LXC Containers - Exposing Ports & Port Forwarding

I sort of promised to make a networking port-forward video about LXC in my previous LXC & LXD video so, here it is!

Networking can be somewhat of a challenge in LXC. The (current) default use case for LXC & LXD is for use as internal containers in a virtual network. As such, you cannot easily port forward your containers as you can with Docker. Instead, you must change the nictype to make your containers publicly accessible. A side effect of this is since the container is no longer in a virtual network with the host, the host must use the router to connect to it.

Port forwarding can technically be achieved by using iptables, however, I think most people agree that iptables are cumbersome and are generally avoided by most users. Macvlan is a heavy-handed approach the technically exposes *all* ports to the router, which means you *must* have some kind of a firewall on your router or gateway if you want to keep your containers secured.

If you want to use your LXC container as a web server or game server (like I do), macvlan is arguably the best way to facilitate it.
~~
Support the channel! Becoming a Patron or Ko-fi supporter gives you access to the Egee video archive & good vibes for supporting my videos!

Use My Affiliate Links & Support The Channel! 🎁

Linux & Open Source Gear

Recording Gear

[BrianJurkowski]

Kudos on the video! Clear, concise, good audio quality - I hope to see more videos from you on LXC / networking, etc.

[hobbyegee]

Hope everyone enjoyed the video! Please like, comment, and subscribe if you learned something (or even if you didn't :D)! Couple things I glossed over in the video:

• You CAN technically port forward your LXC containers using iptables however I found this method burdensome and prefer the macvlan approach
• Using macvlan exposes your entire container to your router. If you do not have proper security setup on your router or gateway, an attacker can easily access your container. Make sure your router or gateway has a good firewall before setting your containers up with macvlan
• Always make sure you stop your containers before making any kind of network changes.

[jamminvagia]

Thanks for putting this up. When I started setting up my containers, I thought this was gonna be the hard part. Turns out it was easier than getting steamcmd running in lxc.

[stevekirsch]

Awesome video. Thanks for pointing out the macvlan. This makes it trivial to configure the DISPLAY to use my host machine.

[VitePapa]

I've been looking to repurpose an old netbook to learn LXD but would always be stuck at the networking part.

I'm sending you all my love...

[DDBAA]

5 hours it took me to find someone on the internet who can answer my question. I'm running Turnkey-lxc, ALL I want is to be able to ssh into running containers from other machines in my network and NOT only the host Turnkey-lxc system. I've been SSH'ing into turnkey-lxc just to get access to my running containers, this should fix that problem right ? I am not using lxd on Ubuntu so it doesn't come with the convenient 'lxd init' where you can configure everything interactively ... Its just 'lxc-create' , 'lxc-start -n container' , 'lxc-attach -n container-name' . It actually behaves a lot like docker.


Although there was something you said that did catch my ear, about exposing Docker containers. I am not positive how you go about exposing a docker container, I learned how to share the hosts network adapter and xserver. If I want my docker container on the network, I will just 'docker run -ti --net=host ubuntu /bin/bash' just as an example, but it does give you the same exact hostname as the server. Which can get to be a problem with conflicting ports. It may be manageable for one container, but with multiple containers as far as open ports it would be madness . SO , HOW does one expose a Docker container to the network so that it gets its own ip ?

[lopo]

how do i expose port and port forwarding a regular VM on proxmox? using ubuntu LAMP

[alexclarke]

Thank you for this, subscribed! Your videos are really well done, and your voice is absolutely perfectly suited for tutorial videos - Thought your original LXC video was an official demonstration from Ubuntu until you had to recheck one of your commands! Haha

[NickMcCathyTX]

Thanks! One thing I didn't see in the video was how to apply a profile to an existing container. To do so: "lxc profile apply [container-name] [profile-name]"

[HaiNguyen-cfji]

This come with issue, host and container can't ping each other so you can't ssh or access container http from host (while other device in network can)

[kb]

Thanks for the video.. Just wanna say that after trying this solution macvlan, it didnt work and after deep search i realized that macvlan does not work with wireless.... I read that it only works with ethernet connection... Any one could guide?
Thanks anyways

[ismailgarig]

Please which file you open after configuration default 3:27

[insidiousbottom]

Great instructions thanks. I have a question.
Once my containers have been assigned the dhcp address from my router, I cannot ping it from my lan nor can I see any services on the IP from my lxd host. Do i have to do something to route the traffic?

[OpenThisGate]

Fortunately the latest versions of most distros can run nspawn containers, which allows you to forward ports without having to deal with docker. I guess LXD is just going to get left behind.

[soufianta]

Which distribution is running on your "gameserver "?

[vripscript]

Full LXD management of profiles, containers, images, remotes, certificates, networks, storage and devices.

[amilcarlelis]

HELLO GUYS! I INTEND TO CREAT A VOIP LXC ANYONE CAN HALP PLEASE, THANK YOU