Monday, May 04

Geek

Making An LXC Or LXD Container Accessible To The Internet

The simple manual approach:

Let's say your public IP range is 1.2.3.0/29.  This is a pretty typical allocation for a dedicated server.

Your gateway will be 1.2.3.1, and your server will be 1.2.3.2.  Broadcast is 1.2.3.7, so you have four IP addresses available.  

We'll pick 1.2.3.3, and we'll give the container the internal IP of 10.1.1.3.  The simplest way to do that is to add the container names and internal IP addresses to your hosts file before launch.  The IP addresses will be assigned automatically and won't change.

The selected public IP should not be active on the host interface when you start.  If you ping it you should get no response.

  1. Add the public IP address within the container.

    root@container# ifconfig eth0:1 1.2.3.3 up


  2. Add a static route from the host server to the container.  (But see step 4 below.)

    root@host# route add 1.2.3.3/32 gw 10.1.1.3


  3. If you try reaching the container now, chances are it won't work, because the route hasn't been announced to the gateway.  Fortunately, that's easy too.

    root@host# arp -Ds 216.18.211.180 eth0 pub

    In this case eth0 will likely be something different.  You want the main public interface for your server - in my case this was enp35s0.


  4. Make sure to set up appropriate firewall rules in the container.  That static route will take effect before the filtering by ufw on the host.  (That one surprised me too.)


  5. That's it.  Done.

The problem with this approach is that it is manual and you'll need to make sure it's applied on reboot.  Just create an /etc/rc.local file on the host and on the container (on recent version of Ubuntu it doesn't exit by default), put the necessary commands in there, and end it with an exit 0.

The advantage of this approach is that since you're not mucking about with netplan files the chance of you locking yourself out of your own server is greatly reduced.

I wish someone had explained this clearly somewhere back when I had Mari, before I had to give it up because I couldn't get networking to work properly and couldn't afford to keep it around but not in production.  But Akane is a pretty nice server too.  On the CPU side it is much, much faster (about 2.5x single-threaded, about 2x multi-threaded), and it's less than half the price. 

Posted by: Pixy Misa at 05:28 PM | No Comments | Add Comment | Trackbacks (Suck)
Post contains 399 words, total size 3 kb.




Apple pies are delicious. But never mind apple pies. What colour is a green orange?




49kb generated in CPU 0.0141, elapsed 0.1044 seconds.
56 queries taking 0.0951 seconds, 339 records returned.
Powered by Minx 1.1.6c-pink.