Networks

Machines get a real presence on your network through a Linux bridge. Virtainer Lite does not run its own DHCP server, NAT, or address management: your existing network keeps doing that job.

The two kinds of network

• The management network is how you reach the host itself. There is exactly one, and it is the one that can lock you out.
• VM networks are what machines attach to. New machines use the host’s default VM network unless you pick another.

A bridged management network can also carry machines. A management interface that is not bridged cannot, and Virtainer Lite refuses rather than quietly breaking your access.

Creating a network

The Networks page builds networks from recipes that cover the common shapes:

Recipe	What it gives you
Dedicated	A bridge on its own uplink
Isolated	A segment with no uplink, for machines that should only talk to each other
Bonded uplink	A bridge over bonded interfaces
VLAN segment	A tagged segment on an existing interface

There is also a structured editor for the cases the recipes do not cover, and a topology view showing how interfaces stack up. The management branch is locked by default in that editor, and unlocking it is deliberate.

The confirmation window

Changes to the management network must be confirmed

Any change that touches the management network is applied as a trial. You have five minutes to confirm from the new configuration. If you do not, the host rolls it back automatically.

This is what makes management network changes survivable. If a change is wrong and takes the host off the network, doing nothing restores it.

If the change moves the host to a new address, the console reopens a confirmation page at the new address, and you will not have to sign in again to confirm it.

Some changes need explicit acknowledgement even when they are correct: taking over an interface that carries the default route, planning a configuration with no default route at all, or demoting the current management interface.

Per-machine policy

Two controls apply to a machine’s own network attachment:

• Anti-spoof restricts a machine to its own address and MAC, so it cannot claim to be something else. Extra source addresses can be allowed explicitly.
• Port isolation stops a machine talking directly to its neighbours on the same bridge.

Both can be set on the network as a default and overridden per machine. The console shows the value that is actually in effect and where it came from, so there is no ambiguous inherited setting to guess at.

Both can be changed while the machine runs. A change to a network’s policy is pushed to the machines on it immediately, except where a machine has its own override, which continues to win.

What Lite does not do

Cross-host overlay networks, VXLAN creation, and internal NAT private networks are not part of Virtainer Lite. Networking spanning more than one host belongs to Virtainer Basic. See Virtainer Basic.