Docker Cookbook

3.7 Using pipework to Understand Container Networking | 85

---

of manipulating the container network namespace. If you read the code of pipework,
you will see what it does. A good explanation is also available in the Docker 
docu‐
mentation
and is a good exercise, both in networking and containers. I highly recom‐
mend reading it.
This discussion is not about pipework specifically; it aims to show
you all the steps necessary to build a networking stack for a con‐
tainer. It is extremely useful to obtain a better understanding of
container networking and reverse-engineer how Docker works.
Let’s look back at this single pipework command:
$ sudo ./pipework br0 cookbook 192.168.1.10/24@192.168.1.254
This command did several almost magical things at once:
• It created a bridge 
br0
on the host.
• It assigned IP address 
192.168.1.254
.
• It created a network interface inside the container and assigned it IP address
192.168.1.10
.
• Finally it added a route inside the container, setting up the bridge as the default
gateway.
Let’s do it step by step but without pipework this time. To get started, let’s add a
bridge 
br0
and give it the IP 
192.168.1.254
. If you have worked on virtual machine
virtualization before, this should be familiar. If not, follow along: you create the
bridge with the 
brctl
utility, use 
ip
to add the IP address to the bridge, and finish by
bringing the bridge up.
If you have followed along, you might want to delete the existing 
br0
bridge:
$ sudo ip link set br0 down
$ sudo brctl delbr br0
You are now ready to do it all over again, but by hand this time:
$ sudo brctl addbr br0
$ sudo ip addr add 192.168.1.254/24 dev br0
$ sudo ip link set dev br0 up
The tricky part compared to full network virtualization comes from the fact that you
are dealing with containers and that the networking stack is in fact a different
network namespace on the host. To assign network interfaces to the container, you
need to assign an interface to the network namespace that the container will use. The
interfaces that you can assign to a specific network namespace are virtual Ethernet