<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 04/03/18 02:26, Steven Spencer wrote:<br>
<blockquote type="cite"
cite="mid:CAKE+uH8MosE=Gjfhik8aBiReAMsE8Wkrwi=0Ubyc3N74545RGA@mail.gmail.com">
<div dir="ltr">Honestly, unless I'm spinning up a container on my
local desktop, I always use the routed method. Because our
organization always thinks of a container as a separate machine,
it makes the build pretty similar whether the machine is on the
LAN or WAN side of the network. It does, of course, require that
each container run its own firewall, but that's what we would do
with any machine on our network.</div>
<div class="gmail_extra"><br>
</div>
</blockquote>
Can you please elaborate on your setup?It always seemed like
administrative hassle to me. Outside routers need to known how to
find your container. I can see three ways, each has it's drawbacks:<br>
<br>
1. Broadcast container MACs outside, but L3-route packets inside the
server instead of L2-bridging. Seems clean but I don't know how to
do it in [bare] Linux.<br>
<br>
2. Create completely virtual LAN (not in 802.1q sense) with separate
IP address space inside the server and teach outside routers to
route corresponding addresses via your server. OKish as long as you
have access to the outside router configuration, but some things
like broadcasts won't work. Also, I'm not sure it solves OP
inter-container isolation problem.<br>
<br>
3. Create separate routing table rule for each container/group of
them. Hard to administer and dangerous IMO.<br>
<br>
<pre class="moz-signature" cols="72">--
With Best Regards,
Marat Khalili
</pre>
</body>
</html>