Matthias Radestock
df5d6972e1
- strip "Weave" and "Weave Net" - "Integrating a Host Network with Weave" -> "Integrating with the Host Network" - "Configuring Weave to Explicitly Use an IP Range" -> "Allocating IPs in a Specific Range"
70 lines
3.3 KiB
Markdown
70 lines
3.3 KiB
Markdown
---
|
|
title: Isolating Applications on a Weave Network
|
|
menu_order: 30
|
|
---
|
|
|
|
A single Weave network can host multiple, isolated applications where each application's containers are able
|
|
to communicate with each other, but not with the containers of other applications.
|
|
|
|
To isolate applications, you can make use of `isolation-through-subnets` technique.
|
|
This common strategy is an example of how with Weave Net many of your `on metal`
|
|
techniques can still be used to deploy applications to a container network.
|
|
|
|
To begin isolating an application (or parts of an application),
|
|
configure Weave Net's IP allocator to manage multiple subnets.
|
|
|
|
Using [the netcat example](/site/using-weave.md), configure multiple subsets:
|
|
|
|
host1$ weave launch --ipalloc-range 10.2.0.0/16 --ipalloc-default-subnet 10.2.1.0/24
|
|
host1$ eval $(weave env)
|
|
host2$ weave launch --ipalloc-range 10.2.0.0/16 --ipalloc-default-subnet 10.2.1.0/24 $HOST1
|
|
host2$ eval $(weave env)
|
|
|
|
This delegates the entire 10.2.0.0/16 subnet to Weave Net, and instructs
|
|
it to allocate from 10.2.1.0/24 within that, if a specific subnet is not
|
|
specified.
|
|
|
|
Next, launch the two netcat containers onto the default subnet:
|
|
|
|
host1$ docker run --name a1 -ti ubuntu
|
|
host2$ docker run --name a2 -ti ubuntu
|
|
|
|
And then to test the isolation, launch a few more containers onto a different subnet:
|
|
|
|
host1$ docker run -e WEAVE_CIDR=net:10.2.2.0/24 --name b1 -ti ubuntu
|
|
host2$ docker run -e WEAVE_CIDR=net:10.2.2.0.24 --name b2 -ti ubuntu
|
|
|
|
Ping each container to confirm that they can talk to each other, but not to the containers of our first subnet:
|
|
|
|
root@b1:/# ping -c 1 -q b2
|
|
PING b2.weave.local (10.2.2.128) 56(84) bytes of data.
|
|
--- b2.weave.local ping statistics ---
|
|
1 packets transmitted, 1 received, 0% packet loss, time 0ms
|
|
rtt min/avg/max/mdev = 1.338/1.338/1.338/0.000 ms
|
|
|
|
root@b1:/# ping -c 1 -q a1
|
|
PING a1.weave.local (10.2.1.2) 56(84) bytes of data.
|
|
--- a1.weave.local ping statistics ---
|
|
1 packets transmitted, 0 received, 100% packet loss, time 0ms
|
|
|
|
root@b1:/# ping -c 1 -q a2
|
|
PING a2.weave.local (10.2.1.130) 56(84) bytes of data.
|
|
--- a2.weave.local ping statistics ---
|
|
1 packets transmitted, 0 received, 100% packet loss, time 0ms
|
|
|
|
If required, a container can also be attached to multiple subnets when it is started using:
|
|
|
|
host1$ docker run -e WEAVE_CIDR="net:default net:10.2.2.0/24" -ti ubuntu
|
|
|
|
`net:default` is used to request the allocation of an address from the default subnet in addition to one from an explicitly specified range.
|
|
|
|
>**Important:** Containers must be prevented from capturing and injecting raw network packets - this can be accomplished by starting them with the `--cap-drop net_raw` option.
|
|
|
|
>Note: By default docker permits communication between containers on the same host, via their docker-assigned IP addresses. For complete
|
|
isolation between application containers, that feature needs to be disabled by [setting `--icc=false`](https://docs.docker.com/engine/userguide/networking/default_network/container-communication/#communication-between-containers) in the docker daemon configuration.
|
|
|
|
**See Also**
|
|
|
|
* [Automatic Allocation Across Multiple Subnets](/site/ipam/allocation-multi-ipam.md)
|
|
* [Managing Services - Exporting, Importing, Binding and Routing](/site/using-weave/service-management.md)
|