Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

6
  • 1
    You should really have 192.168.123.50/24 as the ipv4.addresses (or, whatever address and prefix length that was configured on enp0s31f6), and make Network Manager not configure anything on enp0s31f6. Commented Oct 4 at 2:34
  • @TomYan Explain, please? One of us doesn't understand, and it's entirely possible that it's me. Tbh, I don't even understand why that sequence of ip commands works, because the macvlan bridge doesn't even reference the docker container's network! I want to use NetworkManager because ip link is not persisted. This method is the only one I've found to work, and it absolutely must be possible to duplicate it with nmcli. I could certainly just write a script to do the ip commands whenever I needed it, but that's far too easy! Commented Oct 4 at 15:23
  • Bridge-mode MACVLANs attached to the same "link" (such as enp0s31f6) are like bridge ports (that belong to the same bridge), that's why adding a MACVLAN to the "host side" ("default" network namespace) allows the host-container communication. And if you have a MACVLAN on the host side, you can/should just configure it as if it is its "link" (enp0s31f6), and leave the latter unconfigured (but only brought up). Commented Oct 4 at 15:36
  • When you only have the link on the host side, traffics from other network namespaces (that has one of the link's MACVLANs) will only "go out" to the network via the link. (Probably traffics from the host side will only do that as well in that case.) Therefore, while the other network namespaces can reach each other and other hosts in the network, they cannot reach the "host side", and the "host side" can only reach the other hosts in the network, but not any of the other network namespaces, whereas traffics from the other hosts can go to all of them. Commented Oct 4 at 15:46
  • I guess you can think of it as digging a hole that leads to the other MACVLANs (of the same link), and that hole can also lead to the "external sub-segment" attached to the link, just like the link interface itself, so you can/should configure IP on that hole. Commented Oct 4 at 15:59