How to make your LXD containers get IP addresses from your LAN using a bridge

Background: LXD is a hypervisor that manages machine containers on Linux distributions. You install LXD on your Linux distribution and then you can launch machine containers into your distribution running all sort of (other) Linux distributions.

In the previous post, we saw how to get our LXD container to receive an IP address from the local network (instead of getting the default private IP address), using macvlan.

How to make your LXD containers get IP addresses from your LAN using macvlan

In this post, we are going to see how to use a bridge to make our containers get an IP address from  the local network. Specifically, we are going to see how to do this using NetworkManager. If you have several public IP addresses, you can use this method (or the other with the macvlan) in order to expose your LXD containers directly to the Internet.

Creating the bridge with NetworkManager

See this post How to configure a Linux bridge with Network Manager on Ubuntu on how to create the bridge with NetworkManager. It explains that you

  1. Use NetworkManager to Add a New Connection, a Bridge.
  2. When configuring the Bridge, you specify the real network connection (the device, like eth0 or enp3s12) that will be the slave of the bridge. You can verify the device of the network connection if you run ip route list 0.0.0.0/0.
  3. Then, you can remove the old network connection and just keep the slave. The slave device (bridge0) will now be the device that gets you your LAN IP address.

At this point you would have again network connectivity. Here is the new device, bridge0.

$ ifconfig bridge0
bridge0 Link encap:Ethernet HWaddr 00:e0:4b:e0:a8:c2 
 inet addr:192.168.1.64 Bcast:192.168.1.255 Mask:255.255.255.0
 inet6 addr: fe80::d3ca:7a11:f34:fc76/64 Scope:Link
 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
 RX packets:9143 errors:0 dropped:0 overruns:0 frame:0
 TX packets:7711 errors:0 dropped:0 overruns:0 carrier:0
 collisions:0 txqueuelen:1000 
 RX bytes:7982653 (7.9 MB) TX bytes:1056263 (1.0 MB)

Creating a new profile in LXD for bridge networking

In LXD, there is a default profile and then you can create additional profile that either are independent from the default (like in the macvlan post), or can be chained with the default profile. Now we see the latter.

First, get a list of all available existing profiles. There is a single profile, the default one from LXD, and is used by 11 LXD containers. This means that this LXD installation has 11 containers.

$ lxc profile list
+---------------+---------+
| NAME          | USED BY |
+---------------+---------+
| default       | 11      |
+---------------+---------+

Then, create a new and empty LXD profile, called bridgeprofile.

$ lxc create profile bridgeprofile

Here is the fragment to add to the new profile. The eth0 is the interface name in the container, so for the Ubuntu containers it does not change. Then, bridge0 is the interface that was created by NetworkManager. If you created that bridge by some other way, add here the appropriate interface name. The EOF at the end is just a marker when we copy and past to the profile.

description: Bridged networking LXD profile
devices:
  eth0:
    name: eth0
    nictype: bridged
    parent: bridge0
    type: nic
EOF

Paste the fragment to the new profile.

$ cat <<EOF | lxc profile edit bridgeprofile
(paste here the full fragment from earlier)

The end result should look like the following.

$ lxc profile show bridgeprofile
config: {}
description: Bridged networking LXD profile
devices:
  eth0:
    name: eth0
    nictype: bridged
    parent: bridge0
    type: nic
name: bridgeprofile
used_by:

Now, list again the profiles so that we can verify the newly created profile, bridgeprofile. It is there, and it is not used yet by a LXD (lex-dee) container.

$ lxc profile list
+---------------+---------+
| NAME          | USED BY |
+---------------+---------+
| bridgeprofile | 0       |
+---------------+---------+
| default       | 11      |
+---------------+---------+

If it got messed up, delete the profile and start over again. Here is the command.

$ lxc profile delete profile_name_to_delete

Creating containers with the bridge profile

Now we are ready to create a new container that will use the bridge. We need to specify first the default profile, then the new profile. This is because the new profile will overwrite the network settings of the default profile.

$ lxc launch -p default -p bridgeprofile ubuntu:x mybridge
Creating mybridgeStarting mybridge

Here is the result.

