Guest24897
/
DockerCLI
mirror of https://github.com/docker/cli.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4994 from robmry/47639_per-interface-sysctls 

Document CLI support for per interface sysctls
This commit is contained in:
Albin Kerouanton 2024-05-29 11:03:28 +02:00 committed by GitHub
parent 4d28ae98f4 d5d94e46fc
commit 8ed44f916f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 124 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
cli/command/network/connect_test.go
View File

@ -43,27 +43,41 @@ func TestNetworkConnectErrors(t *testing.T) {
}
func TestNetworkConnectWithFlags(t *testing.T) {
expectedOpts := []network.IPAMConfig{
{
Subnet: "192.168.4.0/24",
IPRange: "192.168.4.0/24",
Gateway: "192.168.4.1/24",
AuxAddress: map[string]string{},
expectedConfig := &network.EndpointSettings{
IPAMConfig: &network.EndpointIPAMConfig{
IPv4Address: "192.168.4.1",
IPv6Address: "fdef:f401:8da0:1234::5678",
LinkLocalIPs: []string{"169.254.42.42"},
},
Links: []string{"otherctr"},
Aliases: []string{"poor-yorick"},
DriverOpts: map[string]string{
"driveropt1": "optval1,optval2",
"driveropt2": "optval4",
},
}
cli := test.NewFakeCli(&fakeClient{
networkConnectFunc: func(ctx context.Context, networkID, container string, config *network.EndpointSettings) error {
assert.Check(t, is.DeepEqual(expectedOpts, config.IPAMConfig), "not expected driver error")
assert.Check(t, is.DeepEqual(expectedConfig, config))
return nil
},
})
args := []string{"banana"}
cmd := newCreateCommand(cli)
args := []string{"mynet", "myctr"}
cmd := newConnectCommand(cli)
cmd.SetArgs(args)
cmd.Flags().Set("driver", "foo")
cmd.Flags().Set("ip-range", "192.168.4.0/24")
cmd.Flags().Set("gateway", "192.168.4.1/24")
cmd.Flags().Set("subnet", "192.168.4.0/24")
for _, opt := range []struct{ name, value string }{
{"alias", "poor-yorick"},
{"driver-opt", "\"driveropt1=optval1,optval2\""},
{"driver-opt", "driveropt2=optval3"},
{"driver-opt", "driveropt2=optval4"}, // replaces value
{"ip", "192.168.4.1"},
{"ip6", "fdef:f401:8da0:1234::5678"},
{"link", "otherctr"},
{"link-local-ip", "169.254.42.42"},
} {
err := cmd.Flags().Set(opt.name, opt.value)
assert.Check(t, err)
}
assert.NilError(t, cmd.Execute())
}

