The document discusses Docker networking and how Weave addresses some of its limitations. With Docker, each host has its own isolated network and containers on different hosts cannot communicate easily. Weave provides a common virtual network across all hosts that allows containers to communicate via standard IP protocols even if on different hosts. It uses DNS to enable service discovery and containers can be addressed by name across the Weave network. Weave also supports advanced features like encryption, container migration, and upcoming fast data path and IP address management capabilities.

1. Docker Networking
John Merrells

2. Docker
The current state of Docker Networking

3. get a server

4. Ubuntu 14.04
eth0: 45.79.82.5
install an operating system

5. Ubuntu 14.04
eth0: 45.79.82.5
docker0: 172.17.42.1
install Docker
Docker 1.6.2
$ wget -qO- https://get.docker.com/ | sh

6. Ubuntu 14.04
eth0: 45.79.82.5
docker0: 172.17.42.1
veth7b4d22b
start a container
eth0: 172.17.0.1
port: 5000
$ docker run -d …

7. Ubuntu 14.04
eth0: 45.79.82.5
docker0: 172.17.42.1
veth7b4d22b
traffic routed through docker bridge
eth0: 172.17.0.1
port: 5000

8. Ubuntu 14.04
eth0: 45.79.82.5
docker0: 172.17.42.1
veth7b4d22b
port 32768
start a container,
and publish a port
$ docker run -d -P …
eth0: 172.17.0.1
port: 5000

9. Ubuntu 14.04
eth0: 45.79.82.5
docker0: 172.17.42.1
veth7b4d22b
port 32768
traffic to port forwarded
eth0: 172.17.0.1
port: 5000

10. Ubuntu 14.04
If we want containers to
communicate with each other
eth0: 45.79.82.5
docker0: 172.17.42.1

11. Ubuntu 14.04
eth0: 45.79.82.5
docker0: 172.17.42.1
veth7b4d22b
start a container,
with a name
$ docker run -d —name web …
eth0: 172.17.0.1
port: 5000
name: web

12. Ubuntu 14.04
start containers with names,
and ‘link’ them together
eth0: 172.17.0.1
port: 5432
name: db
eth0: 172.17.0.2
port: 5000
name: web
eth0: 45.79.82.5
docker0: 172.17.42.1
veth8a5c43a
veth7b4d22b
port 32768
$ docker run -d --name db …
$ docker run -d -P --name web --link db:db …

13. Ubuntu 14.04
eth0: 172.17.0.1
port: 5432
name: db
eth0: 172.17.0.2
port: 5000
name: web
DB_PORT=tcp://172.17.0.7:5432
DB_PORT_5432_TCP=tcp://172.17.0.7:5432
DB_PORT_5432_TCP_ADDR=172.17.0.7
DB_PORT_5432_TCP_PORT=5432
DB_PORT_5432_TCP_PROTO=tcp
DB_NAME=/web/db
linking is via environment variables
custom application code needed

14. h2
eth0: 45.79.90.4
docker0: 172.17.42.1
h1
eth0: 45.79.82.5
docker0: 172.17.42.1
If we want containers,
on different hosts,
to communicate with each other
Docker hosts don’t know about each other

15. eth0: 172.17.0.1
port: 5432
name: db
h2
eth0: 45.79.90.4
docker0: 172.17.42.1
port 32768
eth0: 172.17.0.1
port: 5000
name: web
h1
eth0: 45.79.82.5
docker0: 172.17.42.1
port 32893
there’s no linking across the network
h1$ docker run -d -P —name web …
h2$ docker run -d -P —name db …

16. Container Networking
Docker
IP Allocation Subnet per Host
Routing NAT
Ports
IPTables, Port Forwarding,
Random Ports
Service Discovery Environment Variables
Multi Host Not Supported

17. Weave
Networking with Docker + Weave

18. get a server

19. Ubuntu 14.04
eth0: 45.79.82.5
install an operating system

20. Ubuntu 14.04
eth0: 45.79.82.5
docker0: 172.17.42.1
install Docker
Docker 1.6.2
$ wget -qO- https://get.docker.com/ | sh