$ lxc list
+-------------+---------+---------------------+------+
| mytest | RUNNING | 192.168.1.72 (eth0)      |      |
+-------------+---------+---------------------+------+
| ...                                         | ...  |

The container mybridge is accessible from the local network.

Changing existing containers to use the bridge profile

Suppose we have an existing container that was created with the default profile, and got the LXD NAT network. Can we switch it to use the bridge profile?

Here is the existing container.

$ lxc launch ubuntu:x mycontainer
Creating mycontainerStarting mycontainer

Let’s assign mycontainer to use the new profile, “default,bridgeprofile”.

$ lxc profile assign mycontainer default,bridgeprofile

Now we just need to restart the networking in the container.

$ lxc exec mycontainer -- systemctl restart networking.service

This can take quite some time, 10 to 20 seconds. Be patient. Obviously, we could simply restart the container. However, since it can take quite some time to get the IP address, it is more practical to know exactly when you get the new IP address.

Let’s see how it looks!

$ lxc list ^mycontainer$
+----------------+-------------+---------------------+------+
| NAME           | STATE       | IPV4                | IPV6 |
+----------------+-------------+---------------------+------+
| mycontainer    | RUNNING     | 192.168.1.76 (eth0) |      |
+----------------+-------------+---------------------+------+

It is great! It got a LAN IP address! In the lxc list command, we used the filter ^mycontainer$, which means to show only the container with the exact name mycontainer. By default, lxc list does a substring search when it tries to match a container name. Those ^ and $ characters are related to Linux/Unix in general, where ^ means start, and $ means end. Therefore, ^mycontainer$ means the exact string mycontainer!

Changing bridged containers to use the LXD NAT

Let’s switch back from using the bridge, to using the LXD NAT network. We stop the container, then assign just the default profile and finally start the container.

$ lxc stop mycontainer
$ lxc profile assign mycontainer default
Profiles default applied to mycontainer
$ lxc start mycontainer

Let’s have a look at it,

$ lxc list ^mycontainer$
+-------------+---------+----------------------+--------------------------------+
| NAME        | STATE   | IPV4                 | IPV6                           |
+-------------+---------+----------------------+--------------------------------+
| mycontainer | RUNNING | 10.52.252.101 (eth0) | fd42:cba6:...:fe10:3f14 (eth0) |
+-------------+---------+----------------------+--------------------------------+

NOTE: I tried to assign the default profile while the container was running in bridged mode. It made a mess with the networking and the container could not get an IPv4 IP address anymore. It could get an IPv6 address though. Therefore, use as a rule of thumb to stop a container before assigning a different profile.

NOTE #2: If your container has a LAN IP address, it is important to stop the container so that your router’s DHCP server gets the notification to remove the DHCP lease. Most routers remember the MAC address of a new computer, and a new container gets a new random MAC address. Therefore, do not delete or kill containers that have a LAN IP address but rather stop them first. Your router’s DHCP lease table is only that big.

Conclusion

In this post we saw how to selectively get ours containers to receive a LAN IP address.  This requires to set the host network interface to be the slave of the bridge. It is a bit invasive compared to using a macvlan, but offers the ability for the containers and the host to communicate with each other over the LAN.

 

Permanent link to this article: https://blog.simos.info/how-to-make-your-lxd-containers-get-ip-addresses-from-your-lan-using-a-bridge/

2 comments

1 ping

    • Jair Bolivar on March 10, 2018 at 13:54
    • Reply

    Just noticed that for the LXD ver 2.21 the command to create the new bridge profile is:

    root@lxc1:~# lxc profile list
    +———+———+
    | NAME | USED BY |
    +———+———+
    | default | 0 |
    +———+———+
    root@lxc1:~# lxc profile create bridgeprofile
    Profile bridgeprofile created

    root@lxc1:~# lxc profile list
    +—————+———+
    | NAME | USED BY |
    +—————+———+
    | bridgeprofile | 0 |
    +—————+———+
    | default | 0 |
    +—————+———+

    1. Thanks for pointing this out. It is an omission in this post, as it should show first any existing profilers, then create the new one and finally list again all profiles (to show the newly created one).

      I’ll update the post.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: