Binding containers to specific network interfaces with MacVLAN networks

Question

Pulumi · Accepted Answer

To achieve the goal of binding containers to specific network interfaces using MacVLAN networks with Pulumi, you would typically use Docker as your container runtime. MacVLAN networks allow containers to appear as physical devices on your network, enabling them to have their own IP addresses on the existing network. This can be useful for cases where you want to route traffic directly to specific containers without going through port mapping.

Pulumi doesn't have a direct abstraction for MacVLAN as it is a Docker-specific network driver, but you can manage Docker resources with Pulumi through the `docker` provider. You can use the `docker.Network` resource to create a MacVLAN network and then use it within a `docker.Container` resource to bind your container to that network.

The `docker.Network` resource is used to create a network within Docker, and you can specify the `driver` property to `macvlan`. Alongside that, you can specify `ipamOptions` and `options` to configure your MacVLAN network according to your network interface and subnet.

Let’s go through a Pulumi program written in TypeScript that sets up a MacVLAN network and deploys a container attached to that network. This assumes you have Docker installed on your system.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as docker from "@pulumi/docker";

// Create a MacVLAN network in Docker
const macvlanNetwork = new docker.Network("macvlanNetwork", {
    name: "macvlan_network",
    checkDuplicate: true,
    driver: "macvlan",
    ipamConfig: [{
        subnet: "10.1.1.0/24",
        ipRange: "10.1.1.128/25",
        gateway: "10.1.1.1"
    }],
    options: {
        parent: "eth0"
    }
});

// Deploy a container which will be attached to the MacVLAN network
const macvlanContainer = new docker.Container("macvlanContainer", {
    image: "nginx",
    name: "nginx_container",
    networksAdvanced: [{
        name: macvlanNetwork.name,
        aliases: ["nginx"]
    }],
    ports: [{
        internal: 80,
        external: 80 // You can expose the port if needed
    }]
});

// Export the name of the MacVLAN network
export const macvlanNetworkName = macvlanNetwork.name;

// Export the name of the container
export const macvlanContainerName = macvlanContainer.name;
```

In this program:

1. We import the required modules from `@pulumi/pulumi` and `@pulumi/docker`.
2. We create a MacVLAN network named `macvlan_network` specifying the subnet, IP range, and the gateway. The `driver` is set to `macvlan` and `parent` to the network interface you wish to bind the network (e.g., `eth0`).
3. We declare a new Docker container using `docker.Container`, configure it to use the image `nginx`, and attach it to the created MacVLAN network. We also alias the container as `nginx` within the network.
4. Both the name of the MacVLAN network and the container are exported. This is useful if you need to reference them elsewhere in your Pulumi stack or in outputs after the deployment process.

Please make sure that the subnet you choose for the MacVLAN does not collide with the subnet for other network resources, and ensure that the network interface used as the parent is present on your Docker host. Also, adjust the `ipRange` and `gateway` according to your network configuration.

Remember that MacVLAN configurations operate at a lower network layer and are highly dependent on your existing network infrastructure. You may need to consult with a network administrator if you are working within a corporate or complex network setting.