</span> -<span style="color:#f92672">&lt;name&gt;</span>default<span style="color:#f92672">&lt;/name&gt;</span> -<span style="color:#f92672">&lt;uuid&gt;</span>8d2028ed-cc9a-4eae-9883-b59b673d560d<span style="color:#f92672">&lt;/uuid&gt;</span> -<span style="color:#f92672">&lt;forward</span> <span style="color:#a6e22e">mode=</span><span style="color:#e6db74">&#39;nat&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;nat&gt;</span> -<span style="color:#f92672">&lt;port</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;1024&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;65535&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/nat&gt;</span> -<span style="color:#f92672">&lt;/forward&gt;</span> -<span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;virbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;63:b3:d8:75:53:6b&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;192.168.122.1&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;dhcp&gt;</span> -<span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;192.168.122.2&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;192.168.122.254&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/dhcp&gt;</span> -<span style="color:#f92672">&lt;/ip&gt;</span> -<span style="color:#f92672">&lt;/network&gt;</span> -</code></pre></div><p>So we&rsquo;ve a <code>&lt;network/&gt;</code> that is defined by:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>virsh net-dumpxml default +</span></span></code></pre></div><p>The output should look (more or less) like in the following snippet:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-xml" data-lang="xml"><span style="display:flex;"><span><span style="color:#f92672">&lt;network&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;name&gt;</span>default<span style="color:#f92672">&lt;/name&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;uuid&gt;</span>8d2028ed-cc9a-4eae-9883-b59b673d560d<span style="color:#f92672">&lt;/uuid&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;forward</span> <span style="color:#a6e22e">mode=</span><span style="color:#e6db74">&#39;nat&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;nat&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;port</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;1024&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;65535&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/nat&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/forward&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;virbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;63:b3:d8:75:53:6b&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;192.168.122.1&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;192.168.122.2&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;192.168.122.254&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/ip&gt;</span> +</span></span><span style="display:flex;"><span><span style="color:#f92672">&lt;/network&gt;</span> +</span></span></code></pre></div><p>So we&rsquo;ve a <code>&lt;network/&gt;</code> that is defined by:</p> <ul> <li>a <code>&lt;name/&gt;</code></li> <li>a <code>&lt;uuid/&gt;</code></li> @@ -52,18 +52,18 @@ So if you try to implement for example your own DHCP server you might want to is <p>The complete reference for the XML schema can be found <a href="https://libvirt.org/formatnetwork.html">here</a>.</p> <p>Before we have a closer look how to bring Podman containers into a Libvirt network, let&rsquo;s define a new <code>containers</code> network. The following snippet contains the definition I&rsquo;ll use:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-xml" data-lang="xml"><span style="color:#f92672">&lt;network&gt;</span> -<span style="color:#f92672">&lt;name&gt;</span>containers<span style="color:#f92672">&lt;/name&gt;</span> -<span style="color:#f92672">&lt;uuid&gt;</span>929b7b7d-bd82-452d-96b7-12f0cf1a4b17<span style="color:#f92672">&lt;/uuid&gt;</span> -<span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;conbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;af:af:13:ed:c6:41&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;10.10.1.42&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> -<span style="color:#f92672">&lt;dhcp&gt;</span> -<span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;10.10.1.100&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;10.10.1.150&#39;</span><span style="color:#f92672">/&gt;</span> -<span style="color:#f92672">&lt;/dhcp&gt;</span> -<span style="color:#f92672">&lt;/ip&gt;</span> -<span style="color:#f92672">&lt;/network&gt;</span> -</code></pre></div><p>It&rsquo;s quite similar except I made a few adoptions:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-xml" data-lang="xml"><span style="display:flex;"><span><span style="color:#f92672">&lt;network&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;name&gt;</span>containers<span style="color:#f92672">&lt;/name&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;uuid&gt;</span>929b7b7d-bd82-452d-96b7-12f0cf1a4b17<span style="color:#f92672">&lt;/uuid&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;bridge</span> <span style="color:#a6e22e">name=</span><span style="color:#e6db74">&#39;conbr0&#39;</span> <span style="color:#a6e22e">stp=</span><span style="color:#e6db74">&#39;on&#39;</span> <span style="color:#a6e22e">delay=</span><span style="color:#e6db74">&#39;0&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;mac</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;af:af:13:ed:c6:41&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;ip</span> <span style="color:#a6e22e">address=</span><span style="color:#e6db74">&#39;10.10.1.42&#39;</span> <span style="color:#a6e22e">netmask=</span><span style="color:#e6db74">&#39;255.255.255.0&#39;</span><span style="color:#f92672">&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;range</span> <span style="color:#a6e22e">start=</span><span style="color:#e6db74">&#39;10.10.1.100&#39;</span> <span style="color:#a6e22e">end=</span><span style="color:#e6db74">&#39;10.10.1.150&#39;</span><span style="color:#f92672">/&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/dhcp&gt;</span> +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&lt;/ip&gt;</span> +</span></span><span style="display:flex;"><span><span style="color:#f92672">&lt;/network&gt;</span> +</span></span></code></pre></div><p>It&rsquo;s quite similar except I made a few adoptions:</p> <ul> <li>remove the <code>&lt;forward/&gt;</code> block</li> <li>change the <code>&lt;name/&gt;</code> and the <code>&lt;uuid/&gt;</code> (with the help of <code>uuidgen</code>)</li> @@ -74,18 +74,21 @@ The following snippet contains the definition I&rsquo;ll use:</p> <p>You may use any private network - as far as I can tell it shouldn&rsquo;t matter if you&rsquo;re using a class B, C or D private network as long as you don&rsquo;t have any conflicts with your LAN or any other virtual interfaces of your environment.