Chapter 11. Communicating among containers

PDF

Learn about establishing communication between containers, applications, and host systems leveraging port mapping, DNS resolution, or orchestrating communication within pods.

11.1. The network modes and layers

There are several different network modes in Podman:

bridge - creates another network on the default bridge network
container:<id> - uses the same network as the container with <id> id
host - uses the host network stack
network-id - uses a user-defined network created by the podman network create command
private - creates a new network for the container
slirp4nets - creates a user network stack with slirp4netns, the default option for rootless containers
pasta - high performance replacement for slirp4netns. You can use pasta beginning with Podman v4.4.1.
none - create a network namespace for the container but do not configure network interfaces for it. The container has no network connectivity.
ns:<path> - path to a network namespace to join

Note

The host mode gives the container full access to local system services such as D-bus, a system for interprocess communication (IPC), and is therefore considered insecure.

11.2. Differences between slirp4netns and pasta

Notable differences of pasta network mode compared to slirp4netns include:

pasta supports IPv6 port forwarding.
pasta is more efficient than slirp4netns.
pasta copies IP addresses from the host, while slirp4netns uses a predefined IPv4 address.
pasta uses an interface name from the host, while slirp4netns uses tap0 as interface name.
pasta uses the gateway address from the host, while slirp4netns defines its own gateway address and uses NAT.

Note

The default network mode for rootless containers is slirp4netns.

11.3. Setting the network mode

Additional resources

You can use the podman run command with the --network option to select the network mode.

Prerequisites

The container-tools module is installed.

Procedure

Optional: If you want to use the pasta network mode, install the passt package:
```
$ {PackageManager} install passt
```
Run the container based on the registry.access.redhat.com/ubi8/ubi image:
```
$ podman run --network=<netwok_mode> -d --name=myubi registry.access.redhat.com/ubi8/ubi
```
The <netwok_mode> is the required network mode. Alternatively, you can use the default_rootless_network_cmd option in the containers.conf file to switch the default network mode.

Note

The default network mode for rootless containers is slirp4netns.

Verification

Verify the setting of the network mode:

$ podman inspect --format {{.HostConfig.NetworkMode}} myubi
<netwok_mode>

11.4. Inspecting a network settings of a container

Additional resources

Use the podman inspect command with the --format option to display individual items from the podman inspect output.

Prerequisites

The container-tools module is installed.

Procedure

Display the IP address of a container:

# podman inspect --format='{{.NetworkSettings.IPAddress}}' <containerName>

Display all networks to which container is connected:

# podman inspect --format='{{.NetworkSettings.Networks}}' <containerName>

Display port mappings:

# podman inspect --format='{{.NetworkSettings.Ports}}' <containerName>

Additional resources

podman-inspect man page on your system

11.5. Communicating between a container and an application

You can communicate between a container and an application. An application ports are in either listening or open state. These ports are automatically exposed to the container network, therefore, you can reach those containers using these networks. By default, the web server listens on port 80. Using this procedure, the myubi container communicates with the web-container application.

Prerequisites

The container-tools module is installed.

Procedure

Start the container named web-container:

# podman run -dt --name=web-container docker.io/library/httpd

List all containers:

# podman ps -a

CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES
b8c057333513  docker.io/library/httpd:latest  httpd-foreground  4 seconds ago  Up 5 seconds ago              web-container

Inspect the container and display the IP address:

# podman inspect --format='{{.NetworkSettings.IPAddress}}' web-container

10.88.0.2

Run the myubi container and verify that web server is running:

# podman run -it --name=myubi ubi8/ubi curl 10.88.0.2:80

<html><body><h1>It works!</h1></body></html>

11.6. Communicating between a container and a host

By default, the podman network is a bridge network. It means that a network device is bridging a container network to your host network.

Prerequisites

The container-tools module is installed.
The web-container is running. For more information, see section Communicating between a container and an application.

