ipvlan is a lightweight L2 and L3 network implementation that does not require traditional bridges and is generally pretty kewl.

The kernel dependency is the ipvlan kernel module support. You can verify if you have it compiled in or not with the following:

$ modprobe ipvlan
$ lsmod | grep ipvlan
    ipvlan   24576  0

If you get any errors or it doesn't show up from lsmod then you probably need to simply upgrade the kernel version. Here is an example upgrade to v4.3-rc2 that works on both Ubuntu 15.04 and 14.10 along with the similar Debian distributions.

$ wget http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.3-rc2-unstable/linux-headers-4.3.0-040300rc2_4.3.0-040300rc2.201509201830_all.deb
$ wget http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.3-rc2-unstable/linux-headers-4.3.0-040300rc2-generic_4.3.0-040300rc2.201509201830_amd64.deb
$ wget http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.3-rc2-unstable/linux-image-4.3.0-040300rc2-generic_4.3.0-040300rc2.201509201830_amd64.deb
$ dpkg -i linux-headers-4.3*.deb linux-image-4.3*.deb
$ reboot

As of Docker v1.9 the docker/libnetwork APIs are packaged by default in Docker. Grab the latest or v1.9+ version of Docker from Latest Linux binary from Docker. Alternatively curl -sSL https://get.docker.com/ | sh or from your distribution repo or docker repos.

1. Start Docker with the following or simply start the service. Version 1.9+ is required.

$ docker -v
Docker version 1.9.1, build a34a1d5

# -D is optional debugging
$ docker  daemon -D

2. Start the driver.

In the repo directory, use the binary named ipvlan-docker-plugin-0.2-Linux-x86_64. The binary can of course be renamed.

$ cd binaries
$ ./ipvlan-docker-plugin-0.2-Linux-x86_64 -d

# (optional debug flag) -d

3. Create a network with Docker

Note, the subnet needs to correspond to the master interface.

The mode and host interface options are required. Use the interface on the subnet you want the containers to be on. In the following example, eth1 of the host OS is on 192.168.1.0/24.

• -o host_iface=eth1
• -o mode=l2

$ docker network  create  -d ipvlan  --subnet=192.168.1.0/24 --gateway=192.168.1.1 -o host_iface=eth1 -o mode=l2  net1

4. Start some docker containers

Run some containers, specify the network and verify they can ping one another

$ docker run --net=net1 -it --rm ubuntu

This example can also be run up to a ToR switch with a .1q trunk. To test on a localhost, Vlan 20 should not be able to ping Vlan 30 without being routed by an upstream router/gateway. All containers inside of the Vlan should be able to ping one another. The default namespace (example: eth0 on docker host) is not reachable via icmp per ipvlan arch.

Start the plugin the same as the above example (-d for debug) along with the Docker daemon running $ docker daemon:

$ ./ipvlan-docker-plugin-0.2-Linux-x86_64 -d

Vlan ID 20

# create a new subinterface tied to dot1q vlan 20
ip link add link eth1 name eth1.20 type vlan id 20

# enable the new sub-interface
$ ip link set eth1.20 up

# now add networks and hosts as you would normally by attaching to the master (sub)interface that is tagged
$ docker network  create  -d ipvlan  --subnet=192.168.20.0/24 --gateway=192.168.20.1 -o host_iface=eth1.20 ipvlan101
$ docker run --net=ipvlan101 -it --name ivlan_test1 --rm ubuntu
$ docker run --net=ipvlan101 -it --name ivlan_test2 --rm ubuntu

Vlan ID 30

# create a new subinterface tied to dot1q vlan 30
$ ip link add link eth1 name eth1.30 type vlan id 30

# enable the new sub-interface
$ ip link set eth1.30 up

# now add networks and hosts as you would normally by attaching to the master (sub)interface that is tagged
$ docker network  create  -d ipvlan  --subnet=192.168.30.0/24 --gateway=192.168.30.1 -o host_iface=eth1.30 ipvlan130
$ docker run --net=ipvlan130 -it --name ivlan_test3 --rm ubuntu
$ docker run --net=ipvlan130 -it --name ivlan_test4 --rm ubuntu

TODO: Test me.

• There can only be one network type bound to the host interface at any given time. Example: Macvlan Bridge or IPVlan L2. There is no mixing.
• The specified gateway is external to the host or at least not defined by the driver itself.
• Multiple drivers can be active at any time. However, Macvlan and Ipvlan are not compatable on the same master interface (e.g. eth0).
• You can create multiple networks and have active containers in each network as long as they are all of the same mode type.
• Each network is isolated from one another. Any container inside the network/subnet can talk to one another without a reachable gateway.
• Containers on separate networks cannot reach one another without an external process routing between the two networks/subnets.

Use Godep for dependencies.

Install and use Godep with the following:

$ go get github.com/tools/godep
# From inside the plugin directory where the Godep directory is restore the snapshotted dependencies used by libnetwork:
$ godep restore

There is a godbus/dbus version that conflicts with vishvananda/netlink that will lead to this error at build time. This can appear as libnetwork issues when in fact it is 3rd party drivers. Libnetwork also uses Godep for versioning so using those versions would be just as good or even better if keeping with the latest experimental nightly Docker builds:

Example of the godbus error:

../../../docker/libnetwork/iptables/firewalld.go:75: cannot use c.sysconn.Object(dbusInterface, dbus.ObjectPath(dbusPath)) (type dbus.BusObject) as type *dbus.
Object in assignment: need type assertion

• If you dont want to use godep @Orivej graciously pointed out the godbus dependency in issue #5:

"You need a stable godbus that you can probably get with:"

cd $GOPATH/src/github.com/godbus/dbus
git checkout v2

• Another option would be to use godep and sync your library with libnetworks.

go get github.com/tools/godep
git clone https://github.com/docker/libnetwork.git
cd libnetwork
godep restore