12

I have hundreds of containers in various software virtual switches. I would like to know if its possible to find out which vnet# belongs to which docker container. Right now, I am detecting that by watching syslog as each container gets created. In KVM, there is a command "virsh domiflist ", which is exactly what i'm looking for.

16

The iflink of the container is the same as the ifindex of the veth#.

You can get the iflink of the container as follows:

docker exec -it <container-name> bash -c 'cat /sys/class/net/eth0/iflink'

Say, that results in 12, then grep for that:

grep -l 12 /sys/class/net/veth*/ifindex

That will give a unique result, on my system:

/sys/class/net/veth11d4238/ifindex

Combine that in a script:

#!/bin/bash

for container in $(docker ps -q); do
    iflink=`docker exec -it $container bash -c 'cat /sys/class/net/eth0/iflink'`
    iflink=`echo $iflink|tr -d '\r'`
    veth=`grep -l $iflink /sys/class/net/veth*/ifindex`
    veth=`echo $veth|sed -e 's;^.*net/\(.*\)/ifindex$;\1;'`
    echo $container:$veth
done

The script was written to be easy to follow.

Sample run:

$ docker ps -q
c4d8096eff43
34ac6e9f1e6e
d5a2aa5f3de3

$ sudo ./vethfinder
c4d8096eff43:veth11d4238
34ac6e9f1e6e:veth7d52cd1
d5a2aa5f3de3:vethe46073d

Reference: https://forums.docker.com/t/relationship-between-interface-vethxxxxx-and-container/12872/20

| improve this answer | |
  • Thank you, but it for some reason doesn't always work. I have 50 containers, and the script above would return 1 or 2 blanks. When I look at the iflink value for both containers, they are not +1 from the value obtained from inside the container. – user2066671 Mar 2 '17 at 6:20
  • This is a guess: It could be a timing issue. If containers are created too quickly after each other, then assigning the iflink values might get out of sync. The system might assign two consecutive iflink values to two containers, instead of alternating between the container and the system. – NZD Mar 3 '17 at 0:37
  • This is interesting, I create and run the containers in a for loop, the last container iflink is always very different. For example, the iflink from /sys/class/net/veth###/iflink returns 4205, but the container's /sys/class/eth0/iflink shows 4216 – user2066671 Mar 4 '17 at 0:27
  • Beats me. I tried a few things: starting a bunch of containers, verified that iflink lines up nicely. Stopped a few containers and created a few new ones, verified that iflink still lines up nicely. I got 115 containers running and my highest iflink was 244. How do you get to 4216? – NZD Mar 5 '17 at 5:39
  • I also checked the post I got the information from. It states: "This can be found out by matching a container interface's iflink value with a host veth interface's ifindex value". My script uses iflink for both. Maybe try 'ifindex' for 'veth' ? – NZD Mar 5 '17 at 5:51
3

searches for all interfaces in containers.

#!/bin/bash

for container in $(docker ps --format '{{.Names}}'); do
    iflink=`docker exec -it $container bash -c 'cat /sys/class/net/eth*/iflink'`
    for net in $iflink;do
        net=`echo $net|tr -d '\r'`
        veth=`grep -l $net /sys/class/net/veth*/ifindex`
        veth=`echo $veth|sed -e 's;^.*net/\(.*\)/ifindex$;\1;'`
        echo $container:$veth
    done
done
| improve this answer | |
1

I am using a different method, which seem to work just fine:

[root@kh1 ~]# docker inspect 6d48e279c5b8 --format '{{.State.Pid}}'                                                                                                                                                                                                              
56316
[root@kh1 ~]# 
[root@kh1 ~]# ip netns identify 56316
ns-56316
[root@kh1 ~]# 
[root@kh1 ~]# ip netns list | grep ns-56316
ns-56316 (id: 6)
[root@kh1 ~]# 
[root@kh1 ~]# ip link show | grep -B1 "link-netnsid 6"
330: veth1ce76e2b@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master cni0 state UP mode DEFAULT group default 
    link/ether de:f8:ce:a2:85:f9 brd ff:ff:ff:ff:ff:ff link-netnsid 6
| improve this answer | |
  • I have created a tool that does the steps above automatically. You can download the linux x86_64 binary from here – mhristache May 29 '18 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.