Problems with Docker/Macvlan and stability - Best practices for direct network exposure of containers?

[poshmick907ak]

So I'm new to Unraid and am trying to setup my server so that the single network interface is a trunk. I have configured my NIC in Unraid settings so Unraid's management is working fine on the default native VLAN. I've also defined the additional VLANs that will be used for my Docker containers.

 

In Docker settings I enabled Macvlan (don't really know the difference with IPVlan, but went with Macvlan since I used that to expose my Dockers on my Synology to the local network) and then defined the custom network interfaces for each VLAN I had defined in Unraid network settings. When setting up my docker containers that needed to live on special VLANs, I was able to assign them to the VLAN-specific custom Docker interfaces for those VLANs and they worked great on those networks as I intended.... until they didn't

 

I've had my server lock up and become non-responsive twice now (Unraid management nor any of the Docker containers responding to pings). I noticed that the FixCommonProblems plugin flagged me for "Macvlan and Bridging found". Looking online, I've found some references to problems with Macvlan and possible system stability.

 

What's the proper way to fully extend my network to Docker containers? I'd like to have them operate like they were directly on my network and receive their own individual IP addresses and not just be bridged behind the Unraid IP using different ports (some of them won't even be on the same VLAN as the Unraid management NIC).

 

Do I need to add a second NIC to the server so one is for un-tagged native VLAN traffic just for the Unraid management IP and then dedicate a separate NIC for use with Docker that supports trunking for the various VLANs used by the containers?

[JorgeB]

You can change to ipvlan or if you really want macvlan just disable bridging, see the v6.12.4 release notes for more info.

[poshmick907ak]

So reading a little more into this, I think I have clarity on Macvan vs IPvlan the difference being each host gets a unique virtualized MAC vs having to share with IPvlan. I think the only consequence of IPVlan would be I couldn't have hosts get IPs via DHCP and maybe some layer 2 discovery protocols might be borked, but neither should be an issue in my use case, so I think I'll make the plunge and just switch to IPVlan.