IP-only Linux device containers

[jbemmel]

There are lots of Linux container images out there representing network devices or functionality. They have their own config files, but what they commonly need is a configured IP address

We could either generalize the 'linux' device, or introduce a new device type that only supports Linux-style IP address configuration, and the bgp module (with dummy config template)

Case in point is the OpenBGPd image: https://github.com/openbgpd-portable/openbgpd-container

It does not contain Python binaries, so the regular linux provisioning scripts fail

[ipspace]

You could use "unprovisioned" group for those devices (that's exactly why we created it), but then you'll have to figure out what to do with the default route, which containerlab sets to point to the management network.

See also https://netsim-tools.readthedocs.io/en/latest/example/external.html#unprovisioned-devices

If you have any better idea, I'm all ears ;)

[jbemmel]

I did try that, but apart from the default route the device is also not getting any IPs (except mgmt)

[ipspace]

Straight from that same document (in an orange box to make it more visible)

Devices in the ‌unprovisioned group will not get IP addresses on interfaces other than the management interface, or static routes to the rest of the network.

We're not including those devices in Ansible plays, so how should they get IP addresses on other interfaces?

[jbemmel]

I know that's "works as designed", what I'm saying is I have a use case for "unmanaged" devices that still get IP configuration

Could be a targeted Ansible script that just does "ip addr add" etc. - but executed via ssh or docker connection, not using Python

[ipspace]

I know that's "works as designed", what I'm saying is I have a use case for "unmanaged" devices that still get IP configuration

Could be a targeted Ansible script that just does "ip addr add" etc. - but executed via ssh or docker connection, not using Python

What makes you believe that a container you're interested in would have ip command or even bash? Maybe the one you're looking at today does, but what about the next one? Also, even if we solve your use case and somehow magically assign IP addresses to interfaces, that container still won't be able to reach anything beyond the directly-connected subnet.

It all comes down to "that's not how containers are supposed to be used" -- any (regular) container orchestration tool would set up IP addresses and routing before starting the first process in the container. As there are no hooks in containerlab (yet) that would allow you to specify IP addresses on links, or default routing, there's not much we can do.

[ipspace]

@hellt (assuming mentions in discussions work this way ;)

Do you think it would be possible to add capability for custom default routes to containerlab?

For example, a "host" container (routing daemon, NMS,...) could have a default route pointing to the an in-network interface and specified next hop instead of management network. Ideally, one could specify the whole routing table (prefix/next hop) for each container ;))

Worst case, we could do the same thing in post-startup hooks in netlab, but it would be nicer to have it built into containerlab.

[hellt]

@ipspace if we are talking here bare linux containers that leverage the kernel routing stack, then you can add routes using the exec node property in containerlab

Example: https://github.com/srl-labs/srl-telemetry-lab/blob/7adcfed24bb7450f0e9a88ab72b553ea3d018104/st.clab.yml#L54

Will that work?

[ipspace]

It's good to know about the exec property, I'm sure it will become useful one day 👍

However, now that I started going down this path (again 🥴), I'm worried about containers not having the ip command, but I think I found a solution.

Thanks again for taking your time and pointing me to another containerlab feature I was not aware of.

[ipspace]

Worst case: we could execute ip route add commands in container namespace after the container has been started

https://stackoverflow.com/questions/36882945/change-default-route-in-docker-container

[ipspace]

@jbemmel: Implemented in #703