将docker容器ip设置为全局ip

Question

I am currently trying to set a ip to container which can accessed by any other machine within the network. The network in which my docker-host machine is 9.158.143.0/24 with a gateway 9.158.143.254. Tried setting the ip(any free) within the subnet 9.158.143.0/24 with network type as bridge.It did not work(not even able to ping the container within docker host machine). Then created a user defined network with subnet 9.10.10.0/24 and network driver as bridge. the container created is pingable but only within docker host machine. Is there any way that this container be accessible from all the machine within the network(not just docker host machine). PS: i do not want to expose the port.(Is changing routes helpful ..i know very little networking)

I aso tried userdefined network with macvlan driver. in this case i am able to ping container from other machines but not from docker host machine where container is present

Answer 1

To do this, you need to:

1- dedicate a new address for this container, on your local network;

2- configure this address as a secondary address on your docker engine host;

3- enable routing between local interfaces on your docker engine host;

4- use iptables to redirect the connections to this new address to your container.

Here is an example:

We suppose:

• your container instance is named myinstance

• your LAN network interface is named eth0

• you have chosen the available network address 192.168.1.178 on your LAN

So, you need to do the following:

• start your container (in this example, we start a web server):

  docker run --rm -t -i --name=mycontainer httpd:2.2-alpine

• enable local IP routing:

  sysctl -w net.ipv4.ip_forward=1

• add a secondary address for your container:

  ip addr add 192.168.1.178/24 dev eth0

• redirect connections for this address to your container:

  First, find your container local address:

  % docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' mycontainer

  172.17.0.2

  Now, use this local address with iptables :

  iptables -t nat -A PREROUTING -i eth0 -d 192.168.1.178/32 -j DNAT --to 172.17.0.2

Finally, you can check it works by accessing http://192.168.1.178/ from any other host on your LAN.