Using https://lab4me.xyz/books/linux/page/how-to-create-and-use-macvlan-network-in-docker, I create a Docker macvlan network:
### create mac-vlan network docker network create \ -d macvlan \ --subnet=192.168.123.0/24 \ --gateway=192.168.123.1 \ -o parent=enp0s31f6 \ demo-macvlan-net and start a container on that network:
docker run --rm -itd \ --name alp1 \ --network=demo-macvlan-net \ --ip=192.168.123.111 \ alpine:latest \ /bin/sh All works fine, but as it says, we can't communicate from the Docker host to the container (though we can reach the container from anywhere else on the 192.168.123.0/24 subnet).
You can enable communication from the host via:
sudo ip link add mycool-net link enp0s31f6 type macvlan mode bridge sudo ip addr add 192.168.123.50/32 dev mycool-net sudo ip link set mycool-net up sudo ip route add 192.168.123.0/24 dev mycool-net (Actually, you can use sudo ip route add 192.168.123.111/32 dev mycool-net instead of the last command)
My most recent attempt using nmcli was:
nmcli connection add type macvlan ifname test mode bridge dev enp0s31f6 -- +ipv4.method manual ipv4.addresses 192.168.123.111 ipv4.gateway 192.168.123.1 which gives me an ip route of:
192.168.2.1 dev test proto static scope link metric 411 So, via the gateway, not the container's IP. If I don't specify the gateway, no route is created at all.
How can I create this macvlan in NetworkManager? Essentially, I need those last ip commands using nmcli (to make it possible to just activate a saved NM connection whenever I need it).
192.168.123.50/24as theipv4.addresses(or, whatever address and prefix length that was configured onenp0s31f6), and make Network Manager not configure anything onenp0s31f6.ipcommands works, because the macvlan bridge doesn't even reference the docker container's network! I want to use NetworkManager becauseip linkis not persisted. This method is the only one I've found to work, and it absolutely must be possible to duplicate it withnmcli. I could certainly just write a script to do theipcommands whenever I needed it, but that's far too easy!enp0s31f6) are like bridge ports (that belong to the same bridge), that's why adding a MACVLAN to the "host side" ("default" network namespace) allows the host-container communication. And if you have a MACVLAN on the host side, you can/should just configure it as if it is its "link" (enp0s31f6), and leave the latter unconfigured (but only brought up).