Nspawn - Private Bridge Interface

The Whisper

Separating networks isn't a new idea.
It's been protecting our systems for a long time.
You already witnessed a simple nspawn configuration - with a bridge network.

You can extend it to a public and private interface configuration.

The Plan

Systemd can configure the network with Systemd-networkd.
The .netdev files create network devices.
The .network files configure the networking.
You already have a bridge attached to the network card.
You will create a new bridge interface without connecting it to a network card.
This interface has no external connectivity. No LAN. No internet.
Nspawn containers connected to the new bridge (priv0) will see each other.
Containers connected to priv0 but not bridge0 will remain on the private segment.

Some containers don't need to talk to the network directly.
They should see each other on the private segment.

The Execution

Nspawn Host Configuration

Create the new private network device.

In /etc/systemd/network/40-priv0.netdev:

[NetDev]
Name=priv0
Kind=bridge

Configure the priv0 network.

In /etc/systemd/network/50-priv0.network:

[Match]
Name=priv0

[Network]
ConfigureWithoutCarrier=yes
LinkLocalAddressing=no
IPv6AcceptRA=no

Bring up the new priv0 interface.

sudo networkctl reload

Verify the configuration.

sudo networkctl list

Verify the bridge:

ip link show priv0
bridge link show

The priv0 interface must be visible on the host.
The new interface must not have an uplink.
It's isolated. Separated.

Nspawn Only-private Container Configuration

Configure the container's network as in the previous article.

Open /var/lib/machines/${CONTAINER}/etc/systemd/network/20-host0.network.

[Match]
Name=host0

[Network]
Address=10.10.0.1/24
LinkLocalAddressing=no
IPv6AcceptRA=no

Each container needs its own IP address.

The container will be attached to the private network segment only.

The container's .nspawn configuration file must contain:

[Network]
Bridge=priv0

The Topology

       Nspawn host
           |
       ┌───┴───┐
       │ priv0 │
       └───┬───┘
           |
    ┌──────┴──────┐
    │             │
  CT-A           CT-B
10.10.0.1     10.10.0.2

Possible Architectural Deviations

Some nodes need public and private interfaces as well.

You can set them up in the container's .nspawn configuration:

[Network]
Bridge=bridge0
VirtualEthernetExtra=ve-cont1-pr0:host1

You use cont1 as a short, unique form of the container identifier.
Keep interface names within 15 characters - Linux interface names cannot exceed 15 bytes.

Systemd-nspawn creates the ve-cont1-pr0 / host1 veth pair.
Systemd-networkd attaches the host-side interface to the priv0 bridge.

Attach the ve-cont1-pr0 to the priv0 bridge in the host's
/etc/systemd/network/50-cont1-pr0.network configuration file:

[Match]
Name=ve-cont1-pr0

[Network]
Bridge=priv0

The 50-cont1-pr0.network must have precedence over nspawn's default
80-container-ve.network configuration. Verify it in your system.

Reload the networking and verify the changes.

You created a dual-legged nspawn container configuration.

Final Whisper

Sometimes networking isn't an easy topic.
Still as an architect you must understand the basics of the topology.

Your nspawn containers are more isolated now.

If you want to comment, visit us:

IRC:     irc.silentarchitect.org
Port:    6697
Channel: #silentarchitect