In this video, we'll talk about container networking.
So docker containers and pot and root containers are offered on their own network.
Because these containers have an IP address and this IP address needs to be provided in
full isolation.
To offer the full isolation, the Linux network bridge device is used to connect the private
container network to the external network.
So the containers have their own IP address, but they cannot be used from the outside because
they are on the private network.
However, from the private network, containers can go outside and packets can return to the
container using Network Address Translation or NET technology.
And this NET technology is implemented by Linux firewalls.
So that is why firewalling is always important when you are using containers.
In Potman, it's a little bit different if you are using Potman rootless containers,
because they don't have an IP address, and for that reason, they are not connected to
any container network.
The Potman philosophy is why would a container need an IP address?
Because really, a container is all about a specific process that is running, and the
generic way to address processes is by using their port numbers.
Now let me show you what these container networks look like in a docker environment.
All right, let me start by doing a sudo apt install docker.io.
Now this being docker, I need sudo usermod minus a g docker and student to make sure
that my current account is a member of the group docker, otherwise it can't run containers.
And now as a little trick to rapidly activate my new group membership, I use new GRP docker.
Let's start a subshell in which docker is my primary group.
Primary group is not perfect, but for this demo, it's good enough.
So I'm going to use docker run nginx.
And what is that doing?
Well, it's unable to find the image nginx locally, and it's going to fetch it.
We have seen that before.
And oh boy, I didn't make that docker run minus d.
We wanted to run in detached mode, right?
So here docker ps is showing that it is running.
Now if I use IPA, then what do we see?
We see that besides the ns160, there is a docker 0, and it's this docker 0 that was
automatically created by docker as a docker bridge.
Now in this docker bridge, there is a virtual patch cable.
You can even see that in the IPA output.
It's the veth5, et cetera, highlighted here.
And this is the virtual patch cable that goes into the container.
So if I use docker ps, then I can see my container.
And if I would use docker inspect on silly satellite, there we can see the IP address
configuration that has been assigned to it.
You can also see that this container is on the network with the name bridge.
And this network has its own gateway and its own IP address.
And this is how the container can connect to the external network.
And this is container networking in a nutshell.