<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>Apols, my usual norm is tangental but seems I have gone worse... :)</div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;">I have been thinking of LXC in terms of server services where the case is often that servers and clients are on the same subnet.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent;"><span style="font-style: normal;">Kerberos and authentication, Cups and various others not exactly true but simple same subnet
routing.</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;"><span style="font-style: normal;"><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;"><span style="font-style: normal;">I guess the bridge and another subnet was chosen purely to stop clashes with the physical host subnet.</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;"><span style="font-style: normal;"><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;">My mind was mulling over the idea of a samba4, proxy,
email... lxc containers all running isolated but authenticating via kerb and samba4.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;">That way I could use a single server and as the system grows its quite simple to hop from container to dedicated server.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;"> </div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;"><br></div><div><br></div> <div style="font-family: 'times new roman',
'new york', times, serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Michael H. Warfield <mhw@WittsEnd.com><br> <b><span style="font-weight: bold;">To:</span></b> Bretton Woods <woods.bretton@yahoo.co.uk> <br><b><span style="font-weight: bold;">Cc:</span></b> mhw@WittsEnd.com; "lxc-users@lists.sourceforge.net" <lxc-users@lists.sourceforge.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Saturday, 3 August 2013, 23:04<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Lxc-users] local subnet<br> </font> </div> <div class="y_msg_container"><br>On Sat, 2013-08-03 at 22:23 +0100, Bretton Woods wrote: <br>> the answer is probably yes.<br>> <br>> <br>> is it possible to create a container without a network bridge that is<br>>
on the same subnet as the host?<br><br>I believe that is what "macvlan" was suppose to be for but I never had a<br>good experience with it (ongoing host to container issue that may or may<br>not have been resolved in the kernel - I gave up long ago). I generally<br>used bridged, one way or another.<br>> <br>> In fact why do we always create a bridge and another subnet?<br><br>I don't understand this question. You have two parts which are<br>orthogonal.<br><br>Quite literally, the only differences between "bridged mode", "nat<br>mode", and "routed mode" is whether the host interface is a member of<br>the bridge and your router/nat configurations.<br><br>If the host interface is a member of the common bridge, you are in a<br>fully bridged mode and you don't need another subnet and your guests are<br>part of the hosts subnet.<br><br>If it's not, you're generally (default) assigning a private address to<br>the bridge and using NAT (nat
mode) or (very rare) assigning a global<br>unicast IPv4 block to the bridge and using true routing for "routed<br>mode" with static routes on your host.<br><br>The key to all three modes is that bridge, which acts as an internal<br>etherswitch on the host (some literature even refers to it as a virtual<br>lan). So the "and another subnet" actually only applies to two of those<br>three modes (and routed mode is so rare, I'm tempted to say it doesn't<br>really count).<br><br>also, If you really REALLY want to get bitching complex, you can use a<br>hybrid mode with IPv4 and IPv6 where IPv4 is routed / nated and IPv6 is<br>bridged directly. Then your IPv4 networking is on separate subnets but<br>your IPv6 routing is on a flat SLA (IPv6 subnet) and managed by the<br>common router and it's RA's (router advertisements). That requires<br>creative use of the mac level firewalling (ebtables) and is not<br>recommended unless you're a real
masochistic experimenter like I am.<br><br>> bretton<br>> <br>> <br>> Just one of those thoughts :)<br>> <br>Interesting thoughts but you have other options. What you are referring<br>to is merely the default.<br><br>Regards,<br>Mike<br>-- <br>Michael H. Warfield (AI4NB) | (770) 985-6132 | <a ymailto="mailto:mhw@WittsEnd.com" href="mailto:mhw@WittsEnd.com">mhw@WittsEnd.com</a><br> /\/\|=mhw=|\/\/ | (678) 463-0932 | <a href="http://www.wittsend.com/mhw/" target="_blank">http://www.wittsend.com/mhw/</a><br> NIC whois: MHW9 | An optimist believes we live in the best of all<br> PGP Key: 0x674627FF | possible worlds. A pessimist is sure of it!<br><br></div> </div> </div> </div></body></html>