Linux Containers (LXC) is an operating-system-level virtualization method for running multiple isolated Linux systems (containers) on a single control host.
LXC provides networking through virtual network interfaces that are attached to the containers. This is typically done via a bridge on a host system that all containers connect to. Each container has its own network stack so it does not interfere with the host or other containers on the same system, and may even have its own IP address.
There are several different types of networking configurations that can be used with LXC, including bridged, macvlan, vlan, physical, and ptp. Each has its own advantages/disadvantages and use cases.
- Bridged Networking: This is the most common network configuration. In bridged mode, a new network bridge is created on the host system and the container’s network interface is connected to it.
- Macvlan Networking: Macvlan allows for assigning multiple MAC addresses within one single network device. It’s useful when you want containers to look like physical devices on your network.
- VLAN Networking: Virtual LANs (VLANs) allow for creating multiple distinct broadcast domains within a single network infrastructure.
- Physical Networking: Physical networking connects a physical network device on the host to the container.
- Point-to-Point Networking: PTP networking creates a network connection between two nodes or endpoints.
With advanced networking setup, multiple network interfaces can also be added to the container. This allows for more complex networking scenarios like having a DMZ, Internal, and External network emulation for the containers.
Firewall rules are usually done on the host system or within the individual containers, but this depends on the type of networking that is being implemented and the individual requirements for each system.
