# Dockerコンテナネットワーク

**URL:** https://forum.ficusonline.com/t/topic/314
**Category:** Server
**Created:** [2019 年 8 月 6 日午前 7:52 UTC](https://forum.ficusonline.com/t/topic/314 "2019-08-06T07:52:49Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2019 年 8 月 6 日午前 7:52 UTC](https://forum.ficusonline.com/t/topic/314/1 "2019-08-06T07:52:49Z")

</div>

**Dockerコンテナのネットワーク設定**

> **[Networking](https://docs.docker.com/engine/network/)**
>
> Learn how networking works from the container's point of view

 ![bridge2](https://forum.ficusonline.com/uploads/default/original/2X/d/d286ca0368a6b8a4a40d22f492deac21a9e62cdc.png)

コンテナのネットワークについては、３つのオプション **bridge,host,none** が用意されています。

```auto
$ docker network ls

NETWORK ID NAME DRIVER SCOPE
17e324f45964 bridge bridge local
6ed54d316334 host host local
7092879f2cc8 none null local

```

**bridgeモード**

> **[Networking with standalone containers](https://docs.docker.com/engine/network/tutorials/standalone/)**
>
> Tutorials for networking with standalone containers

コンテナ稼働時にはデフォルトで **bridge** モードが選択されます。 **bridge** モードではコンテナ専用のネットワークが割り当てられ、ホストマシンのネットワークとは隔離されます。 **“docker network inspect bridge”** や **“ifconfig”** コマンドで割り当てられたIPアドレスなどの確認ができます。

```auto
$ docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "c0c58b4d39d158XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "Created": "2019-07-29T16:45:03.528703512+09:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

```

```auto
$ ifconfig
docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
        inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
        inet6 fe80::42:53ff:fe85:7593 prefixlen 64 scopeid 0x20<link>
        ether 02:42:53:85:75:93 txqueuelen 0 (イーサネット)
        RX packets 1 bytes 28 (28.0 B)
        RX errors 0 dropped 0 overruns 0 frame 0
        TX packets 229 bytes 38983 (38.9 KB)
        TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

```

ユーザ定義のbridgeネットワークを作成することも出来ます。コンテナイメージ毎にbridgeネットワークを定義して、コンテナ稼働時にこのネットワークを指定する使用方法が推奨されているようです。

> **[docker network create](https://docs.docker.com/reference/cli/docker/network/create/)**

例）以下alpine-netという名称のbridgeネットワークを定義します。

```auto
$ docker network create --driver bridge alpine-net

```

Dockerネットワークリストにより、bridgeモードにalpine-netが追加されていることが確認できます。

```auto
$ docker network ls

NETWORK ID NAME DRIVER SCOPE
e9261a8c9a19 alpine-net bridge local
17e324f45964 bridge bridge local
6ed54d316334 host host local
7092879f2cc8 none null local

```

```auto
$ docker network inspect alpine-net

[
    {
        "Name": "alpine-net",
        "Id": "e9261a8c9a19eabf2bf1488bf5f208b99b1608f330cff585c273d39481c9b0ec",
        "Created": "2017-09-25T21:38:12.620046142Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Containers": {},
        "Options": {},
        "Labels": {}
    }
]

```

alpineコンテナイメージをネットワーク指定して以下４種類のコンテナを稼働します。

```auto
$ docker run -dit --name alpine1 --network alpine-net alpine ash

$ docker run -dit --name alpine2 --network alpine-net alpine ash

$ docker run -dit --name alpine3 alpine ash

$ docker run -dit --name alpine4 --network alpine-net alpine ash

$ docker network connect bridge alpine4

```

各コンテナに割り当てられるIPアドレス、異なるbridgeネットワーク間通信については、上記リンク先ドキュメントを参照願います。

**hostモード**

> **[Networking using the host network](https://docs.docker.com/engine/network/tutorials/host/)**
>
> Tutorials for networking using the host network, disabling network isolation

ホストマシンのネットワーク環境をコンテナに適用します。

例）nginxウェブサーバをホストマシンネットワークで稼働させます。（–rmオプション：コンテナ停止時にコンテナを削除。–dオプション：バックグラウンド動作）

```auto
$ docker run --rm -d --network host --name my_nginx nginx

