Lab 4: Container networking — see veth, bridge, iptables

Objective

Trace a packet from inside a container through the host network stack. See the veth pair, the bridge, the iptables DNAT rules, and the host’s outbound interface.

Requirements

• A Linux host.
• Docker installed.
• curl available.

Tasks

Task 1: Start a container

docker run --rm -d --name nettest -p 8080:80 nginx:1.27

Task 2: Find the veth pair

PID=$(docker inspect nettest --format '{{.State.Pid}}')

docker exec nettest ip link

HOST_VETH=$(ip link | grep "if${PID: -3}:" | head -1 | awk -F: '{print $2}' | xargs)
echo "Host-side veth: $HOST_VETH"
ip link show $HOST_VETH

Task 3: See the bridge

ip link show docker0
brctl show docker0

Task 4: See the iptables DNAT rule

iptables -t nat -L DOCKER -n -v | grep :8080

Task 5: Trace with tcpdump

In one terminal:

sudo tcpdump -i docker0 -n port 80 -c 5

In another terminal:

curl http://localhost:8080

Task 6: Clean up

docker stop nettest