21. Ubuntu 14.04
eth0: 45.79.82.5
docker0: 172.17.42.1
install Weave
Docker 1.6.2
$ wget -O /usr/local/bin/weave
https://git.io/weave
Weave 0.10.0

22. Ubuntu 14.04
eth0: 45.79.82.5
docker0: 172.17.42.1
vethace68bd
weave
vethwepl8289
launch the weave router
$ weave launch
eth0: 10.0.0.1
name: weave
port: 6783

23. Ubuntu 14.04
eth0: 45.79.82.5
docker0: 172.17.42.1
vethace68bd
weave
vethwepl8289
eth0: 10.0.0.1
name: weave
port: 6783
let’s ignore the docker
bridge and interfaces

24. eth0: 45.79.82.5
weave
vethwepl8289
vethwepl8709
start a container
$ weave run 10.2.1.1/24 -d …
eth0: 10.0.0.1
name: weave
port: 6783
eth0: 10.2.1.1
port: 5000

25. eth0: 45.79.82.5
weave
vethwepl8289
vethwepl8709
traffic routed through weave
eth0: 10.0.0.1
name: weave
port: 6783
eth0: 10.2.1.1
port: 5000

26. eth0: 45.79.82.5
weave
vethwepl8289
vethwepl8709
start a container,
publish a port
$ weave run 10.2.1.1/24 -d —name web -p 5000:5000 …
eth0: 10.0.0.1
name: weave
port: 6783
eth0: 10.2.1.1
port: 5000
name: web

27. eth0: 45.79.82.5
weave
vethwepl8289
vethwepl8709
traffic router through weave,
no random port
eth0: 10.0.0.1
name: weave
port: 6783
eth0: 10.2.1.1
port: 5000
name: web

28. eth0: 45.79.82.5
weave
If we want containers to
communicate with each other
eth0: 10.0.0.1
name: weave
port: 6783

29. eth0: 45.79.82.5
weave
use the weave DNS server
$ weave launch-dns 10.1.0.3/16 …
eth0: 10.0.0.1
name: weave
port: 6783
eth0: 10.1.0.3
name: weavedns
port: 53

30. eth0: 45.79.82.5
weave
vethwepl8289
vethwepl8801
vethwepl8709
eth0: 10.2.1.1
port: 5000
name: web
eth0: 10.2.1.2
port: 5432
name: db
$ weave run 10.2.1.1/24 -d —name web -p 5000:5000 …
$ weave run 10.2.1.2/24 -d —name db …
now we can name containers
eth0: 10.0.0.1
name: weave
port: 6783
eth0: 10.1.0.3
name: weavedns
port: 53

31. and they can find each other with
regular DNS lookups
name: weave
port: 6783
name: weavedns
port: 53
eth0: 10.2.1.1
port: 5000
name: web
fqdn: web.weave.local
eth0: 10.2.1.2
port: 5432
name: db
fqdn: db.weave.local
eth0: 45.79.82.5
weave
vethwepl8289
vethwepl8801
vethwepl8709
Where’s db?
Where’s web?

32. and communicate with each other over
regular IP based protocols
name: weave
port: 6783
name: weavedns
port: 53
eth0: 10.2.1.1
port: 5000
name: web
fqdn: web.weave.local
eth0: 10.2.1.2
port: 5432
name: db
fqdn: db.weave.local
eth0: 45.79.82.5
weave
vethwepl8289
vethwepl8801
vethwepl8709

33. h2
eth0: 45.79.90.4
h1
eth0: 45.79.82.5
eth0: 10.0.0.2
name: weave
port: 6783
peer: 45.79.82.5
name: weavedns
port: 53
eth0: 10.0.0.1
name: weave
port: 6783
peer: 45.79.90.4
name: weavedns
port: 53
h1$ weave launch 10.0.0.1/16
h2$ weave launch 10.0.0.2/16 45.79.82.5
If we want containers,
on different hosts,
to communicate with each other