```

---

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2019 年 8 月 23 日午後 1:16 UTC](https://forum.ficusonline.com/t/topic/314/2 "2019-08-23T13:16:34Z")

</div>

**コンテナからホストネットワーク上のMySQLサーバへのアクセス**

> <https://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach>

_ **host=localhostを指定するとコンテナ内でのunix socket経由の接続となるためアクセスは拒否されます。MySQLの設定でbind-address=127.0.0.1になっていることを確認の上、host=127.0.0.1を指定します。** _

### host mode

To access MySQL running on the docker host from containers in _host mode_ , you can keep `bind-address = 127.0.0.1` in your MySQL configuration and all you need to do is to connect to `127.0.0.1` from your containers:

```auto
[vagrant@docker:~] $ docker run --rm -it --network=host mysql mysql -h 127.0.0.1 -uroot -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 36
Server version: 5.5.41-0ubuntu0.14.04.1 (Ubuntu)

Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

```

**note:** Do use `mysql -h 127.0.0.1` and not `mysql -h localhost` ; otherwise the MySQL client would try to connect using a unix socket.

**同一ネットワーク内で、あるコンテナからコンテナ稼働のMySQLサーバへアクセスする場合**  
MySQLコンテナ名をホスト名として指定します。

---

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2019 年 9 月 3 日午前 9:56 UTC](https://forum.ficusonline.com/t/topic/314/3 "2019-09-03T09:56:56Z")

</div>

コンテナがデフォルトのBridgeネットワークを使用した場合、ホストマシン外部への転送（フォワーディング）は拒否されています。ホストマシン外部への転送（フォワーディング）を有効にするため、以下対応が必要です。

> **[Bridge network driver](https://docs.docker.com/engine/network/drivers/bridge/)**
>
> All about using user-defined bridge networks and the default bridge

## Enable forwarding from Docker containers to the outside world

By default, traffic from containers connected to the default bridge network is **not** forwarded to the outside world. To enable forwarding, you need to change two settings. These are not Docker commands and they affect the Docker host’s kernel.

1. Configure the Linux kernel to allow IP forwarding.

```auto
$ sysctl net.ipv4.conf.all.forwarding=1

```

1. Change the policy for the `iptables``FORWARD` policy from `DROP` to `ACCEPT` .

```auto
$ sudo iptables -P FORWARD ACCEPT

```

These settings do not persist across a reboot, so you may need to add them to a start-up script.

再起動した場合にも設定が反映されるように起動スクリプトに上記2つのコマンドを追加する必要が有ります。

> **[Packet filtering and firewalls](https://docs.docker.com/engine/network/packet-filtering-firewalls/)**
>
> How Docker works with packet filtering, iptables, and firewalls

---

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2021 年 10 月 13 日午後 1:30 UTC](https://forum.ficusonline.com/t/topic/314/4 "2021-10-13T13:30:30Z")

</div>

### Docker-Composeで指定した各サービスへIPアドレスを付与する場合

```auto
$ docker network create --help

Usage: docker network create [OPTIONS] NETWORK

Create a network

Options:
      --attachable Enable manual container attachment
      --aux-address map Auxiliary IPv4 or IPv6 addresses used by Network driver (default map[])
      --config-from string The network from which to copy the configuration
      --config-only Create a configuration only network
  -d, --driver string Driver to manage the Network (default "bridge")
      --gateway strings IPv4 or IPv6 Gateway for the master subnet
      --ingress Create swarm routing-mesh network
      --internal Restrict external access to the network
      --ip-range strings Allocate container ip from a sub-range
      --ipam-driver string IP Address Management Driver (default "default")
      --ipam-opt map Set IPAM driver specific options (default map[])
      --ipv6 Enable IPv6 networking
      --label list Set metadata on a network
  -o, --opt map Set driver specific options (default map[])
      --scope string Control the network's scope
      --subnet strings Subnet in CIDR format that represents a network segment

