New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add overlay network support in < 3.16 kernels #821
Conversation
👍 This is a good news. We use 3.10.74 kernel on most of the machines in our company. |
} | ||
|
||
func setupGlobalChain() { | ||
if err := rawIPTables("-N", "OVERLAY"); err != nil { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it is better to name this DOCKER-OVERLAY ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok, will change name.
@mrjana just some minor nits... but otherwise a big 👍 from me. |
Add support for overlay networking in older kernels. Following were done to achieve this: + Create the vxlan network in host namespace. + This may create conflicts with other private networks so check for conflicts and fail a join if there is any conflict. + Add iptable based filtering to only allow subnet bridges in the same network to forward traffic while different network bridges will not be able to forward b/w each other. Also block traffic to overlay network originating from the host itself. Signed-off-by: Jana Radhakrishnan <mrjana@docker.com>
Updated with addressing the PR comments |
LGTM |
1 similar comment
LGTM |
Add overlay network support in < 3.16 kernels
🎉 🎉 🎉 |
Linux kernel prior to v3.16 was not supporting netns for vxlan interfaces. As such, moby/libnetwork#821 introduced a "host mode" to the overlay driver. The related kernel fix is available for rhel7 users since v7.2. Thus, this host mode is considered dead. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Linux kernel prior to v3.16 was not supporting netns for vxlan interfaces. As such, moby/libnetwork#821 introduced a "host mode" to the overlay driver. The related kernel fix is available for rhel7 users since v7.2. Thus, this host mode is considered dead. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Linux kernel prior to v3.16 was not supporting netns for vxlan interfaces. As such, moby/libnetwork#821 introduced a "host mode" to the overlay driver. The related kernel fix is available for rhel7 users since v7.2. Thus, this host mode is considered dead. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Linux kernel prior to v3.16 was not supporting netns for vxlan interfaces. As such, moby/libnetwork#821 introduced a "host mode" to the overlay driver. The related kernel fix is available for rhel7 users since v7.2. Thus, this host mode is considered dead. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Linux kernel prior to v3.16 was not supporting netns for vxlan interfaces. As such, moby/libnetwork#821 introduced a "host mode" to the overlay driver. The related kernel fix is available for rhel7 users since v7.2. Thus, this host mode is considered dead. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Linux kernel prior to v3.16 was not supporting netns for vxlan interfaces. As such, moby/libnetwork#821 introduced a "host mode" to the overlay driver. The related kernel fix is available for rhel7 users since v7.2. This mode could be forced through the use of the env var _OVERLAY_HOST_MODE. However this env var has never been documented and is not referenced in any blog post, so there's little chance many people rely on it. Moreover, this host mode is deemed as an implementation details by maintainers. As such, we can consider it dead and we can remove it without a prior deprecation warning. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Linux kernel prior to v3.16 was not supporting netns for vxlan interfaces. As such, moby/libnetwork#821 introduced a "host mode" to the overlay driver. The related kernel fix is available for rhel7 users since v7.2. This mode could be forced through the use of the env var _OVERLAY_HOST_MODE. However this env var has never been documented and is not referenced in any blog post, so there's little chance many people rely on it. Moreover, this host mode is deemed as an implementation details by maintainers. As such, we can consider it dead and we can remove it without a prior deprecation warning. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Add support for overlay networking in older kernels.
Following were done to achieve this:
+ Create the vxlan network in host namespace.
+ This may create conflicts with other private
networks so check for conflicts and fail a
join if there is any conflict.
+ Add iptable based filtering to only allow
subnet bridges in the same network to forward
traffic while different network bridges will
not be able to forward b/w each other. Also
block traffic to overlay network originating
from the host itself.
Signed-off-by: Jana Radhakrishnan mrjana@docker.com