Great news!
I had a look at the network_ipvlan
LXC feature. In LXD 3.13 (channel: candidate),
$ lxc info
...
kernel_version: 4.15.0-48-generic
lxc_features:
mount_injection_file: "true"
network_gateway_device_route: "false"
network_ipvlan: "false"
network_l2proxy: "false"
seccomp_notify: "false"
...
$
It is a feature that it is not enabled in my case. Is it user-configurable?
https://github.com/lxc/lxd/blob/master/lxd/daemon.go#L580
It appears it is not user-configurable. As mentioned in the announcement, it relates to the version of liblxc
that is bundled in the snap package.
The master
branch of liblxc
knows about network_ipvlan
:
But what version of liblxc
does the 3.13 LXD snap package have?
$ snap run --shell lxd
bash-4.3$ ls -l /snap/lxd/current/lib/liblxc*
lrwxrwxrwx 1 0 0 15 May 9 17:12 /snap/lxd/current/lib/liblxc.so.1 -> liblxc.so.1.5.0
-rwxr-xr-x 1 0 0 1068656 May 9 17:29 /snap/lxd/current/lib/liblxc.so.1.5.0
-rwxr-xr-x 1 0 0 80688 May 9 17:29 /snap/lxd/current/lib/liblxcfs.so
bash-4.3$
It mentions it is a liblxc 1.5.0
version. There is no string network_ipvlan
in liblxc.so.1.5.0
.
How does this library relate to the repository GitHub - lxc/lxc: LXC - Linux Containers ? I could not find a relevant 1.5.0
tag in the source code repository.
I have used the snap package from the candidate
channel, which bundles the following lxclxc
version, tag: lxc-3.1.0
. It is not recent enough to have the network_ipvlan goodness.
But what snap package channel is recent enough to have the git version of liblxc
? Is it edge
?
It is edge
. Does edge have a recent enough LXD that includes IPVLAN support?
$ snap info lxd
...
channels:
stable: 3.12 2019-04-16 (10601) 56MB -
candidate: 3.13 2019-05-09 (10732) 56MB -
beta: ↑
edge: git-566ee20 2019-05-09 (10738) 56MB -
...
There is a commit, 566ee20. Is that recent enough to have IPVLAN support in LXD? Here are the commits, Commits · lxc/incus · GitHub and discourse does not show a good snapshot of the page.
So, we could switch to the edge
snap channel of LXD and experience the full goodness of the new features. But that would be utterly inappropriate for the stability of the system. Because, would things break in LXD if you switch forward and back between the stable
and edge
channels? The LXD version is almost the same, but liblxc
differs quite a bit; almost six months of changes to the code.
So, what do we do? You know what we do, but let’s capture first the error message when you try IPVLAN on a liblxc that it is not recent enough. They say it is good for SEO.
$ lxc launch ubuntu:18.04 mycontainer --profile default --profile ipvlan
Creating mycontainer
Error: Failed container creation: Create container: Create LXC container: Initialize LXC: LXC is missing one or more API extensions: network_ipvlan, network_l2proxy, network_gateway_device_route
Let’s switch the snap package of LXD to the edge
channel.
$ snap switch --channel edge lxd
"lxd" switched to the "edge" channel
$ snap refresh
lxd (edge) git-566ee20 from Canonical✓ refreshed
Will it work now?
$ lxc launch ubuntu:18.04 mycontainer --profile default --profile ipvlan
Creating mycontainer
Starting mycontainer
$ lxc list mycontainer
+-------------+---------+------+------+------------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+-------------+---------+------+------+------------+-----------+
| mycontainer | RUNNING | | | PERSISTENT | 0 |
+-------------+---------+------+------+------------+-----------+
No IP address from the LAN. What went wrong? Isn’t IPVLAN supposed to let the container get the IP address automatically from the LAN? Probably not, considering that it is Layer 3 (not Layer 2 that macvlan
is). Scratch that then, we start over again.
To cut this short, you need to tell LXD (ipv4.address=...
) the IP address for the container. Then, LXD will be able to set up what is needed. And you need to instruct the container of the DNS server settings because without DNS, cloud-init
takes time to complete the bootup sequence (and create the ubuntu
account).
In a nutshell,
- You need to get LXD to setup the IP address for the container, because that’s the way IPVLAN works.
- You do not get a DNS server autoconfigured, so you need to configure it in some way, such as with
cloud-init
from a LXD profile. - You do not need to (cannot?) add a default route. LXD/ipvlan does that for you. See below how the default route looks like.
ubuntu@mycontainer:~$ route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 0.0.0.0 0.0.0.0 U 0 0 0 eth0
ubuntu@mycontainer:~$ ping -c 1 www.google.com
PING www.google.com (216.58.198.4) 56(84) bytes of data.
64 bytes from mil04s03-in-f4.1e100.net (216.58.198.4): icmp_seq=1 ttl=54 time=76.2 ms
--- www.google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 76.275/76.275/76.275/0.000 ms
ubuntu@mycontainer:~$