github.com/containerd/nerdctl@v1.7.7/docs/cni.md (about)

     1  # Using CNI with nerdctl
     2  
     3  nerdctl uses CNI plugins for its container network, you can set network by
     4  either `--network` or `--net` option.
     5  
     6  ## Basic networks
     7  
     8  nerdctl support some basic types of CNI plugins without any configuration
     9  needed(you should have CNI plugin be installed), for Linux systems the basic
    10  CNI plugin types are `bridge`, `portmap`, `firewall`, `tuning`, for Windows
    11  system, the supported CNI plugin types are `nat` only.
    12  
    13  The default network `bridge` for Linux and `nat` for Windows if you
    14  don't set any network options.
    15  
    16  Configuration of the default network `bridge` of Linux:
    17  
    18  ```json
    19  {
    20    "cniVersion": "1.0.0",
    21    "name": "bridge",
    22    "plugins": [
    23      {
    24        "type": "bridge",
    25        "bridge": "nerdctl0",
    26        "isGateway": true,
    27        "ipMasq": true,
    28        "hairpinMode": true,
    29        "ipam": {
    30          "type": "host-local",
    31          "routes": [{ "dst": "0.0.0.0/0" }],
    32          "ranges": [
    33            [
    34              {
    35                "subnet": "10.4.0.0/24",
    36                "gateway": "10.4.0.1"
    37              }
    38            ]
    39          ]
    40        }
    41      },
    42      {
    43        "type": "portmap",
    44        "capabilities": {
    45          "portMappings": true
    46        }
    47      },
    48      {
    49        "type": "firewall",
    50        "ingressPolicy": "same-bridge"
    51      },
    52      {
    53        "type": "tuning"
    54      }
    55    ]
    56  }
    57  ```
    58  
    59  ## Bridge isolation
    60  
    61  nerdctl >= 0.18 sets the `ingressPolicy` to `same-bridge` when `firewall` plugin >= 1.1.0 is installed.
    62  This `ingressPolicy` replaces the CNI `isolation` plugin used in nerdctl <= 0.17.
    63  
    64  When the `isolation` plugin is found, nerdctl uses the `isolation` plugin instead of `ingressPolicy`.
    65  The `isolation` plugin has been deprecated, and a future version of `nerdctl` will solely support `ingressPolicy`.
    66  
    67  When neither of `firewall` plugin >= 1.1.0 or `isolation` plugin is found, nerdctl does not enable the bridge isolation.
    68  This means a container in `--net=foo` can connect to a container in `--net=bar`.
    69  
    70  ## macvlan/IPvlan networks
    71  
    72  nerdctl also support macvlan and IPvlan network driver.
    73  
    74  To create a `macvlan` network which bridges with a given physical network interface, use `--driver macvlan` with
    75  `nerdctl network create` command.
    76  
    77  ```
    78  # nerdctl network create mac0 --driver macvlan \
    79    --subnet=192.168.5.0/24
    80    --gateway=192.168.5.2
    81    -o parent=eth0
    82  ```
    83  
    84  You can specify the `parent`, which is the interface the traffic will physically go through on the host,
    85  defaults to default route interface.
    86  
    87  And the `subnet` should be under the same network as the network interface,
    88  an easier way is to use DHCP to assign the IP:
    89  
    90  ```
    91  # nerdctl network create mac0 --driver macvlan --ipam-driver=dhcp
    92  ```
    93  
    94  Using `--driver ipvlan` can create `ipvlan` network, the default mode for IPvlan is `l2`.
    95  
    96  ## Custom networks
    97  
    98  You can also customize your CNI network by providing configuration files.
    99  For example you have one configuration file(`/etc/cni/net.d/10-mynet.conf`)
   100  for `bridge` network:
   101  
   102  ```json
   103  {
   104    "cniVersion": "1.0.0",
   105    "name": "mynet",
   106    "type": "bridge",
   107    "bridge": "cni0",
   108    "isGateway": true,
   109    "ipMasq": true,
   110    "ipam": {
   111      "type": "host-local",
   112      "subnet": "172.19.0.0/24",
   113      "routes": [
   114        { "dst": "0.0.0.0/0" }
   115      ]
   116    }
   117  }
   118  ```
   119  
   120  This will configure a new CNI network with the name `mynet`, and you can use
   121  this network to create a container:
   122  
   123  ```console
   124  # nerdctl run -it --net mynet --rm alpine ip addr show
   125  1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
   126      link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
   127      inet 127.0.0.1/8 scope host lo
   128         valid_lft forever preferred_lft forever
   129      inet6 ::1/128 scope host
   130         valid_lft forever preferred_lft forever
   131  3: eth0@if6120: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP
   132      link/ether 5e:5b:3f:0c:36:56 brd ff:ff:ff:ff:ff:ff
   133      inet 172.19.0.51/24 brd 172.19.0.255 scope global eth0
   134         valid_lft forever preferred_lft forever
   135      inet6 fe80::5c5b:3fff:fe0c:3656/64 scope link tentative
   136         valid_lft forever preferred_lft forever
   137  ```