<div dir="ltr">Have you checked Fan? <br><br><a href="http://blog.dustinkirkland.com/2015/06/the-bits-have-hit-fan.html?m=1">http://blog.dustinkirkland.com/2015/06/the-bits-have-hit-fan.html?m=1</a><br><br></div><div class="gmail_extra"><br><div class="gmail_quote">2015-06-20 2:16 GMT-04:00 Janjaap Bos <span dir="ltr"><<a href="mailto:janjaapbos@gmail.com" target="_blank">janjaapbos@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Yes, ZeroTier provides peer-to-peer virtual networking. It is cloud / container / virtualiser agnostic. It will work anywhere and we use it for connecting containers & vm's across clouds. Also to provide access to users on Windows / OSX.<div><br></div><div>Within the container you need access to the /dev/net/tun device and depending on the flavour (lxc / lxd / docker) net_admin capabilities.</div><div><br></div><div>You can download it at <a href="https://www.zerotier.com" target="_blank">https://www.zerotier.com</a> or build it from <a href="https://github.com/zerotier/ZeroTierOne" target="_blank">https://github.com/zerotier/ZeroTierOne</a></div><div><br></div><div>Since it is peer-to-peer there is very little overhead. Packets destined for local peers will stay within the local net. You can create very large distributed flat ether networks. Great for the type of cloud backplane you described.</div><div><br></div><div>Also, this enables you to live migrate instances while maintaining their network configuration.</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">2015-06-20 3:37 GMT+02:00 Tomasz Chmielewski <span dir="ltr"><<a href="mailto:mangoo@wpkg.org" target="_blank">mangoo@wpkg.org</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I know this is just "normal networking", however, there are at least two issues with your suggestions:<br>
<br>
- it assumes the hosts are in the same subnet (say, connected to the same switch), so it won't work if the hosts have two different public IPs (i.e. 46.1.2.3 and 124.8.9.10)<br>
<br>
- with just two hosts, you may overcome the above limitation with some VPN magic; however, it becomes problematic as the number of hosts grows (imagine 10 or more hosts, trying to set it up without SPOF / central VPN server; ideally, the hosts should talk to themselves using the shortest paths possible)<br>
<br>
<br>
Therefore, I'm asking if there is any better "magic", as you say, for lxc networking?<br>
Possibly it could be achieved with tinc, running on hosts only - <a href="http://www.tinc-vpn.org/" rel="noreferrer" target="_blank">http://www.tinc-vpn.org/</a> - but haven't really used it.<br>
And maybe people have other ideas?<span><br>
<br>
-- <br>
Tomasz Chmielewski<br>
<a href="http://wpkg.org" rel="noreferrer" target="_blank">http://wpkg.org</a><br>
<br>
<br></span><span>
On 2015-06-20 03:20, Christoph Lehmann wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>
There is no magic with lxcs networking. Its just a bridge and some<br>
iptables rules for NAT and a dhcp server.<br>
<br>
You can setup a bridge on your public interface, configure the<br>
container to use that bridge and do the same on your second host.<br>
<br>
Am 19. Juni 2015 18:15:23 MESZ, schrieb Tomasz Chmielewski<br>
<<a href="mailto:mangoo@wpkg.org" target="_blank">mangoo@wpkg.org</a>>:<br>
<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>
Are there any solutions which would let one build "mesh networking"<br>
for<br>
lxc containers, similar to what weave does for docker?<br>
<br>
Assumptions:<br>
<br>
- multiple servers (hosts) which are not in the same subnet (i.e. in<br>
<br>
different DCs in different countries),<br></span>
- containers share the same subnet (i.e. <a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">10.0.0.0/8</a> [1]), no matter<span><br>
on which<br>
host they are running<br>
- if container is migrated to a different host, it is still<br>
reachable on<br>
the same IP address without any changes in the networking<br>
<br>
I suppose the solution would run only once on each of the hosts,<br>
rather<br>
than in each container.<br>
<br>
Is there something similar for lxc?<br>
</span></blockquote><span>
<br>
--<br>
Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail<br>
gesendet.<br></span><span>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br>
</span></blockquote><div><div>
<br>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a></div></div></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature">Luis M. Ibarra</div>
</div>