IOX Docker Networking - Half works?

[RichardAtkin]

Evening...

I'm trying to run a Docker image in a Cat9300 on 17.1.1.  I can build / upload / install / start the Container, but I can't get the Container's networking sorted out...  I'm struggling to understand how concepts like Bridges, Bridge IPs, the Guest-Interface and the appGigabitEthernet interface relate to traditional networking concepts.

I have got as far as the switch learning the Container's MAC and ARP, but that's all... I can't actually get it to pass any traffic at all... DNS, ICMP, etc... they all fail.  This is just lab stuff so the topology is extremely simple - single VLAN, single subet.

Config extract:

!
interface AppGigabitEthernet1/0/1
 switchport mode trunk
 switchport trunk allowed vlan all
!
interface Vlan1
 ip address 192.168.2.1 255.255.255.0
!
iox
!
ip http server
ip http authentication local
ip http secure-server
!
app-hosting appid LogMon
 app-vnic AppGigabitEthernet trunk
  vlan 1 guest-interface 0
   guest-ipaddress 192.168.2.2 netmask 255.255.255.0
 app-default-gateway 192.168.2.1 guest-interface 0
!

Show output:

Switch#
Switch#show mac address-table vlan 1
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    5254.dd52.821e    DYNAMIC     Ap1/0/1
   1    7035.09ae.bcc7    STATIC      Vl1
Total Mac Addresses for this criterion: 2
Switch#show ip arp vla
Switch#show ip arp vlan 1
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.2.1             -   7035.09ae.bcc7  ARPA   Vlan1
Internet  192.168.2.2             0   5254.dd52.821e  ARPA   Vlan1
Switch#

Any tips?

Are there any reading materials beyond Cisco's developer site that actually explain how the various bridge, bridge ip, guest-interface, vnic, appGigabitEthernet (etc etc...) concepts work (in general, or in 17.1.1 specifically)?

Cheers,

Richard

[Alexander Stevenson]

Hello Richard,

I can appreciate your dilemma. However, I think you have a pretty good grasp on this topic. Let me ask you this:
Are the container and the switch in the same subnet?

[RichardAtkin]

Hi Dude,

Yes, this is all on a single (not even stacked) switch and all in the same subnet.

I’m fine with ‘normal’ networking, but both Docker and IOX are new to me. I’m assuming human error on my part, I just don’t know enough to fix it!

cheers,

Rich

[Alexander Stevenson]

Hello Richard,

I'm not sure you've had a chance to peruse this gem regarding configuring the IP address via the AppGigabitEthernet port using the IOS commands: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/prog/configuration/171/b_171_programmability_cg/application_hosting.html#id_96210

It appears there's another applicable resource of value at: https://developer.cisco.com/docs/app-hosting/#!application-hosting-configuration/assigning-ip-address-to-app-container

Please get back to us if you continue to have issues.

[RichardAtkin · Accepted solution]

Found this:

https://www.ciscolive.com/c/dam/r/ciscolive/apjc/docs/2018/pdf/BRKRST-2673.pdf

About halfway down (sorry, no page numbers) it gives a nice simple example of how to use a VirtualPortGroup to provide connectivity between the network and the Container...  I used that, configured the container's NIC in the iox manager GUI, removed all of the app-hosting stuff from the IOS CLI, and it works :)

I'm still in the dark about how a lot of this actually works, but it's a step in the right direction.

[Alexander Stevenson]

Great find, Richard! Happy for you. Keep it up!