77
docs/reference/commandline/container_run.md
View File

@ -707,7 +707,24 @@ For additional information on working with labels, see
To start a container and connect it to a network, use the `--network` option.
The following commands create a network named `my-net` and adds a `busybox` container
If you want to add a running container to a network use the `docker network connect` subcommand.
You can connect multiple containers to the same network. Once connected, the
containers can communicate using only another container's IP address
or name. For `overlay` networks or custom plugins that support multi-host
connectivity, containers connected to the same multi-host network but launched
from different Engines can also communicate in this way.
> **Note**
>
> The default bridge network only allows containers to communicate with each other using
> internal IP addresses. User-created bridge networks provide DNS resolution between
> containers using container names.
You can disconnect a container from a network using the `docker network
disconnect` command.
The following commands create a network named `my-net` and add a `busybox` container
to the `my-net` network.
```console
@ -724,24 +741,56 @@ $ docker network create --subnet 192.0.2.0/24 my-net
$ docker run -itd --network=my-net --ip=192.0.2.69 busybox
```
If you want to add a running container to a network use the `docker network connect` subcommand.
To connect the container to more than one network, repeat the `--network` option.
You can connect multiple containers to the same network. Once connected, the
containers can communicate using only another container's IP address
or name. For `overlay` networks or custom plugins that support multi-host
connectivity, containers connected to the same multi-host network but launched
from different Engines can also communicate in this way.
```console
$ docker network create --subnet 192.0.2.0/24 my-net1
$ docker network create --subnet 192.0.3.0/24 my-net2
$ docker run -itd --network=my-net1 --network=my-net2 busybox
```
To specify options when connecting to more than one network, use the extended syntax
for the `--network` flag. Comma-separated options that can be specified in the extended
`--network` syntax are:
| Option | Top-level Equivalent | Description |
|-----------------|---------------------------------------|-------------------------------------------------|
| `name` | | The name of the network (mandatory) |
| `alias` | `--network-alias` | Add network-scoped alias for the container |
| `ip` | `--ip` | IPv4 address (e.g., 172.30.100.104) |
| `ip6` | `--ip6` | IPv6 address (e.g., 2001:db8::33) |
| `mac-address` | `--mac-address` | Container MAC address (e.g., 92:d0:c6:0a:29:33) |
| `link-local-ip` | `--link-local-ip` | Container IPv4/IPv6 link-local addresses |
| `driver-opt` | `docker network connect --driver-opt` | Network driver options |
```console
$ docker network create --subnet 192.0.2.0/24 my-net1
$ docker network create --subnet 192.0.3.0/24 my-net2
$ docker run -itd --network=name=my-net1,ip=192.0.2.42 --network=name=my-net2,ip=192.0.3.42 busybox
```
`sysctl` settings that start with `net.ipv4.`, `net.ipv6.` or `net.mpls.` can be
set per-interface using `driver-opt` label `com.docker.network.endpoint.sysctls`.
The interface name must be the string `IFNAME`.
To set more than one `sysctl` for an interface, quote the whole `driver-opt` field,
remembering to escape the quotes for the shell if necessary. For example, if the
interface to `my-net` is given name `eth0`, the following example sets sysctls
`net.ipv4.conf.eth0.log_martians=1` and `net.ipv4.conf.eth0.forwarding=0`, and
assigns the IPv4 address `192.0.2.42`.
```console
$ docker network create --subnet 192.0.2.0/24 my-net
$ docker run -itd --network=name=my-net,\"driver-opt=com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1,net.ipv4.conf.IFNAME.forwarding=0\",ip=192.0.2.42 busybox
```
> **Note**
>
> The default bridge network only allow containers to communicate with each other using
> internal IP addresses. User-created bridge networks provide DNS resolution between
> containers using container names.
> Network drivers may restrict the sysctl settings that can be modified and, to protect
> the operation of the network, new restrictions may be added in the future.
You can disconnect a container from a network using the `docker network
disconnect` command.
For more information on connecting a container to a network when using the `run` command, see the ["*Docker network overview*"](https://docs.docker.com/network/).
For more information on connecting a container to a network when using the `run` command,
see the [Docker network overview](https://docs.docker.com/network/).
### <a name="volumes-from"></a> Mount volumes from container (--volumes-from)

20
docs/reference/commandline/network_connect.md
View File

@ -65,6 +65,26 @@ being connected to.
$ docker network connect --alias db --alias mysql multi-host-network container2
```
### <a name="sysctl"></a> Set sysctls for a container's interface (--driver-opt)
`sysctl` settings that start with `net.ipv4.` and `net.ipv6.` can be set per-interface
using `--driver-opt` label `com.docker.network.endpoint.sysctls`. The name of the
interface must be replaced by `IFNAME`.
To set more than one `sysctl` for an interface, quote the whole value of the
`driver-opt` field, remembering to escape the quotes for the shell if necessary.
For example, if the interface to `my-net` is given name `eth3`, the following example
sets `net.ipv4.conf.eth3.log_martians=1` and `net.ipv4.conf.eth3.forwarding=0`.
```console
$ docker network connect --driver-opt=\"com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1,net.ipv4.conf.IFNAME.forwarding=0\" multi-host-network container2
```
> **Note**
>
> Network drivers may restrict the sysctl settings that can be modified and, to protect
> the operation of the network, new restrictions may be added in the future.
### Network implications of stopping, pausing, or restarting containers
You can pause, restart, and stop containers that are connected to a network.

14
opts/network_test.go
View File

@ -98,6 +98,20 @@ func TestNetworkOptAdvancedSyntax(t *testing.T) {
},
},
},
{
value: "name=docknet1,\"driver-opt=com.docker.network.endpoint.sysctls=net.ipv6.conf.IFNAME.accept_ra=2,net.ipv6.conf.IFNAME.forwarding=1\"",
expected: []NetworkAttachmentOpts{
{
Target: "docknet1",
Aliases: []string{},
DriverOpts: map[string]string{
// The CLI converts IFNAME to ifname - it probably shouldn't, but the API
// allows ifname to cater for this.
"com.docker.network.endpoint.sysctls": "net.ipv6.conf.ifname.accept_ra=2,net.ipv6.conf.ifname.forwarding=1",
},
},
},
},
}
for _, tc := range testCases {
tc := tc