```

docker-composeファイル内で各サービスにIPアドレスを付与する場合、gatewayアドレスとサブネットを指定します。  
**EX)**

```auto
$ docker network create --gateway 172.16.0.1 --subnet 172.16.0.0/24 nginx-proxy

```

---

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2022 年 7 月 18 日午前 8:33 UTC](https://forum.ficusonline.com/t/topic/314/5 "2022-07-18T08:33:26Z")

</div>

## Docker Compose Ver.2でのネットワークの書式

> <https://github.com/docker-archive/compose-cli/issues/1856>
>
> \*\*Description\*\*
> 
> In compose v2 I always see 
> \> "network default: network.exte…rnal.name is deprecated in favor of network.name"
> 
> For every docker-compose command. 
> 
> Here's the networks stanza:
> 
> \`\`\`yaml
> networks:
> default:
> name: ddev\_default
> external: true
> \`\`\`
> 
> This appears to be the exact same as is suggested in the official docs at https://docs.docker.com/compose/networking/#use-a-pre-existing-network - nothing about deprecation there.
> 
> And I also don't see \`network.external.name\` being used here. It's network.external as a bool, right?
> 
> \*\*Steps to reproduce the issue:\*\*
> 
> Use the network stanza above.
> 
> \*\*Describe the results you received:\*\*
> 
> \> "network default: network.external.name is deprecated in favor of network.name"
> 
> \*\*Describe the results you expected:\*\*
> 
> No deprecation complaint. Or at least one that I can understand.
> 
> \*\*Additional information you deem important (e.g. issue happens only occasionally):\*\*
> 
> \*\*Output of \`docker version\`:\*\*
> 
> \`\`\`
> Client:
> Cloud integration: 1.0.17
> Version: 20.10.7
> API version: 1.41
> Go version: go1.16.4
> Git commit: f0df350
> Built: Wed Jun 2 11:56:23 2021
> OS/Arch: darwin/arm64
> Context: desktop-linux
> Experimental: true
> 
> Server: Docker Engine - Community
> Engine:
> Version: 20.10.7
> API version: 1.41 (minimum version 1.12)
> Go version: go1.13.15
> Git commit: b0f5bc3
> Built: Wed Jun 2 11:55:36 2021
> OS/Arch: linux/arm64
> Experimental: false
> containerd:
> Version: 1.4.6
> GitCommit: d71fcd7d8303cbf684402823e425e9dd2e99285d
> runc:
> Version: 1.0.0-rc95
> GitCommit: b9ee9c6314599f1b4a7f497e1f1f856fe433d3b7
> docker-init:
> Version: 0.19.0
> GitCommit: de40ad0
> 
> \`\`\`
> 
> \*\*Output of \`docker context show\`:\*\*  
> 
> \`\`\`
> desktop-linux
> 
> \`\`\`
> 
> \*\*Output of \`docker info\`:\*\*
> 
> \`\`\`
> Client:
> Context: desktop-linux
> Debug Mode: false
> Plugins:
> buildx: Build with BuildKit (Docker Inc., v0.5.1-docker)
> compose: Docker Compose (Docker Inc., 2.0.0-beta.4)
> scan: Docker Scan (Docker Inc., v0.8.0)
> 
> Server:
> Containers: 10
> Running: 5
> Paused: 0
> Stopped: 5
> Images: 174
> Server Version: 20.10.7
> Storage Driver: overlay2
> Backing Filesystem: extfs
> Supports d\_type: true
> Native Overlay Diff: true
> userxattr: false
> Logging Driver: json-file
> Cgroup Driver: cgroupfs
> Cgroup Version: 1
> Plugins:
> Volume: local
> Network: bridge host ipvlan macvlan null overlay
> Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
> Swarm: inactive
> Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
> Default Runtime: runc
> Init Binary: docker-init
> containerd version: d71fcd7d8303cbf684402823e425e9dd2e99285d
> runc version: b9ee9c6314599f1b4a7f497e1f1f856fe433d3b7
> init version: de40ad0
> Security Options:
> seccomp
> Profile: default
> Kernel Version: 5.10.25-linuxkit
> Operating System: Docker Desktop
> OSType: linux
> Architecture: aarch64
> CPUs: 4
> Total Memory: 5.8GiB
> Name: docker-desktop
> ID: 53UE:EPJ4:JJNQ:JFFR:DIZ4:RKDH:DZOT:O2RE:53SK:6Z4G:7A7B:NPHD
> Docker Root Dir: /var/lib/docker
> Debug Mode: false
> HTTP Proxy: http.docker.internal:3128
> HTTPS Proxy: http.docker.internal:3128
> Registry: https://index.docker.io/v1/
> Labels:
> Experimental: false
> Insecure Registries:
> 127.0.0.0/8
> Live Restore Enabled: false
> 
> 
> \`\`\`
> 
> \*\*Additional environment details (AWS ECS, Azure ACI, local, etc.):\*\*
> 
> This is Docker Desktop 3.5.1 on either macOS or Windows. 
> 
> \`\`\`
> $ docker-compose --version
> Docker Compose version 2.0.0-beta.4
> \`\`\`