</p> <p>When done safe your network definition as <code>.xml</code> file. To import the configuration you can use <code>virsh net-define</code> like in the following snippet (assuming the network definition is in <code>containers.xml</code>):</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-define containers.xml -&gt; Network containers defined from containers.xml -</code></pre></div><p><em>Note: this only works because the XML already contains an <code>&lt;uuid/&gt;</code>. Otherwise you&rsquo;d have to use <code>virsh net-create</code> and a few more extra steps to make the network actually persistent.</em></p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-define containers.xml +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers defined from containers.xml +</span></span></code></pre></div><p><em>Note: this only works because the XML already contains an <code>&lt;uuid/&gt;</code>. Otherwise you&rsquo;d have to use <code>virsh net-create</code> and a few more extra steps to make the network actually persistent.</em></p> <p>If you now check with <code>virsh net-list</code> you&rsquo;d be disappointed because there&rsquo;s no network! Checking again with <code>virsh net-list --all</code> explains why our <code>containers</code> network wasn&rsquo;t in the output previously because it is by default <em>inactive</em>. To activate it we&rsquo;ve to start it like so:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-start containers -&gt; Network containers started -</code></pre></div><p>If you don&rsquo;t mind the extra adapter and wish to use the network frequently in the future you might consider to autostart it:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ virsh net-autostart containers -&gt; Network containers marked as autostarted -</code></pre></div><p>With our custom Libvirt network in place we&rsquo;re good to go to configure Podman.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-start containers +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers started +</span></span></code></pre></div><p>If you don&rsquo;t mind the extra adapter and wish to use the network frequently in the future you might consider to autostart it:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ virsh net-autostart containers +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>&gt; Network containers marked as autostarted +</span></span></code></pre></div><p>With our custom Libvirt network in place we&rsquo;re good to go to configure Podman.</p> <h2 id="part-2-podman-cni-network" >Part 2: Podman CNI network <span> <a href="#part-2-podman-cni-network"> @@ -100,70 +103,70 @@ You should find the default network as <code>87-podman.conflist</code> in We will define our own <code>libvirt</code> network to join Podman containers into the previously created Libvirt network. You can either use <code>podman network create</code> to create the network (at least more or less) or you can copy for example the default network and make some adjustments.</p> <p>To create the new network from the CLI you can use the following command:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">podman network create <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --disable-dns <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --internal <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --gateway 10.10.2.37 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --ip-range 10.10.2.160/29 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --subnet 10.10.2.0/24 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> libvirt -</code></pre></div><p>Note that I used a different IP range as in the Libvirt network! Otherwise Podman will complain that the IP range is already in use at an adapter. +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>podman network create <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --disable-dns <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --internal <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --gateway 10.10.2.37 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --ip-range 10.10.2.160/29 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --subnet 10.10.2.0/24 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> libvirt +</span></span></code></pre></div><p>Note that I used a different IP range as in the Libvirt network! Otherwise Podman will complain that the IP range is already in use at an adapter. You can use this command to create the required file in <code>/etc/cni/net.d/</code> but you&rsquo;ve to update the <code>ranges</code> accordingly before creating a container in the network.</p> <p>Because we&rsquo;ve to edit the <code>.conflist</code> either way copy the default one is also fine.</p> <p>The <code>.conflist</code> I&rsquo;m using looks like this:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-json" data-lang="json">{ -<span style="color:#f92672">&#34;cniVersion&#34;</span>: <span style="color:#e6db74">&#34;0.4.0&#34;</span>, -<span style="color:#f92672">&#34;name&#34;</span>: <span style="color:#e6db74">&#34;libvirt&#34;</span>, -<span style="color:#f92672">&#34;plugins&#34;</span>: [ -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;bridge&#34;</span>, -<span style="color:#f92672">&#34;bridge&#34;</span>: <span style="color:#e6db74">&#34;conbr0&#34;</span>, -<span style="color:#f92672">&#34;isGateway&#34;</span>: <span style="color:#66d9ef">false</span>, -<span style="color:#f92672">&#34;hairpinMode&#34;</span>: <span style="color:#66d9ef">true</span>, -<span style="color:#f92672">&#34;ipam&#34;</span>: { -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;host-local&#34;</span>, -<span style="color:#f92672">&#34;routes&#34;</span>: [ -{ -<span style="color:#f92672">&#34;dst&#34;</span>: <span style="color:#e6db74">&#34;0.0.0.0/0&#34;</span> -} -], -<span style="color:#f92672">&#34;ranges&#34;</span>: [ -[ -{ -<span style="color:#f92672">&#34;subnet&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.0/24&#34;</span>, -<span style="color:#f92672">&#34;rangeStart&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.151&#34;</span>, -<span style="color:#f92672">&#34;rangeEnd&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.160&#34;</span>, -<span style="color:#f92672">&#34;gateway&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.42&#34;</span> -} -] -] -} -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;portmap&#34;</span>, -<span style="color:#f92672">&#34;capabilities&#34;</span>: { -<span style="color:#f92672">&#34;portMappings&#34;</span>: <span style="color:#66d9ef">true</span> -} -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;firewall&#34;</span>, -<span style="color:#f92672">&#34;backend&#34;</span>: <span style="color:#e6db74">&#34;&#34;</span> -}, -{ -<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;tuning&#34;</span> -} -] -} -</code></pre></div><p>Interestingly the <code>rangeStart</code> and <code>rangeEnd</code> are actually IP addresses and not tight to some IP networks but unfortunately there&rsquo;s no equivalent for <code>podman network create</code> hence I update both to a range after the DHCP range of the Libvirt network to make sure that no duplicate IPs are assigned.