|
| 1 | +--- |
| 2 | +id: deploying-containers-that-can-communicate-with-each-other-on-ecss |
| 3 | +title: Deploying Containers that Can Communicate with Each Other on ECSs |
| 4 | +tags: [vpc, ecs, docker] |
| 5 | +--- |
| 6 | + |
| 7 | +# Deploying Containers that Can Communicate with Each Other on ECSs |
| 8 | + |
| 9 | +You can deploy containers, that are not provided by Open Telekom Cloud's Container Services (CCE or CCI), on Elastic Cloud Servers (ECS) and enable the containers on different ECSs, but in the same subnet, to communicate with each other. |
| 10 | + |
| 11 | +## Solution Advantages |
| 12 | + |
| 13 | +* Containers deployed on ECSs can use CIDR blocks that are not from those of the ECS VPCs, but use routes added to VPC route tables for data forwarding. |
| 14 | +* You only need to add routes to the route tables to allow communications among containers, which is flexible and convenient. |
| 15 | + |
| 16 | +## Typical Topology |
| 17 | + |
| 18 | +The network topology requirements are as follows: |
| 19 | + |
| 20 | +* ECSs are in the same subnet. As shown in the following figure, the VPC subnet is `192.168.0.0/24`, and the IP addresses of the ECS 1 and ECS 2 are `192.168.0.2` and `192.168.0.3`, respectively. |
| 21 | +* Containers are on CIDR blocks that are not from those of the VPC subnets that the ECSs belong to. Containers on the same ECS are on the same CIDR block, but containers on different ECSs are on different CIDR blocks. As shown in the following figure, the CIDR block of containers on ECS 1 is `10.0.2.0/24`, and that on ECS 2 is `10.0.3.0/24`. |
| 22 | +* The next hop of the data packets sent to a container is the ECS where the container is deployed. As shown in the following figure, the next hop of the packets sent to CIDR block `10.0.2.0/24` is `192.168.0.2`, and that of the packets sent to CIDR block `10.0.3.0/24` is `192.168.0.3`. |
| 23 | + |
| 24 | +<center> |
| 25 | +**Figure 1** Network topology |
| 26 | + |
| 27 | + |
| 28 | +</center> |
| 29 | + |
| 30 | +## Creating the ECSs |
| 31 | + |
| 32 | +1. **Create VPCs.** For details, see [Creating a VPC](https://docs.otc.t-systems.com/virtual-private-cloud/umn/vpc_and_subnet/vpc/creating_a_vpc.html#en-us-topic-0013935842). |
| 33 | + |
| 34 | +2. **Create ECSs.** For details, see [Creating an ECS](https://docs.otc.t-systems.com/elastic-cloud-server/umn/getting_started/creating_an_ecs/index.html#en-us-topic-0021831611). |
| 35 | + |
| 36 | + After the ECS is created, disable source/destination check on the ECS NIC, as shown in the figure below: |
| 37 | + |
| 38 | + <center> |
| 39 | + **Figure 2** Disabling source/destination check |
| 40 | +  |
| 41 | + </center> |
| 42 | + |
| 43 | +3. **Deploy containers on ECSs.** |
| 44 | + |
| 45 | + You can use Docker CE to deploy containers. For details, see the [documentation of Docker CE](https://docs.docker.com/engine/install/). |
| 46 | + |
| 47 | + :::important |
| 48 | + Containers on the same ECS must be on the same CIDR block and the CIDR blocks of containers on different ECSs cannot overlap. |
| 49 | + ::: |
| 50 | + |
| 51 | +4. **Add routes to the VPC route table.** |
| 52 | + |
| 53 | + Set the next hop of the packets sent to CIDR block `10.0.2.0/24` to `192.168.0.2`, and set the next hop of the packets sent to CIDR block `10.0.3.0/24` to `192.168.0.3`. |
| 54 | + |
| 55 | + :::caution |
