site  contact  subhomenews

Containers veth bridge, getting started

October 01, 2018 — BarryK

I started to put together Easy Containers in January 2017, and this website was extremely helpful:

...lovely clear grass-roots explanation. At that time, I did not bother about 'network namespace', just using the host network namespace in the containers -- which makes things very simple, just have to copy /etc/resolv.conf into a container, and we have Internet access. I do drop 'network capabilities', so it is reasonably secure.

Forward to now, and I am experimenting with a container having its own network namespace. The above link has a example, setting up a 'virtual ethernet' bridge. It requires the "netns" option for the 'ip' utility, which the Busybox ip applet does not have, so had to install the full 'ip' from the 'iproute2' package -- the 'ip' is 430KB unfortunately.

Here is what I did, follow the example from above link:

# brctl addbr br0
# brctl addif br0 eth0
# dhcpcd br0
br0: waiting for carrier
br0: carrier acquired
br0: adding address fe80::4ea2:f3b9:2318:6773
DUID 00:01:00:01:13:43:3e:ca:c0:55:e9:0f:eb:00
br0: IAID e8:0f:ec:00
br0: soliciting a DHCP lease
br0: offered from
br0: leased for 7200 seconds
br0: adding route to
br0: adding default route via
forked to background, child pid 5414
# ip netns add handcraft
# ip link add veth1 type veth peer name eth1
RTNETLINK answers: File exists
# ip link set eth1 netns handcraft
# brctl addif br0 veth1
brctl: iface veth1: No such device
# ip link add veth2 type veth peer name eth2
# ip link set eth2 netns handcraft
# brctl addif br0 veth2
# ip link set veth2 up
# ip netns exec dhcpcd eth2
Cannot open network namespace "dhcpcd": No such file or directory
# ip netns exec handcraft dhcpcd eth2
eth2: waiting for carrier
eth2: carrier acquired
eth2: adding address fe80::b4b:efa7:15f7:d3d0
DUID 00:01:00:01:13:43:3e:ca:c0:55:e9:0f:eb:00
eth2: IAID d4:a8:e2:56
eth2: soliciting a DHCP lease
eth2: soliciting an IPv6 router
eth2: offered from
eth2: probing address
eth2: leased for 7200 seconds
eth2: adding route to
eth2: adding default route via
forked to background, child pid 6996

Along the way, got two errors, but was able to fix. I don't know why it objected to "veth1". The second error is due to a syntax error in the example, which I sorted out by reading this excellent page:

Now to run my container. The container rootfs is already setup, with /etc/resolv.conf copied-in, just a matter of chrooting into it. Using pflask:

# ip netns exec handcraft pflask --keepenv --mount=bind:/tmp/.X11-unix/X0:/tmp/.X11-unix/X0 --no-ipcns --no-netns \
--caps=all,-sys_admin,-sys_boot,-sys_chroot,-sys_ptrace,-sys_time,-sys_tty_config,-chown,-kill,-dac_override,-dac_read_search,-fowner,-setfcap,-setpcap,-mknod,-sys_module,-sys_nice,-sys_resource \
--no-userns --chroot=/mnt/sdc2/containers/sh0/container -- /ec-run sh0 sakura

...I have not specified a network namespace for pflask, instead have prefixed as shown in blue text.

Inside the container, I expect 'eth2' to be accessible:

# ifconfig
eth2 Link encap:Ethernet HWaddr 9A:45:D4:A9:E2:57
inet addr: Bcast: Mask:
inet6 addr: fe81::b4b:efa6:15f7:d3d0/64 Scope:Link
RX packets:104 errors:0 dropped:0 overruns:0 frame:0
TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:39782 (38.8 KiB) TX bytes:1737 (1.6 KiB)

# ping
PING ( 56 data bytes
64 bytes from seq=0 ttl=49 time=82.916 ms


Notice no 'lo' interface, would have to set that up. But, do I need it?

Tags: easy