34. h2
eth0: 45.79.90.4
h1
eth0: 45.79.82.5
name: weavedns
port: 53
name: weavedns
port: 53
eth0: 10.2.1.1
port: 5000
name: web
fqdn: web.weave.local
eth0: 10.2.1.2
port: 5432
name: db
fqdn: db.weave.local
h1$ weave run 10.2.1.1/24 -d —name web -p 5000:5000 …
h2$ weave run 10.2.1.2/24 -d —name db …
It’s just the same,
containers can find each other with DNS
eth0: 10.0.0.2
name: weave
port: 6783
peer: 45.79.82.5
eth0: 10.0.0.1
name: weave
port: 6783
peer: 45.79.90.4
Where’s
db?
Where’s
web?

35. h2
eth0: 45.79.90.4
h1
eth0: 45.79.82.5
name: weavedns
port: 53
name: weavedns
port: 53
eth0: 10.2.1.1
port: 5000
name: web
fqdn: web.weave.local
eth0: 10.2.1.2
port: 5432
name: db
fqdn: db.weave.local
and can communicate over regular
IP based protocols
eth0: 10.0.0.2
name: weave
port: 6783
peer: 45.79.82.5
eth0: 10.0.0.1
name: weave
port: 6783
peer: 45.79.90.4

36. Container Networking
Docker Weave
IP Allocation Subnet per Host Subnet per App
Routing NAT L2 Routing
Ports IPTables As they should be
Service
Discovery
Environment Variables DNS
Multi Host Not Supported Supported

37. Weave
But wait, there’s more…

38. mesh of peers,
that gossip with each other
eth0: 10.2.1.2 eth0: 10.2.1.3
eth0: 10.2.1.4eth0: 10.2.1.1

39. eth0: 10.2.1.2 eth0: 10.2.1.3
eth0: 10.2.1.4eth0: 10.2.1.1
mesh of peers,
with least cost routing

40. start containers,
on different clouds…
Weave 0.10.0
eth0: 10.2.1.2 eth0: 10.2.1.3 eth0: 10.2.1.4eth0: 10.2.1.1

41. encrypted traffic for
application isolation
eth0: 10.2.1.2eth0: 10.2.1.1 eth0: 10.2.1.2eth0: 10.2.1.1
$ weave launch
-password secret123
$ weave launch
-password 321terces

42. h2
eth0: 45.79.90.4
h1
eth0: 45.79.82.5
name: weavedns
port: 53
name: weavedns
port: 53
eth0: 10.2.1.1
port: 5000
name: web
fqdn: web.weave.local
containers can migrate,
from host to host
eth0: 10.0.0.2
name: weave
port: 6783
peer: 45.79.82.5
eth0: 10.0.0.1
name: weave
port: 6783
peer: 45.79.90.4

43. h2
eth0: 45.79.90.4
h1
eth0: 45.79.82.5
name: weavedns
port: 53
name: weavedns
port: 53
eth0: 10.2.1.1
port: 5000
name: web
fqdn: web.weave.local
containers can migrate,
and maintain the same IP Address
eth0: 10.0.0.2
name: weave
port: 6783
peer: 45.79.82.5
eth0: 10.0.0.1
name: weave
port: 6783
peer: 45.79.90.4

44. Weave
And coming soon

45. eth0: 45.79.82.5
fast data path
eth0: 10.0.0.1
name: weave
port: 6783
eth0: 10.2.1.1
port: 5000
OVS
kernel
module

46. eth0: 45.79.82.5
weave
IP Address Management
eth0: 10.0.0.1
name: weave
port: 6783
iprange: 10.0.0.1/16
$ weave launch -iprange 10.0.0.1/16
$ weave run -d …
eth0: 10.0.0.2

47. Scope
Weave Scope

48. John Merrells
john@weave.works