以下の書式で **Docker Compose Ver.2** では上記警告が表示されるため修正。

修正前

```auto
networks:
  default:
    external: true
    name: my-pre-existing-network

```

```auto
networks:
  default:
    external:
      name: ddev_default

```

修正後

```auto
networks:
  default:
    name: ddev_default
    external: true

```

---

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2023 年 2 月 11 日午後 1:54 UTC](https://forum.ficusonline.com/t/topic/314/6 "2023-02-11T13:54:33Z")

</div>

### **コンテナ内部のDNS**

デフォルトのコンテナ内部の`DNS`は、ホストマシンの **`/etc/resolv.conf`** の内容を引き継ぎますが特定の`DNS`を指定する場合には **`--dns`** フラグを付与します。

**DNS services**

> **[Networking](https://docs.docker.com/engine/network/)**
>
> Learn how networking works from the container's point of view

またホストマシンの `/etc/hosts` の内容は反映されないため、コンテナの `/etc/hosts` に反映させるためには **`--add-host`** フラグを付与します。

**`--add-host`**

> **[docker container run](https://docs.docker.com/reference/cli/docker/container/run/)**

```auto
bash-5.0# cat /etc/resolv.conf
nameserver 127.0.0.11
options ndots:0

```

---

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2023 年 2 月 11 日午後 2:03 UTC](https://forum.ficusonline.com/t/topic/314/7 "2023-02-11T14:03:49Z")

</div>

## コンテナIPv6サポート

> **[Use IPv6 networking](https://docs.docker.com/engine/daemon/ipv6/)**
>
> How to enable IPv6 support in the Docker daemon

[https://gdevillele.github.io/engine/userguide/networking/default\_network/ipv6/](https://gdevillele.github.io/engine/userguide/networking/default_network/ipv6/)

> **[Build a Docker IPv6 Network](https://dev.to/joeneville_/build-a-docker-ipv6-network-dfj)**
>
> 6️⃣ Docker supports IPv6 addressing and IPv6 network builds. 🔇 But IPv6 is not enabled by default. 🔊...

以下`IPv6`のサブネット（任意）を指定したデーモン設定ファイルを新規作成し再起動。

`/etc/docker/daemon.json`

```auto
{
  "ipv6": true,
  "fixed-cidr-v6": "2001:db8:1::/64"
}

```

**注）** `2001:db8:1::/64` はドキュメント内の例示として使用される予約されたIPアドレス

> **[List of reserved IP addresses](https://en.wikipedia.org/wiki/Reserved_IP_addresses)**
>
> Below is a list of reserved Internet Protocol (IP) addresses.
> In the Internet addressing architecture, the Internet Engineering Task Force (IETF) and the Internet Assigned Numbers Authority (IANA) have reserved various IP addresses for special purposes.
> IPv4 designates special usage or applications for various addresses or address blocks:

通常は以下のルール等を用いて作成 （LAN内プリフィックス：`FC00::/7`）

> [@IPv6, V6プラス(IPoE/IPv4 over IPv6)](https://forum.ficusonline.com/t/topic/466/2):
>
> IPv6アドレス Private network IPv6 RFC 4193 [RFC 4193: Unique Local IPv6 Unicast Addresses](https://www.rfc-editor.org/rfc/rfc4193#section-3) 3. Local IPv6 Unicast Addresses 3.1. Format The Local IPv6 addresses are created using a pseudo-randoml…

