I am trying to set up a microservices environment where I need direct routable access to each container's internal IP address from a separate physical machine on my local network. Using the standard NAT-based port mapping (bridge mode) is becoming too complex to manage with our dynamic scaling requirements. Is there a way to use a Macvlan network driver or a transparent proxy to expose the container directly to the host’s physical network segment so it appears as a standalone node with its own MAC address?
3 answers
The most efficient way to achieve this is by using the Docker Macvlan network driver. This allows you to assign an IP address from your physical network directly to a container. You first create a network using docker network create -d macvlan and specify the subnet and gateway of your physical LAN. By attaching the container to this network, it bypasses the Docker bridge and the host's NAT entirely. However, be aware that for security reasons, the Linux kernel typically prevents the host from communicating directly with its own containers over a Macvlan interface unless you create a separate macvlan bridge on the host itself.
If I use the Macvlan driver, will my network switch see the unique MAC addresses for each container, and do I need to enable "promiscuous mode" on my physical network interface to allow this traffic to pass through?
You could also look into the "host" network mode. While it doesn't give the container a separate IP from the host, it removes the NAT overhead and lets the container use the host's IP and ports directly.
I agree with Megan that host mode is simpler, but for Ryan's specific need for "direct routable access to each container's internal IP," Macvlan is definitely the more robust architectural choice for true network isolation and visibility.
Brandon, yes, your switch will see each container as a unique device. Regarding promiscuous mode, it depends on your environment. If you are running Docker inside a virtual machine (like ESXi or VirtualBox), you absolutely must enable promiscuous mode on the VM's vSwitch or network settings. On bare-metal Linux, the Macvlan driver handles the sub-interfaces, but your physical switch port must allow multiple MAC addresses, so ensure you don't have "Port Security" limits set too low on your hardware switches.