Procedure

Verify that the bridge is configured:

# podman network inspect podman | grep bridge

    "bridge": "cni-podman0",
    "type": "bridge"

Display the host network configuration:

# ip addr show cni-podman0

6: cni-podman0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 62:af:a1:0a:ca:2e brd ff:ff:ff:ff:ff:ff
    inet 10.88.0.1/16 brd 10.88.255.255 scope global cni-podman0
       valid_lft forever preferred_lft forever
    inet6 fe80::60af:a1ff:fe0a:ca2e/64 scope link
       valid_lft forever preferred_lft forever

You can see that the web-container has an IP of the cni-podman0 network and the network is bridged to the host.

Inspect the web-container and display its IP address:

# podman inspect --format='{{.NetworkSettings.IPAddress}}' web-container

10.88.0.2

Access the web-container directly from the host:

$ curl 10.88.0.2:80

<html><body><h1>It works!</h1></body></html>

Additional resources

podman-network man page on your system

11.7. Communicating between containers using port mapping

The most convenient way to communicate between two containers is to use published ports. Ports can be published in two ways: automatically or manually.

Prerequisites

The container-tools module is installed.

Procedure

Run the unpublished container:

# podman run -dt --name=web1 ubi8/httpd-24

Run the automatically published container:

# podman run -dt --name=web2 -P ubi8/httpd-24

Run the manually published container and publish container port 80:
```
# podman run -dt --name=web3 -p 9090:80 ubi8/httpd-24
```

List all containers:

# podman ps

CONTAINER ID  IMAGE                                            COMMAND               CREATED         STATUS             PORTS                                             NAMES
f12fa79b8b39  registry.access.redhat.com/ubi8/httpd-24:latest  /usr/bin/run-http...  23 seconds ago  Up 24 seconds ago                                                    web1
9024d9e815e2  registry.access.redhat.com/ubi8/httpd-24:latest  /usr/bin/run-http...  13 seconds ago  Up 13 seconds ago  0.0.0.0:43595->8080/tcp, 0.0.0.0:42423->8443/tcp  web2
03bc2a019f1b  registry.access.redhat.com/ubi8/httpd-24:latest  /usr/bin/run-http...  2 seconds ago   Up 2 seconds ago   0.0.0.0:9090->80/tcp                              web3

You can see that:

Container web1 has no published ports and can be reached only by container network or a bridge.
Container web2 has automatically mapped ports 43595 and 42423 to publish the application ports 8080 and 8443, respectively.
Note
The automatic port mapping is possible because the registry.access.redhat.com/8/httpd-24 image has the EXPOSE 8080 and EXPOSE 8443 commands in the Containerfile.
Container web3 has a manually published port. The host port 9090 is mapped to the container port 80.

Display the IP addresses of web1 and web3 containers:

# podman inspect --format='{{.NetworkSettings.IPAddress}}' web1
# podman inspect --format='{{.NetworkSettings.IPAddress}}' web3

Reach web1 container using <IP>:<port> notation:

# curl 10.88.0.14:8080
...
<title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
...

Reach web2 container using localhost:<port> notation:

# curl localhost:43595
...
<title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
...

Reach web3 container using <IP>:<port> notation:

# curl 10.88.0.14:9090
...
<title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
...

11.8. Communicating between containers using DNS

When a DNS plugin is enabled, use a container name to address containers.

Prerequisites

The container-tools module is installed.
A network with the enabled DNS plugin has been created using the podman network create command.

Procedure

Run a receiver container attached to the mynet network:

# podman run -d --net mynet --name receiver ubi8 sleep 3000

Run a sender container and reach the receiver container by its name:

# podman run -it --rm --net mynet --name sender alpine ping receiver

PING rcv01 (10.89.0.2): 56 data bytes
64 bytes from 10.89.0.2: seq=0 ttl=42 time=0.041 ms
64 bytes from 10.89.0.2: seq=1 ttl=42 time=0.125 ms
64 bytes from 10.89.0.2: seq=2 ttl=42 time=0.109 ms

Exit using the CTRL+C.