再起動

```auto
$ sudo systemctl restart docker

```

ブリッジモードの`IPv6`の有効化を確認  
**注）** ホストマシンにルータから`IPv6`アドレスが割当てられている場合

```auto
$ docker network inspect bridge
[
    {
        "Name": "bridge",
        ........
        ........
        "Driver": "bridge",
        "EnableIPv6": true,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                },
                {
                    "Subnet": "2001:db8:1::/64",
                    "Gateway": "2001:db8:1::1"
                }
            ]
        },
.....
.....

```

## IPv4, IPv6対応ブリッジネットワークの作成

> **[Build an IPv6 Network with Docker Compose](https://dev.to/joeneville_/build-an-ipv6-network-with-docker-compose-434i)**
>
> ✍️ In a previous post, I explained how to enable IPv6 for docker and build a network using the...

Docker Composerで使用する`IPv6`にも対応したカスタムブリッジネートワークを作成。

```auto
$ docker network create --gateway 172.20.0.1 --gateway 2001:db8:1:1::1 --subnet 172.20.0.0/24 --subnet 2001:db8:1:1::0/80 --ipv6 custom_network

```

**注）** ホストマシンのデフォルトのブリッジネットワークのサブネットを **`/64`** で割当てたので、カスタムブリッジネットワークに割当てるサブネットは、これより一段低い（16ビット分） **`/80`** とすること。

作成したネットワークの確認

```auto
$ docker network inspect custom_network
[
    {
        "Name": "custom_network",
        "Id": "912997c445af3a4718039d304c3b613aa0524659ca17bba5d87b5063a7ca795d",
        "Created": "2023-02-12T22:13:25.210491863+09:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": true,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.20.0.0/24",
                    "Gateway": "172.20.0.1"
                },
                {
                    "Subnet": "2001:db8:1:1::0/80",
                    "Gateway": "2001:db8:1:1::1"
                }
            ]
        },

```

**注）** コンテナに上記`IPv6`に対応したブリッジネットワークを使用する場合、ホスト側で`ip6tables(nftablesへ移行)`によるルールを追加する必要があります。

> **[\[SOLUTION\] Docker IPV6 and Docker compose woes](https://forums.docker.com/t/solution-docker-ipv6-and-docker-compose-woes/97852/4)**
>
> Why do you need the masquerade rule if you use a global ipv6 prefix? If your addresses aren’t routable and you need to use masquerade then why use global addresses instead of ULAs.

```auto
$ sudo ip6tables -t nat -A POSTROUTING -s 2001:3984:3989::/64 ! -o docker0 -j MASQUERADE

```

* * *

## IPv6アドレスの開放ポートの確認

> **[Is your site IPv6 ready?](https://ready.chair6.net/)**
>
> Test whether a web address, site, URL, or domain is IPv6 accessible. Tests for DNS AAAA records, IPv6-addressable nameservers, glue, IPv6 connectivity (port 80), and several other elements.

 ![Screenshot from 2023-02-12 22-18-22](https://forum.ficusonline.com/uploads/default/original/2X/5/5450ff4c1bbcd400fd35b04ea026cfed837faef7.png)

* * *

## DNS AAAAレコード(IPv6)確認

**`host`コマンド**

```auto
$ host -t AAAA google.com
google.com has IPv6 address 2a00:1450:4009:81d::200e

```

**`dig`コマンド**

```auto
$ dig google.com AAAA

; <<>> DiG 9.16.1-Ubuntu <<>> google.com AAAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37561
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;google.com. IN	AAAA

;; ANSWER SECTION:
google.com. 101	IN	AAAA	2a00:1450:4009:823::200e

;; Query time: 3 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Mon Feb 13 12:18:19 UTC 2023
;; MSG SIZE rcvd: 67

```

---

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2023 年 2 月 14 日午後 2:19 UTC](https://forum.ficusonline.com/t/topic/314/8 "2023-02-14T14:19:37Z")