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-json" data-lang="json"><span style="display:flex;"><span>{ +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;cniVersion&#34;</span>: <span style="color:#e6db74">&#34;0.4.0&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;name&#34;</span>: <span style="color:#e6db74">&#34;libvirt&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;plugins&#34;</span>: [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;bridge&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;bridge&#34;</span>: <span style="color:#e6db74">&#34;conbr0&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;isGateway&#34;</span>: <span style="color:#66d9ef">false</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;hairpinMode&#34;</span>: <span style="color:#66d9ef">true</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;ipam&#34;</span>: { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;host-local&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;routes&#34;</span>: [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;dst&#34;</span>: <span style="color:#e6db74">&#34;0.0.0.0/0&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ], +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;ranges&#34;</span>: [ +</span></span><span style="display:flex;"><span> [ +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;subnet&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.0/24&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;rangeStart&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.151&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;rangeEnd&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.160&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;gateway&#34;</span>: <span style="color:#e6db74">&#34;10.10.1.42&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;portmap&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;capabilities&#34;</span>: { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;portMappings&#34;</span>: <span style="color:#66d9ef">true</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;firewall&#34;</span>, +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;backend&#34;</span>: <span style="color:#e6db74">&#34;&#34;</span> +</span></span><span style="display:flex;"><span> }, +</span></span><span style="display:flex;"><span> { +</span></span><span style="display:flex;"><span> <span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;tuning&#34;</span> +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> ] +</span></span><span style="display:flex;"><span>} +</span></span></code></pre></div><p>Interestingly the <code>rangeStart</code> and <code>rangeEnd</code> are actually IP addresses and not tight to some IP networks but unfortunately there&rsquo;s no equivalent for <code>podman network create</code> hence I update both to a range after the DHCP range of the Libvirt network to make sure that no duplicate IPs are assigned.</p> <p>I tend to declare the network as <code>host-local</code> but this shouldn&rsquo;t be critical. The <strong>most important</strong> part is to update the <code>bridge</code> to the same interface like in the Libvirt network definition (in my case <code>conbr0</code>).</p> <p>After this we&rsquo;re ready to go and you can for instance start a Nginx container in the <code>libvirt</code> network and you should be able to reach it from a VM in the Libvirt network:</p> -<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">podman run <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --rm <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> -d <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --name nginx <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --network libvirt <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> --ip 10.10.1.151 <span style="color:#ae81ff">\ -</span><span style="color:#ae81ff"></span> docker.io/nginx:alpine -</code></pre></div><p>A nice option for <code>podman run</code> is <code>--ip</code>. -You&rsquo;ve to choose an IP from the previously configured <code>range</code> but you can skip the <code>podman inspect</code> or <code>ip a</code> to get the container IP and the container will have the IP every time you start it, if you like 😉 and speaking of &lsquo;nice&rsquo; <code>podman run</code> options: you do know <code>--replace</code>, don&rsquo;t you?</p> \ No newline at end of file +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>podman run <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --rm <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> -d <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --name nginx <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --network libvirt <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> --ip 10.10.1.151 <span style="color:#ae81ff">\ +</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> docker.io/nginx:alpine +</span></span></code></pre></div><p>A nice option for <code>podman run</code> is <code>--ip</code>. +You&rsquo;ve to choose an IP from the previously configured <code>range</code> but you can skip the <code>podman inspect</code> or <code>ip a</code> to get the container IP and the container will have the IP every time you start it, if you like 😉 and speaking of &rsquo;nice&rsquo; <code>podman run</code> options: you do know <code>--replace</code>, don&rsquo;t you?</p> \ No newline at end of file diff --git a/tags/podman/page/1/index.html b/tags/podman/page/1/index.html index 2d8c448..af53c3a 100644 --- a/tags/podman/page/1/index.html +++ b/tags/podman/page/1/index.html @@ -1 +1 @@ -https://www.1533b4dc0.de/tags/podman/ \ No newline at end of file +https://www.1533b4dc0.de/tags/podman/ \ No newline at end of file