In this lesson, you will learn how to bypass traditional virtual bridges to expose container interfaces directly to your physical network for high-performance, low-latency traffic.
Beyond the Bridge
Up until now, you have managed container networking using veth pairs connected to a Linux Bridge. While flexible, this path forces packets through the host’s software-defined bridge, incurring overhead from packet processing, MAC address learning, and Netfilter hook points. When you need "bare-metal" performance for a container, you can bypass the bridge entirely using MACVLAN or IPVLAN drivers.
MACVLAN: Virtualized Hardware MACs
A macvlan interface acts as a sub-interface of your physical NIC (e.g., eth0). It assigns a unique virtual MAC address to your container. From the perspective of your physical switch, the container appears as a physically distinct device connected to the same port.
- Best for: When you need the container to have its own MAC address, for example, to receive specific VLAN-tagged traffic or to satisfy external DHCP servers that identify devices by MAC.
IPVLAN: Virtualized Layer 3
ipvlan is even more streamlined. Unlike macvlan, it does not assign a unique MAC address to the container; all containers sharing the parent interface use the same MAC as the physical host. However, they are assigned unique IP addresses.
- Best for: Environments where the upstream switch enforces port security (which often drops traffic from multiple MAC addresses on a single port) or when you want to minimize the MAC address table churn on your physical switches.
Implementation Example
To create a macvlan interface attached to eth0 for a container inside a specific network namespace, you would do the following:
# Create a macvlan interface named 'mv0' on eth0
ip link add mv0 link eth0 type macvlan mode bridge
# Move the interface into the container's network namespace
ip link set mv0 netns <container_pid>
By removing the software bridge from the path, these drivers reduce the number of CPU cycles spent on packet traversal, allowing your containers to push traffic at near-line rate speeds.
Key Takeaway: MACVLAN and IPVLAN drivers provide direct Layer 2/3 access to the physical network by eliminating the software bridge, trading management flexibility for raw performance.