</div>

> **[IPvlan network driver](https://docs.docker.com/engine/network/drivers/ipvlan/)**
>
> All about using IPvlan to make your containers appear like physical machines on the network

 ![macvlan-bridge-ipvlan-l2](https://forum.ficusonline.com/uploads/default/original/2X/e/e484f22aea945bdb0586666cfeca2fdc4b76f7d0.png)

```auto
# IPvlan (-o ipvlan_mode= Defaults to L2 mode if not specified)
docker network create -d ipvlan \
    --subnet=192.168.1.0/24 \
    -o parent=eth0 db_net_ipv

# Start a container with an explicit name in daemon mode
docker run --net=db_net_ipv --name=ipv1 -itd alpine /bin/sh

# Start a second container and ping using the container name
# to see the docker included name resolution functionality
docker run --net=db_net_ipv --name=ipv2 -it --rm alpine /bin/sh
ping -c 4 ipv1

# NOTE: the containers can NOT ping the underlying host interfaces as
# they are intentionally filtered by Linux for additional isolation.

```

---

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2023 年 2 月 23 日午前 8:48 UTC](https://forum.ficusonline.com/t/topic/314/9 "2023-02-23T08:48:39Z")

</div>

ufwのIPv6の設定で、以下のフォワードポリシーをデフォルトのドロップからアクセプトに変更するか、特定のアドレス範囲からのフォワードをアクセプトすること。

> <https://gist.github.com/lvnilesh/a4e49110d7eba3d28247c9554f978a0f>

---

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2023 年 3 月 17 日午前 1:52 UTC](https://forum.ficusonline.com/t/topic/314/10 "2023-03-17T01:52:33Z")

</div>

## コンテナ内部からインターネットのIPv6アドレスへのアクセス（`ping6`コマンドで確認）

以下 **`daemon.json`** に **`ip6tables`** オプションを追加することで **`ip6tables`** による **`SNAT`** ルールが`Docker`デーモン起動時にホストマシンに追加されます。ただし、このオプションは現時点 **`(Version 23.0.1)`** では試験的な扱いとなっているようで、 **`experimental`** オプションも追加する必要があります。このオプションにより、コンテナ内からIPv6アドレス宛インターネット通信が可能となります。

> [@Dockerコンテナネットワーク](https://forum.ficusonline.com/t/topic/314/7):
>
> コンテナIPv6サポート [https://docs.docker.com/config/daemon/ipv6/](https://docs.docker.com/config/daemon/ipv6/)[https://gdevillele.github.io/engine/userguide/networking/default\_network/ipv6/](https://gdevillele.github.io/engine/userguide/networking/default_network/ipv6/)[https://dev.to/joeneville\_/build-a-docker-ipv6-network-dfj](https://dev.to/joeneville_/build-a-docker-ipv6-network-dfj) 以下I…

`/etc/docker/daemon.json`

```auto
{
  "ipv6": true,
  "fixed-cidr-v6": "fd00:ffff::/80",
  "ip6tables": true,
  "experimental": true
}

```

* * *

**参考**

> <https://stackoverflow.com/questions/72049115/docker-compose-containers-cannot-access-internet-unless-on-host-network-ipv6-o>

> **[IPv6, Docker(-compose), and Shorewall6/ip6tables](https://blog.iphoting.com/blog/2021/02/10/ipv6-docker-docker-compose-and-shorewall6-ip6tables/)**
>
> The default docker configuration is limited to IPv4 networking and the docker daemon transparently takes care of IPv4-based SNAT. However, when IPv6 is enabl...

> **[DOCKER-USER chain for ip6tables](https://forums.docker.com/t/docker-user-chain-for-ip6tables/133961)**
>
> Our system has some iptables firewall rules on DOCKER-USER chain. Now I want to see if we can add similar rules with ip6tables. But I do not see both DOCKER and DOCKER-USER chains for ip6tables. Is there a way to achieve this with ip6tables? The...

* * *

**Dockerデーモンリファレンス**

> **[dockerd](https://docs.docker.com/reference/cli/dockerd/)**
>
> The daemon command description and usage