macOS 26 network isolation

[retsl]

The docs say:

The vmnet framework in macOS 15 can only provide networks where the attached containers are isolated from one another. Container-to-container communication over the virtual network is not possible.

Is it possible to block container-to-container communication on macOS 26 (without creating a new network for each of them)? I haven't found an option for it. While the containers don't see each other's traffic by default, using e.g. arpspoof they can.

[jglogan]

@retsl I hope to know better if this is possible in macOS 26 by next week.

[camparker]

(Related question, hope it's alright to ask here rather than a new thread)

I'm going to just describe the requested use case, as I've struggled to articulate this in regular words...

Use Case

Isolated Container that is connected to Isolated Network that cannot access the Host or Internet (directly).

Egress Container that is connected to Isolated Network and Egress Network and acts as the Proxy/Firewall between the Isolated Container and Internet.

Is that possible? Can it be done without the Isolated Container still having Host access?

[jglogan]

Have you tried it?

Create a host-only network (--internal flag), and attach the container where you're going to run your isolated agent.

Create your proxy container and dual home it onto the default and internal networks.

It should work. The trick is in setting up your proxy.

[camparker]

Have you tried it?

Create a host-only network (--internal flag), and attach the container where you're going to run your isolated agent.

Create your proxy container and dual home it onto the default and internal networks.

It should work. The trick is in setting up your proxy.

I love the sound of this. I tried it earlier this morning with two container networks, one being --internal but it did not seem to work. I didn't use the default network, so perhaps that's why. I'll do some more testing later with this. It'd be awesome to get this working that way though.

And thank you so much for your responses! I really appreciate it!

[jglogan]

At present, DNS resolution doesn’t work in a host only network, so you’ll need to provide that as part of your proxy strategy

[retsl]

(Related question, hope it's alright to ask here rather than a new thread)

Next time it'd be nice if you created a new thread. I'm receiving an email for every message here even though it doesn't help with my issue at all. It's getting a bit annoying at this point.

While I'm at it, thanks @jglogan for looking into it.