Traditionally virtual machines and containers are exposed on a bridge which is solely available behind a single IP address exposed behind network/port address translation (NAT/PAT). This is, in general an acceptable practice but leads to some configuration challenges when testing out technologies like network booting of hosts, firewalling, equal cost multipath, etc.
This configuration will allow a user to move the IP address of the host to an internal bridge and put containers and VMs on this same bridge to allow these assets layer 2 access to the outside network. The containers/VMs will not have the "normal" utilities for address configuration and will use the same process that the underying host would for IP address management (IPAM). This is to say that if the host uses DHCP, the containers should have this available. If the host utilizes static addressing, likely the guest will need to do the same.
Below is a diagram showing a sample configuration. In this example, the normative configuation is on the left hand side while the bridged configuration is on the right. In this, the guest on the right hand side may use an address within the same subnet as the underlying host as it is in the same broadcast domain.
On systems which use sysconfig
style configuration files use the examples below for including the prefix sysconfig- and placed in the path
/etc/sysconfig/network-scripts/. These files will create an in kernel virtual bridge named br0. To this
bridge, a physical NIC named enp2s0 will be attached.
On systems which use systemd networkd
configuration can be completed using the example config files with the path prefix networkd- and placed in the
path /etc/systemd/networkd/. These files will create a netdev device (layer 2) for the in kernel bridge br0,
attach the device (layer 2) enp1s0 to the bridge br0, and finally assign an IP address to the device br0
(layer 3).
As you are connecting a (virtual) switch to an upstream switchport care must be taken to avoid
switching loops. This is why spanning tree is configured on br0 with a high (read: low)
priority, so as to avoid the device becoming the root bridge of a network. As such attempting
to configure bonding/teaming for the network with multiple network interfaces is possible, but
should be done carefully.