<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>To summarise my email response from yesterday,</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Is there a way within the .nspawn unit file to explicitly set host networking without removing --network-veth from the systems-nspawn@.service unit file.</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Many thanks,</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Sam<br></div><div><br>On 20 Jun 2017, at 19:13, Samuel Taylor <<a href="mailto:sam@tailornetworks.com">sam@tailornetworks.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">Thank you for your response, Mantas!</div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div><div><font face="Calibri,sans-serif">I think I might have been wrong here with my terminology and use of "host-only" networking, after reading Virtualbox's definition in their networking documentation. Currently I have two containers configured.</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">- Container 1</font></div><div><font face="Calibri,sans-serif"> - [Files]</font></div><div><font face="Calibri,sans-serif"> Bind=/datastore/downloads:/data/downloads</font></div><div><font face="Calibri,sans-serif"> [Network]</font></div><div><font face="Calibri,sans-serif"> VirtualEthernet=true</font></div><div><font face="Calibri,sans-serif"> Port=tcp:32401</font></div><div><font face="Calibri,sans-serif">- Container 2</font></div><div><font face="Calibri,sans-serif"> - [Files]</font></div><div><font face="Calibri,sans-serif"> Bind=/datastore/mediacentre:/data</font></div><div><font face="Calibri,sans-serif"> Bind=/datastore/mediacentre/.plexconfig:/var/lib/plex/Plex\ Media\ Server</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Here is a copy of my systemd-nspawn@.service file that is symlinked for both my containers. As you can see I have removed the —network-veth tag that appears by default.</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">[Unit]</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Description=Container %i</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Documentation=man:systemd-nspawn(1)</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">PartOf=machines.target</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Before=machines.target</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">After=network.target</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">[Service]</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">ExecStart=/usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest -U --settings=override --machine=%i</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">KillMode=mixed</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Type=notify</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">RestartForceExitStatus=133</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">SuccessExitStatus=133</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Slice=machine.slice</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Delegate=yes</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">TasksMax=16384</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Within Container 1:</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">[root@container1 ~]# ip link</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">2: host0@if24: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"> link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff link-netnsid 0</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Within Container 2:</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">[root@container2 ~]# ip link</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"> link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">This works fine, however — is there a way of explicitly setting container 2 to use the host's network adapter without modifying the systemd-nspawn@.service file to omitt —network-veth? I think I'm correct in saying this can be achieved within Docker by passing a —net=host parameter at the time of launching your container? Though I could be wrong, I haven't really played with Docker.</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Thank you folks, again, really appreciate any input/assistance.</font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif"><br></font></div><div><font face="Calibri,sans-serif">Sam</font></div></div></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><span id="OLK_SRC_BODY_SECTION" style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> Mantas Mikulėnas <<a href="mailto:grawity@gmail.com">grawity@gmail.com</a>><br><span style="font-weight:bold">Date: </span> Tuesday, 20 June 2017 at 17:17<br><span style="font-weight:bold">To: </span> Samuel Taylor <<a href="mailto:sam@tailornetworks.com">sam@tailornetworks.com</a>>, <<a href="mailto:systemd-devel@lists.freedesktop.org">systemd-devel@lists.freedesktop.org</a>><br><span style="font-weight:bold">Subject: </span> Re: [systemd-devel] Systems-nspawn host-only networking?<br></div><div><br></div><span style="mso-bookmark:_MailOriginalBody"><p dir="ltr">I haven't used nspawn much. But I think the terminology is the opposite – veth *is* the most similar to other tools' "host-only network", as it essentially creates a connection completely separate from the physical LAN, unless the host itself decides to route between them. (Compare with VirtualBox's vboxnet0.)</p><p dir="ltr">Meanwhile, the opposite option would be macvlan, which attaches to a physical interface (like "bridged network" in VirtualBox) and separates traffic by MAC.</p><p dir="ltr">In between, you have the option of first creating a "host-only" veth, and *then* putting it in a Linux bridge interface (br0/virbr) together with eth0.</p><p dir="ltr">(I don't remember if nspawn can do this automatically or whether you need to 'ip link set veth0 master br0'...)</p><br><div class="gmail_quote"><div dir="ltr">On Tue, Jun 20, 2017, 19:07 Samuel Taylor <<a href="mailto:sam@tailornetworks.com">sam@tailornetworks.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello to all,<br><br> I'm new to the scene here so forgive me if this is not the most appropriate place to post this. I have posed this question to Freenet IRC a couple of times but I've not had any takers.<br><br> At the moment I am in the process of deploying a couple of nspawn containers, one utilizing a VirtualEthernet config and the other sharing the network adapter of the host, which I believe is typically, outside of the nspawn universe, referred to as host-only networking? (please correct me if I am wrong).<br><br> At present I have omitted --network-veth from the default systemd-nspawn .service unit file for containers, to enable the use of host-only networking within one of my containers. For the second container which utilizes a VirtualEthernet I have configured this parameter using the .nspawn file. Is there a way of avoiding having to modify the default systemd-nspawn unit file and instead configuring host-only networking within the .nspawn file? I have noted from the documentation that a network interface can be specified i.e<br><br> [Network]<br> Interface=eth0<br><br> However, from the documentation this would appear to remove the adapter from the calling namespace, and it would only be available within my container, which is not the case when removing --network-veth from the equation and not setting anything at all.<br><br> If this is considered a bad practice I will instead use the VirtualEthernet and Port parameters on my container currently utilising host-only networking.<br><br> I've been really enjoying getting my hands dirty with systemd the last few days, so if you could shed some light on where I'm going wrong here, that would be greatly appreciated!<br><br> Many thanks,<br><br> Sam<br><br><br> Sent from my iPhone<br> _______________________________________________<br> systemd-devel mailing list<br><a href="mailto:systemd-devel@lists.freedesktop.org" target="_blank">systemd-devel@lists.freedesktop.org</a><br><a href="https://lists.freedesktop.org/mailman/listinfo/systemd-devel" rel="noreferrer" target="_blank">https://lists.freedesktop.org/mailman/listinfo/systemd-devel</a><br></blockquote></div><div dir="ltr">-- <br></div><div data-smartmail="gmail_signature"><p dir="ltr">Mantas Mikulėnas <<a href="mailto:grawity@gmail.com">grawity@gmail.com</a>><br> Sent from my phone</p></div></span></span> </div></blockquote></body></html>