| 56 | + * By default, a VPC supports containers from a maximum of 50 different CIDR blocks. If containers from more different CIDR blocks need to be deployed in a VPC, apply for more route tables for the VPC. |
| 57 | + * After a container is migrated to another ECS, you need to add routes to the route table of the ECS VPC. |
| 58 | + ::: |
| 59 | + |
| 60 | +5. **Add security group rules.** For details, see [Adding a Security Group Rule](https://docs.otc.t-systems.com/virtual-private-cloud/umn/access_control/security_group/managing_a_security_group/creating_a_security_group.html#en-us-topic-0013748715). |
| 61 | + |
| 62 | + To use ping and traceroute commands to check the communications between containers, add the rules shown in the table below, to the security group of the ECSs to allow ICMP and UDP traffic: |
| 63 | + |
| 64 | + | Direction| Protocol| Port| Source | |
| 65 | + |------------------|-----------------|-------------|------------------| |
| 66 | + | Inbound | ICMP | All | 0.0.0.0/0| |
| 67 | + | Inbound | UDP | All | 0.0.0.0/0| |
| 68 | + |
| 69 | +## Validating Connectivity |
| 70 | + |
| 71 | +Use the **ping** command to check whether the containers deployed on two different ECSs can communicate with each other. |
| 72 | + |
| 73 | +Run the following commands to create a network connection **my-net** on ECS 1, set the CIDR block to be used by a container on ECS 1 to `10.0.2.0/24`, and create the container that uses **my-net**. |
| 74 | + |
| 75 | +```bash |
| 76 | +docker network create --subnet 10.0.2.0/24 my-net |
| 77 | +docker run -d --name nginx --net my-net -p 8080:80 nginx:alpine |
| 78 | +``` |
| 79 | + |
| 80 | +Run the following commands to create a network connection and container on ECS 2, and set the CIDR block to be used by the container to `10.0.3.0/24`. |
| 81 | + |
| 82 | +```bash |
| 83 | +docker network create --subnet 10.0.3.0/24 my-net |
| 84 | +docker run -d --name nginx --net my-net -p 8080:80 nginx:alpine |
| 85 | +``` |
| 86 | + |
| 87 | +Run the following command to set the default policy of the **FORWARD** chain in the filter table of iptables on the ECS to **ACCEPT**. |
| 88 | + |
| 89 | +:::important |
| 90 | +This operation is required because Docker sets the default policy of the **FORWARD** chain in the filter table of iptables to **DROP** for security purposes. |
| 91 | +::: |
| 92 | + |
| 93 | +```shell |
| 94 | +iptables -P FORWARD ACCEPT |
| 95 | +``` |
| 96 | + |
| 97 | +Ping and traceroute `10.0.3.2` from `10.0.2.2`. The ping and traceroute operations are successful, and the packet is tracerouted in the following sequence: `10.0.2.2` -> `10.0.2.1` -> `192.168.0.3` -> `10.0.3.2`, which is consistent with the configured route forwarding rules: |
| 98 | + |
| 99 | +```bash |
| 100 | +[root@ecs1 ~]# docker exec -it nginx /bin/sh |
| 101 | +/ # traceroute -d 10.0.3.2 |
| 102 | +traceroute to 10.0.3.2 (10.0.3.2), 30 hops max, 46 byte packets |
| 103 | + 1 10.0.2.1 (10.0.2.1) 0.007 ms 0.004 ms 0.007 ms |
| 104 | + 2 192.168.0.3 (192.168.0.3) 0.232 ms 0.165 ms 0.248 ms |
| 105 | + 3 10.0.3.2 (10.0.3.2) 0.366 ms 0.308 ms 0.158 ms |
| 106 | +/ # ping 10.0.3.2 |
| 107 | +PING 10.0.3.2 (10.0.3.2): 56 data bytes |
| 108 | +64 bytes from 10.0.3.2: seq=0 ttl=62 time=0.570 ms |
| 109 | +64 bytes from 10.0.3.2: seq=1 ttl=62 time=0.343 ms |
| 110 | +64 bytes from 10.0.3.2: seq=2 ttl=62 time=0.304 ms |
| 111 | +64 bytes from 10.0.3.2: seq=3 ttl=62 time=0.319 ms |
| 112 | +``` |
0 commit comments