FrançaisGet started

Virtual networks

How containers talk to each other: the virtual interface pair and the host bridge, Docker's network drivers, VXLAN encapsulation between hosts, Kubernetes' network model and the NetworkPolicy.

  • 36 cards
  • 6 topics
  • Free
Study this deck

The outline, topic by topic

Each topic is weighted the way the exam weighs it.

  1. Concepts
  2. Questions
  3. Sort and link
  4. On the diagram
  5. Scenarios
  6. Understand

A few cards from the deck

  • veth pair: what is it?

    Show the answer

    Two virtual network interfaces linked like the two ends of a cable: whatever enters one comes out of the other, even when they live in two different namespaces.

    One end is moved into the container's network namespace (where it becomes eth0), the other is plugged into the host bridge: this virtual cable is what lets the container out of its isolation.

  • What happens on the last command?

    ```bash
    docker run -d --name web nginx
    docker run --rm alpine ping -c1 web
    `

    • ping: bad address 'web': the name is not resolved
    • The ping succeeds: Docker resolves web on every network
    • Network unreachable: the two containers are on isolated networks
    • Connection refused: web is found but does not listen
    Show the answer

    ping: bad address 'web': the name is not resolved

    Both containers are on the default bridge, which offers no name resolution. On a network created with docker network create, the same command succeeds. It is a resolution failure, not a routing one.

  • With the … driver, the container shares the host's network stack; with the … driver, it only has the loopback interface.

    Show the answer

    With the host driver, the container shares the host's network stack; with the none driver, it only has the loopback interface.

    host removes network isolation (the container's ports are the host's ports, with no publishing), none makes it total: no interface to the outside, no route.

  • Linux bridge: what is it?

    Show the answer

    A software switch in the kernel that joins several virtual interfaces and forwards frames between them according to their MAC addresses.

    Docker creates one per bridge network (docker0 for the default one): the containers plugged into it can reach each other, and the host sends them out through address translation.

Study this deck