Quartz 5

How Container Networking Works: Building a Bridge Network From Scratch

Properties2
descriptionHands-on tutorial building container networking from scratch using Linux network namespaces, veth pairs, bridges, iptables, and NAT.
tagsclippings

3 min read

How Container Networking Works: Building a Bridge Network From Scratch

Overview

This tutorial teaches fundamental Linux networking concepts by building a complete container networking setup from scratch. The content demonstrates how Docker and Kubernetes manage network isolation and communication between containers.

Prerequisites

  • Basic bash and Linux command line knowledge required
  • Tested on Ubuntu 22.04; compatible with modern Linux distributions
  • Requires root or sudo access for network configuration commands

Main Network Environment Components

A Linux networking context consists of:

  • Network devices
  • Routing tables
  • Netfilter/iptables firewall rules

The tutorial provides an inspection script to examine these components before and after creating containers.

Network Namespaces (netns)

Creating isolated network environments:

ip netns add netns0
ip netns list
nsenter --net=/run/netns/netns0 bash

Each namespace has its own devices, routes, and firewall rules, completely isolated from the host and other namespaces.

Virtual Ethernet Devices (veth)

Connecting namespaces requires virtual Ethernet pairs that act as “tunnels”:

ip link add veth0 type veth peer name ceth0
ip link set ceth0 netns netns0

One device remains in the host namespace while its peer moves into the container namespace, enabling bidirectional communication.

Bridge Networking

Multiple containers sharing an IP network requires a virtual switch:

ip link add br0 type bridge
ip link set br0 up
ip link set veth0 master br0
ip link set veth1 master br0
ip addr add 172.18.0.1/16 dev br0

The bridge operates at Layer 2 (Ethernet), forwarding packets between connected interfaces without requiring explicit IP routing.

IP Routing and Network Address Translation

Enabling containers to reach external networks:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 172.18.0.0/16 ! -o br0 -j MASQUERADE

The host becomes a router, and NAT (masquerading) replaces container source IPs with the host’s external address before sending packets outbound.

Port Publishing

Exposing container services to the outside world:

iptables -t nat -A PREROUTING \
  -d 172.16.0.2 -p tcp -m tcp --dport 5000 \
  -j DNAT --to-destination 172.18.0.10:5000

DNAT (Destination NAT) rules redirect incoming traffic on the host to container services.

Docker Network Modes

  • host: No namespace isolation; containers share the host’s network stack
  • none: Only loopback interface; no external connectivity
  • bridge: Default mode using the techniques described above

Practical Implementation

The tutorial walks through creating two containers that:

  1. Communicate with each other via bridge
  2. Access the host system
  3. Reach external networks through NAT
  4. Expose services via port publishing

Learning Outcomes

Understanding these foundational concepts provides insights into:

  • How containerization achieves network isolation
  • Docker’s internal networking mechanisms
  • Kubernetes networking basics (which builds on bridge networking)
  • Linux kernel networking features

The tutorial emphasizes that container networking emerges from combining basic Linux facilities rather than specialized container technology.

Graph View

Backlinks