current community

your communities

more stack exchange communities

Stack Exchange
tour help
stack overflow careers
Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.
up vote 15 down vote favorite
3

I'm trying to understand what's happening under the hood to a network packet coming from the wire connected to the host machine and directed to an application inside a Docker container.

If it were a classic VM, I know that a packet arriving on the host would be transmitted by the hypervisor (say VMware, VBox etc.) to the virtual NIC of the VM and from there through the TCP/IP stack of the guest OS, finally reaching the application.

In the case of Docker, I know that a packet coming on the host machine is forwarded form the network interface of the host to the docker0 bridge, that is connected to a veth pair ending on the virtual interface eth0 inside the container. But after that? Since all Docker containers use the host kernel, is it correct to presume that the packet is processed by the TCP/IP stack of the host kernel? If so, how?

I would really like to read a detailed explanation (or if you know a resource feel free to link it) about what's really happening under the hood. I already carefully read this page, but it doesn't say everything.

Thanks in advance for your reply.

share|improve this question
1  
Yes, the host TCP/IP stack is used. After reading the page you linked to, it's hard to add much more except reading the linux kernel and docker source code- do you have any specific questions rather ? –  nos Jul 8 '14 at 15:08
    
Thanks for your comment. Well, for example it is unclear to me how the data is transmitted form the docker0 bridge to the eth0 of the host machine: I tried to use wireshark but I can only see packets exchanged from docker0 and the vethXYZ; I also presume that between docker0 and eth0 there is a NAT since addresses change but I didn't found documentation about it. –  Manuel Durando Jul 9 '14 at 11:34
    
Right, most of that, including the NAT rules employed by docker is explained in that document. –  nos Jul 9 '14 at 13:28
    
My fault, I skipped the paragraph "Binding container ports to the host" because of the title; sorry for wasting your time. I would suggest you to convert your first comment in an answer, since you answered about the TCP/IP stack, I would accept it gladly :-) –  Manuel Durando Jul 9 '14 at 19:44

1 Answer 1

up vote 2 down vote

The network stack, as in "the code", is definitely not in the container, it's in the kernel of which there's only one shared by the host and all containers (you already knew this). What each container has is its own separate network namespace, which means it has its own network interfaces and routing tables.

Here's a brief article introducing the notion with some examples: http://blog.scottlowe.org/2013/09/04/introducing-linux-network-namespaces/ and I found this article helpful too: http://containerops.org/2013/11/19/lxc-networking/

I hope this gives you enough pointers to dig deeper.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.