The software described in this documentation is either in Extended Support or Sustaining Support. See https://www.oracle.com/us/support/library/enterprise-linux-support-policies-069172.pdf for more information.
Oracle recommends that you upgrade the software described by this documentation as soon as possible.
By default, the lxc-oracle template script
sets up networking by setting up a veth bridge. In this mode, a
container obtains its IP address from the
dnsmasq server that
libvirtd runs on the private virtual bridge
network (virbr0) between the container and
the host. The host allows a container to connect to the rest of
the network by using NAT rules in iptables,
but these rules do not allow incoming connections to the
container. Both the host and other containers on the veth bridge
have network access to the container via the bridge.
Figure 8.1
illustrates a host system with two containers that are connected
via the veth bridge virbr0.
If you want to allow network connections from outside the host to be able to connect to the container, the container needs to have an IP address on the same network as the host. One way to achieve this configuration is to use a macvlan bridge to create an independent logical network for the container. This network is effectively an extension of the local network that is connected the host's network interface. External systems can access the container as though it were an independent system on the network, and the container has network access to other containers that are configured on the bridge and to external systems. The container can also obtain its IP address from an external DHCP server on your local network. However, unlike a veth bridge, the host system does not have network access to the container.
Figure 8.2 illustrates a host system with two containers that are connected via a macvlan bridge.
If you do not want containers to be able to see each other on the network, you can configure the Virtual Ethernet Port Aggregator (VEPA) mode of macvlan. Figure 8.3 illustrates a host system with two containers that are separately connected to a network by a macvlan VEPA. In effect, each container is connected directly to the network, but neither container can access the other container nor the host via the network.
For information about configuring macvlan, see
Section 8.2.6, “Modifying a Container to Use Macvlan” and the
lxc.conf(5) manual page.