---
title: Isolating Applications on a Weave Network
layout: default
---

A single Weave network can host multiple, isolated applications where each application's containers are able 
to communicate with each other, but not with the containers of other applications.

To isolate applications, you can make use of `isolation-through-subnets` technique.
This common strategy is an example of how with Weave Net many of your `on metal` 
techniques can still be used to deploy applications to a container network.
 
To begin isolating an application (or parts of an application),  
configure Weave Net's IP allocator to manage multiple subnets. 

Using [the netcat example](/site/using-weave/deploying-applications.md), configure multiple subsets:

~~~bash
    host1$ weave launch --ipalloc-range 10.2.0.0/16 --ipalloc-default-subnet 10.2.1.0/24
    host1$ eval $(weave env)
    host2$ weave launch --ipalloc-range 10.2.0.0/16 --ipalloc-default-subnet 10.2.1.0/24 $HOST1
    host2$ eval $(weave env)
~~~

This delegates the entire 10.2.0.0/16 subnet to Weave Net, and instructs
it to allocate from 10.2.1.0/24 within that, if a specific subnet is not
specified. 

Next, launch the two netcat containers onto the default subnet:

~~~bash
    host1$ docker run --name a1 -ti ubuntu
    host2$ docker run --name a2 -ti ubuntu
~~~

And then to test the isolation, launch a few more containers onto a different subnet:

~~~bash
    host1$ docker run -e WEAVE_CIDR=net:10.2.2.0/24 --name b1 -ti ubuntu
    host2$ docker run -e WEAVE_CIDR=net:10.2.2.0.24 --name b2 -ti ubuntu
~~~

Ping each container to confirm that they can talk to each other, but not to the containers of our first subnet:

~~~bash
    root@b1:/# ping -c 1 -q b2
    PING b2.weave.local (10.2.2.128) 56(84) bytes of data.
    --- b2.weave.local ping statistics ---
    1 packets transmitted, 1 received, 0% packet loss, time 0ms
    rtt min/avg/max/mdev = 1.338/1.338/1.338/0.000 ms
~~~

~~~bash
    root@b1:/# ping -c 1 -q a1
    PING a1.weave.local (10.2.1.2) 56(84) bytes of data.
    --- a1.weave.local ping statistics ---
    1 packets transmitted, 0 received, 100% packet loss, time 0ms
~~~

~~~bash
    root@b1:/# ping -c 1 -q a2
    PING a2.weave.local (10.2.1.130) 56(84) bytes of data.
    --- a2.weave.local ping statistics ---
    1 packets transmitted, 0 received, 100% packet loss, time 0ms
~~~

If required, a container can also be attached to multiple subnets when it is started using:

~~~bash
    host1$ docker run -e WEAVE_CIDR="net:default net:10.2.2.0/24" -ti ubuntu
~~~

`net:default` is used to request the allocation of an address from the default subnet in addition to one from an explicitly specified range.

>>**Important:** Containers must be prevented from capturing and injecting raw network packets - this can be accomplished by starting them with the `--cap-drop net_raw` option.

>>Note: By default docker permits communication between containers on the same host, via their docker-assigned IP addresses. For complete
isolation between application containers, that feature needs to be disabled by [setting `--icc=false`](https://docs.docker.com/engine/userguide/networking/default_network/container-communication/#communication-between-containers) in the docker daemon configuration. 

**See Also** 

 * [Managing Services in Weave Net: Exporting, Importing, Binding and Routing](/site/using-weave/service-management.md)
 * [Exposing Services to the Outside World] (/site/using-weave/service-export.md)