[arch-general] tap device

[Paul Gideon Dann]

On Wednesday 12 Mar 2014 15:20:01 arnaud gaboury wrote:
> > Can I ask you both why you chose this route of creating a private network?
> > As far as I can tell, by default systemd-spawn will allow the container
> > to use the host's interface. I would have thought that would be adequate
> > for most usecases?
> > 
> > Paul
> 
> My first tests with nspwan/networkd, with a very minimal configuration
> (just one eth netcl profile) left me with a working network on
> container, but as you said, the container was using host interface
> (enp7s0 in my case). Thus, same IP for both and no container network
> "isolation".
> 
> From  SYSTEMD-NSPAWN(1)
> 
>        --private-network
>            Disconnect networking of the container from the host. This
> makes all network
>            interfaces unavailable in the container, with the exception
> of the loopback device and
>            those specified with --network-interface= and configured
> with --network-veth.
> 
> That is exactly what I wanted. In my case, as the container is aimed
> at hosting various web apps with a static IP, I wanted to isolate the
> container network from the host one.

OK, so in fact you did have an extra requirement that you wanted to use a separate IP 
address in this container? Is that an important requirement? Also, as I stated earlier, I 
think you should be using --network-bridge, not --private-network.

Paul