moby
It should be possible to create a network without assigning the bridge an IP address
Using the default bridge and IPAM drivers, it should be possible to create a bridge without assigning it an IP address. This is expressed at the gateway address through the CLI, and although I can set the gateway address within the subnet assigned to the network, there appears to be no way to specify that the bridge should not be assigned an IP address at all.
This is strange when considered in the context or isolated networks where there should be no connectivity outside the isolated network, and therefore no need for a gateway. This is important in the case of untrusted or possibly compromised containers on the isolated docker network, as the bridge address exposes host services. (i.e. if the host is running SSH, HTTP, or (god forbid) Docker listening over TCP without binding to a particular IP address, then these services will be accessible through the bridge IP, and open to compromise from an attacker)
What I'd like to see would be that if I specify a new flag (e.g. "--noip") or provide a special value (e.g. "0.0.0.0") to the "--gateway" flag when using the CLI "docker network create" command that it would create the bridge with no IP address. I am not familiar enough with the internal libnetwork APIs to know what it would be at this layer.
Any comments, pointers on how to implement this change, or workarounds, would be appreciated
+1 I thought this is what --ipam-driver=null is for, but it does not work. I would like to use the macvlan driver with --ipam=driver=null and then use a DHCP client to assign an IP address , but this does not work. At least not in docker 17.06.
Apparently "moby" is the upstream from where changes trickle out, so I opened an issue: https://github.com/moby/moby/issues/37430 and a proposed pull request: https://github.com/moby/moby/pull/37432 there.
Google "com.docker.network.bridge.inhibit_ipv4=true" if anyone lands on this page looking for solutions
terrible things.... the "com.docker.network.bridge.inhibit_ipv4=true" dosen't work on macvlan docker network create -d macvlan -o parent="eth1" -o com.docker.network.bridge.inhibit_ipv4=true veth2 docker network inpect veth2 I got .... "IPAM": { "Driver": "default", "Options": {}, "Config": [ { "Subnet": "172.23.0.0/16", "Gateway": "172.23.0.1" } ] }, "Internal": false, "Attachable": false, "Ingress": false, "ConfigFrom": { "Network": "" }, "ConfigOnly": false, "Containers": {}, "Options": { "com.docker.network.bridge.inhibit_ipv4": "true", "parent": "eth1" }, ....
when I create a new container with veth2. docker assigns 172.23.0.2 to me
docker version is 20.10.1
