Background: LXD is a hypervisor that manages machine containers on Linux distributions. You install LXD on your Linux distribution and then you can launch machine containers into your distribution running all sort of (other) Linux distributions.

• Using macvlan. See https://blog.simos.info/how-to-make-your-lxd-container-get-ip-addresses-from-your-lan/
• Using bridged. It is this tutorial, you are reading it now.
• Using routed. See https://blog.simos.info/how-to-get-lxd-containers-get-ip-from-the-lan-with-routed-network/
• Using ipvlan. See https://blog.simos.info/how-to-get-lxd-containers-obtain-ip-from-the-lan-with-ipvlan-networking/

In this post, we are going to see how to use a bridge to make our containers get an IP address from  the local network. Specifically, we are going to see how to do this using NetworkManager. If you have several public IP addresses, you can use this method (or the other with the macvlan) in order to expose your LXD containers directly to the Internet.

Creating the bridge with NetworkManager

See this post How to Configure and Use Network Bridge in Ubuntu Linux (new link, thanks Samuel) on how to create the bridge with NetworkManager. It explains that you

1. Use NetworkManager to Add a New Connection, a Bridge.
2. When configuring the Bridge, you specify the real network connection (the device, like eth0 or enp3s12) that will be the slave of the bridge. You can verify the device of the network connection if you run ip route list 0.0.0.0/0.
3. Then, you can remove the old network connection and just keep the slave. The slave device (bridge0) will now be the device that gets you your LAN IP address.

At this point you would have again network connectivity. Here is the new device, bridge0.

$ ifconfig bridge0
bridge0 Link encap:Ethernet HWaddr 00:e0:4b:e0:a8:c2 
 inet addr:192.168.1.64 Bcast:192.168.1.255 Mask:255.255.255.0
 inet6 addr: fe80::d3ca:7a11:f34:fc76/64 Scope:Link
 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
 RX packets:9143 errors:0 dropped:0 overruns:0 frame:0
 TX packets:7711 errors:0 dropped:0 overruns:0 carrier:0
 collisions:0 txqueuelen:1000 
 RX bytes:7982653 (7.9 MB) TX bytes:1056263 (1.0 MB)

Creating a new profile in LXD for bridge networking

In LXD, there is a default profile and then you can create additional profile that either are independent from the default (like in the macvlan post), or can be chained with the default profile. Now we see the latter.

First, get a list of all available existing profiles. There is a single profile, the default one from LXD, and is used by 11 LXD containers. This means that this LXD installation has 11 containers.

$ lxc profile list
+---------------+---------+
| NAME          | USED BY |
+---------------+---------+
| default       | 11      |
+---------------+---------+

Then, create a new and empty LXD profile, called bridgeprofile.

$ lxc profile create bridgeprofile

Here is the fragment to add to the new profile. The eth0 is the interface name in the container, so for the Ubuntu containers it does not change. Then, bridge0 is the interface that was created by NetworkManager. If you created that bridge by some other way, add here the appropriate interface name. The EOF at the end is just a marker when we copy and past to the profile.

description: Bridged networking LXD profile
devices:
  eth0:
    name: eth0
    nictype: bridged
    parent: bridge0
    type: nic
EOF

Paste the fragment to the new profile.

$ cat <<EOF | lxc profile edit bridgeprofile
(paste here the full fragment from earlier)

The end result should look like the following.

$ lxc profile show bridgeprofile
config: {}
description: Bridged networking LXD profile
devices:
  eth0:
    name: eth0
    nictype: bridged
    parent: bridge0
    type: nic
name: bridgeprofile
used_by:

Now, list again the profiles so that we can verify the newly created profile, bridgeprofile. It is there, and it is not used yet by a LXD (lex-dee) container.

$ lxc profile list
+---------------+---------+
| NAME          | USED BY |
+---------------+---------+
| bridgeprofile | 0       |
+---------------+---------+
| default       | 11      |
+---------------+---------+

If it got messed up, delete the profile and start over again. Here is the command.

$ lxc profile delete profile_name_to_delete

Creating containers with the bridge profile

Now we are ready to create a new container that will use the bridge. We need to specify first the default profile, then the new profile. This is because the new profile will overwrite the network settings of the default profile.

$ lxc launch -p default -p bridgeprofile ubuntu:x mybridge
Creating mybridgeStarting mybridge

Here is the result.

$ lxc list
+-------------+---------+---------------------+------+
| mytest | RUNNING | 192.168.1.72 (eth0)      |      |
+-------------+---------+---------------------+------+
| ...                                         | ...  |

The container mybridge is accessible from the local network.

Changing existing containers to use the bridge profile

Suppose we have an existing container that was created with the default profile, and got the LXD NAT network. Can we switch it to use the bridge profile?

Here is the existing container.

$ lxc launch ubuntu:x mycontainer
Creating mycontainerStarting mycontainer

Let’s assign mycontainer to use the new profile, “default,bridgeprofile”.

$ lxc profile assign mycontainer default,bridgeprofile

Now we just need to restart the networking in the container.

$ lxc exec mycontainer -- systemctl restart networking.service

This can take quite some time, 10 to 20 seconds. Be patient. Obviously, we could simply restart the container. However, since it can take quite some time to get the IP address, it is more practical to know exactly when you get the new IP address.

Let’s see how it looks!

$ lxc list ^mycontainer$
+----------------+-------------+---------------------+------+
| NAME           | STATE       | IPV4                | IPV6 |
+----------------+-------------+---------------------+------+
| mycontainer    | RUNNING     | 192.168.1.76 (eth0) |      |
+----------------+-------------+---------------------+------+

It is great! It got a LAN IP address! In the lxc list command, we used the filter ^mycontainer$, which means to show only the container with the exact name mycontainer. By default, lxc list does a substring search when it tries to match a container name. Those ^ and $ characters are related to Linux/Unix in general, where ^ means start, and $ means end. Therefore, ^mycontainer$ means the exact string mycontainer!

Changing bridged containers to use the LXD NAT

Let’s switch back from using the bridge, to using the LXD NAT network. We stop the container, then assign just the default profile and finally start the container.

$ lxc stop mycontainer
$ lxc profile assign mycontainer default
Profiles default applied to mycontainer
$ lxc start mycontainer

Let’s have a look at it,

$ lxc list ^mycontainer$
+-------------+---------+----------------------+--------------------------------+
| NAME        | STATE   | IPV4                 | IPV6                           |
+-------------+---------+----------------------+--------------------------------+
| mycontainer | RUNNING | 10.52.252.101 (eth0) | fd42:cba6:...:fe10:3f14 (eth0) |
+-------------+---------+----------------------+--------------------------------+

NOTE: I tried to assign the default profile while the container was running in bridged mode. It made a mess with the networking and the container could not get an IPv4 IP address anymore. It could get an IPv6 address though. Therefore, use as a rule of thumb to stop a container before assigning a different profile.

NOTE #2: If your container has a LAN IP address, it is important to stop the container so that your router’s DHCP server gets the notification to remove the DHCP lease. Most routers remember the MAC address of a new computer, and a new container gets a new random MAC address. Therefore, do not delete or kill containers that have a LAN IP address but rather stop them first. Your router’s DHCP lease table is only that big.

Conclusion

In this post we saw how to selectively get ours containers to receive a LAN IP address.  This requires to set the host network interface to be the slave of the bridge. It is a bit invasive compared to using a macvlan, but offers the ability for the containers and the host to communicate with each other over the LAN.

Simos Xenitellis