In this lesson, you will learn how to bypass traditional software bridges using macvlan and ipvlan to achieve near-wire-speed networking for your containers.
Beyond the Software Bridge
When we use veth pairs connected to a Linux bridge, packets must traverse the bridge’s lookup table and netfilter hooks. As you increase the number of containers, this overhead can become a performance bottleneck. macvlan and ipvlan allow you to virtualize a physical interface directly at the layer 2 or layer 3 level, removing the need for an intermediate bridge.
The Macvlan Approach
A macvlan interface creates a virtual network interface that acts like a distinct physical device with its own unique MAC address. It effectively "clones" your parent interface (like eth0). Because the kernel treats each macvlan sub-interface as a separate hardware-like port, your containers appear as individual physical devices on the switch.
To create one:
# Create a macvlan interface attached to eth0 in 'bridge' mode
ip link add link eth0 name mv-container0 type macvlan mode bridge
In bridge mode, your containers can communicate with each other directly at the hardware level, bypassing the host's bridge software entirely.
The Ipvlan Approach
ipvlan takes virtualization a step further by assigning multiple IP addresses to a single MAC address. This is ideal for environments where the upstream switch enforces strict MAC address limits (port security).
There are two primary modes:
- L2 Mode: The parent interface acts as an L2 switch; the kernel handles the packet switching between
ipvlanslaves. - L3 Mode: The kernel performs routing. This is the ultimate choice for high-performance container networking, as it avoids L2 broadcasts (like ARP) and reduces the processing cost of the packet path.
To create an ipvlan interface:
# Create an ipvlan L3 interface
ip link add link eth0 name ip-container0 type ipvlan mode l3
By using these methods, you strip away the complex layers of bridge-based networking, allowing your container traffic to flow closer to the physical hardware’s capacity while maintaining strict logical isolation.
Key Takeaway: Macvlan provides unique MAC addresses per container, while Ipvlan optimizes performance via shared MAC addresses and hardware-efficient routing.