You can see that the sender container can ping the receiver container using its name.

11.9. Communicating between two containers in a pod

All containers in the same pod share the IP addresses, MAC addresses and port mappings. You can communicate between containers in the same pod using localhost:port notation.

Prerequisites

The container-tools module is installed.

Procedure

Create a pod named web-pod:
```
$ podman pod create --name=web-pod
```

Run the web container named web-container in the pod:

$ podman container run -d --pod web-pod --name=web-container docker.io/library/httpd

List all pods and containers associated with them:

$ podman ps --pod

CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES               POD ID        PODNAME
58653cf0cf09  k8s.gcr.io/pause:3.5                              4 minutes ago  Up 3 minutes ago              4e61a300c194-infra  4e61a300c194  web-pod
b3f4255afdb3  docker.io/library/httpd:latest  httpd-foreground  3 minutes ago  Up 3 minutes ago              web-container  4e61a300c194  web-pod

Run the container in the web-pod based on the docker.io/library/fedora image:

$ podman container run -it --rm --pod web-pod docker.io/library/fedora curl localhost

<html><body><h1>It works!</h1></body></html>

You can see that the container can reach the web-container.

11.10. Communicating in a pod

You must publish the ports for the container in a pod when a pod is created.

Prerequisites

The container-tools module is installed.

Procedure

Create a pod named web-pod:

# podman pod create --name=web-pod-publish -p 80:80

List all pods:

# podman pod ls

POD ID        NAME         STATUS   CREATED        INFRA ID      # OF CONTAINERS
26fe5de43ab3  publish-pod  Created  5 seconds ago  7de09076d2b3  1

Run the web container named web-container inside the web-pod:

# podman container run -d --pod web-pod-publish --name=web-container docker.io/library/httpd

List containers

# podman ps

CONTAINER ID  IMAGE                    COMMAND           CREATED             STATUS             PORTS               NAMES
7de09076d2b3  k8s.gcr.io/pause:3.5                       About a minute ago  Up 23 seconds ago  0.0.0.0:80->80/tcp  26fe5de43ab3-infra
088befb90e59  docker.io/library/httpd  httpd-foreground  23 seconds ago      Up 23 seconds ago  0.0.0.0:80->80/tcp  web-container

Verify that the web-container can be reached:

$ curl localhost:80

<html><body><h1>It works!</h1></body></html>

11.11. Attaching a pod to the container network

Attach containers in pod to the network during the pod creation.

Prerequisites

The container-tools module is installed.

Procedure

Create a network named pod-net:

# podman network create pod-net

/etc/cni/net.d/pod-net.conflist

Create a pod web-pod:

# podman pod create --net pod-net --name web-pod

Run a container named web-container inside the web-pod:

# podman run -d --pod webt-pod --name=web-container docker.io/library/httpd

Optional: Display the pods the containers are associated with:

# podman ps -p

CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES               POD ID        PODNAME
b7d6871d018c   registry.access.redhat.com/ubi8/pause:latest                             9 minutes ago  Up 6 minutes ago              a8e7360326ba-infra  a8e7360326ba  web-pod
645835585e24  docker.io/library/httpd:latest  httpd-foreground  6 minutes ago  Up 6 minutes ago              web-container    a8e7360326ba  web-pod

Verification

Show all networks connected to the container:

# podman ps --format="{{.Networks}}"

pod-net

Chapter 11. Communicating among containers

11.1. The network modes and layers

11.2. Differences between slirp4netns and pasta

11.3. Setting the network mode

11.4. Inspecting a network settings of a container

11.5. Communicating between a container and an application

11.6. Communicating between a container and a host

11.7. Communicating between containers using port mapping

11.8. Communicating between containers using DNS

11.9. Communicating between two containers in a pod

11.10. Communicating in a pod

11.11. Attaching a pod to the container network

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

Making open source more inclusive

About Red Hat

Red Hat legal and privacy links

Red Hat legal and privacy links