r/docker • u/af9_us • 2d ago

Veth to container mappings

I'm doing a deep dive on bridges and veth devices and realized it's difficult to map a veth pair to a running container.

Dockerd will suffix a random string (crypto/rand) to "veth" when creating the bridge connection but doesn't save the value in the container or networks metadata. Instead you have to map the network namespace of each veth device to each container.

This gist https://gist.github.com/amf3/ca6b9106f154cfce06d71bd7012cca30 explains how to map the network device to the running container. One command does need sudo access with "lsns" but otherwise uses normal privleges like "ip and "jq".

3 Upvotes

81% Upvoted

5 comments sorted by

1

u/encbladexp 2d ago

Why do you care for such implementation detail?

1

u/af9_us 2d ago

Mainly for troubleshooting. If I can identify the veth device, I can use tools like tcpdump to know which network device to read traffic from. Other tooling like arping operates at Layer2 of the OSI model. So now I can tell if this is a L2 issue, a L3 issue between the container and bridge, or a routing issue on the host.

2

u/encbladexp 2d ago

Most real world issues, except with macvlan or ipvlan, are L3 issues, and you could do simply: ip route get CONTAINERIP tcpdump THEINTERFACE

Except for inter bridge traffic, everything needs to go through the iptables/nftables chains of the host, so this is where you usually start debugging things.

1

u/fletch3555 Mod 2d ago

Is this purely academic? If you're just learning how stuff works under the hood, then great. If you're looking to use this for practical purposes, you're likely too deep. Understanding kernel namespaces and how containers use them is useful info, but you really should never have to interact with them at this level, and should never have to modify a running container.

1

u/af9_us 2d ago

> Is this purely academic?
It's a little academic. My troubleshooting skills get a lot better by knowing what happens under the hood. While I agree one should never modify a running container, I also think the veth info should be exposed in the container metadata so operators can troubleshoot network issues.

> you're likely too deep
Yes, probably and thanks for the warning. :)