Heya,

this needs documenting in both cli.md and networking.md, and I think you need to add some justification & explaination of what problems it solved to your pull request description.

Sure. I'll update the PR with the documentation.

Regarding the use case, we would like to run docker container with private IP adresses, but globally routable on our internal network, instead of the default private network allocated per docker host. We have tested the following options for the daemon:

--fixed-cidr=10.5.194.128/28 --ip-forward=false --ip-masq=false --iptables=false

The 10.5.194.128/28 is just an example of routable IP addresses on the integration network. Everything works fine (as long as you properly configure the docker0 bridge with a physical network device child), apart from the default gateway inside the container. This gateway is hard coded to be the hosts' IP address, which doesn't make sense in this case.

@SvenDowideit I modified the documentation, could you please take a look ? Thanks !

Doc LGTM - @fredlf @jamtur01

@lebauce In this case, you should either be setting --bip 10.5.194.129/28 or if you already have a bridge interface setup on the host, you can use --bridge <interface> instead of having Docker create one.

@cpuguy83 please allow me to chime in, as I was the one who asked @lebauce to develop this feature. I'm not sure I understand what you propose though. Our goal is:

• each docker host has an interface which belongs to a large, private network, which is globally routable in our infrastructure, say a /20
• for each docker host, we reserve a part of this large network, say a /24
• we take one of the ip addresses of this /24 and use it to configure the docker bridge; this address is not the default gateway for the large network
• we use --fixed-cidr to let the docker daemon know that it's responsible for IP address allocation in this /24
• we disable iptables altogether, and therefore source NATing and port NATing

We just need to let the containers know that the default gateway for the large network is not the address allocated to the docker bridge, which this patch does.

The pros of this approach are that the IP addresses "seen" by the containers are the same as the ones "seen" from the outside, which is important for applications that gossip (such as consul or cassandra). Also, we don't need to dynamically allocate ports, since each container has it's own globally routable address. And we don't need NATing at all.

If there's a way to do this using --bip or --bridge, I would be happy to know :)

please ping me if this is closed because there is some other way to achieve it - we should document it if there is :)

@SvenDowideit If there's another, existing, way to achieve what was described above, I would be happy to use it. I'm not sure if you are waiting for input from me or @cpuguy83 :)

@eolamey its a note only in case, as its something we don't want to lose the documentation for - even if we need to re-write it.

This is good, i think we should do this. +1

@eolamey At first I'm glad that you using --fixed-cidr :) I tried to merge it for very long time.
Design is okay for me, not a big deal.
ping @tiborvass for moving to code-review or questions

@lebauce Sorry for the crazy delay here: I'm pushing this to 2-code-review, are you please available to rebase your PR?

@icecrime @LK4D4 @crosbymichael I see IPv6 was added (as requested), so I think this can be reviewed

(@lebauce, correct me if you weren't ready yet)

@lebauce Sorry, it needs rebase again, and I promise we'll try to be reactive on review afterwards :-(

@icecrime Rebased, ready for review :)

Thanks! Code LGTM (some duplication for IPv4 and IPv6 can be avoided, but I'm fine merging it nevertheless).

LGTM moving to docs review

Docs LGTM

@icecrime I moved the common code to the "requestDefaultGateway" method. Thanks for pointing out the code duplication

Cool thanks!