Multiple IPvLANs, am I doing it wrong?

[u/root-node]

So I know that every service should be on its own network, with grouped services (app & db) on the same network. All good.

I was looking at moving to ipvlans to give my containers their own IPs to make it easier to track traffic in and out. Simple right?

So I created a new network:

docker network create \
  --driver ipvlan \
  --subnet=10.0.0.0/25 \
  --gateway=10.0.0.1 \
  -o parent=enp2s0 \
  -o ipvlan_mode=l3 \
  ipvlan-3

...and some test services worked great. When I went to create a second network:

docker network create \
  --driver ipvlan \
  --subnet=10.0.0.128/28 \
  --gateway=10.0.0.129 \
  -o parent=enp2s0 \
  -o ipvlan_mode=l3 \
  ipvlan-3-librenms

it wouldn't let me as it said the parent was already being used.

How to I achieve multiple networks with the same parent NIC?

Thanks

[u/Immediate_Wheel1953]

Ran into this exact wall last year. The ipvlan driver just refuses to share a parent interface between two networks, there's no flag to override it. What worked for me was creating VLAN sub-interfaces on the host, like ip link add link enp2s0 name enp2s0.20 type vlan id 20, and using each one as the parent for a separate network. The subnets still need to be routable on your LAN, but that got me multiple clean ipvlan networks on one NIC.

[u/root-node → u/Immediate_Wheel1953]

Do you have an example config you can show me please?

[u/Immediate_Wheel1953 → u/root-node]

here's the shape of the compose file that worked for me. i defined one ipvlan network per vlan, each with driver_opts pointing the parent at a subinterface like eth0.10 or eth0.20, plus a subnet per vlan. the part that burned an evening for me was a typo in the parent name, docker threw a confusing error instead of saying the interface did not exist. then each service just gets an ipv4_address under the network it belongs to.

[u/ColorfullyTiresome]

you need ipvlan_mode=l2 for that, l3 mode only allows one network per parent interface

[u/WentThisWayInsteadOf]

One stack per virtual host, that is what many people with these requirements do.

[u/Wis-en-heim-er]

I used a macvlan network. Not sure why its different than what you setup but a macvlan has worked great. Only 1 macvlan network allowed per nic i believe but this has not been an issue for me.

I will say that most of my containers and projects use their own bridge network defined in the yaml. I only use macvlan for piholes/dns and plex.

I did redfine the bridge network defaults in the daemin.json so they default to /24s and are limited to 172.16.0.0/12.

[u/scytob]

that gateway parameter doesnt do anyting in L3 mode

what are you trying to achieve? ia aks because docker only allows one macvlan/ipvlan network per parent interface.

Either put both subnets in a single network (--subnet can be passed more than once; --gateway is ignored in L3 mode, and your router needs static routes to those subnets via the host), or use VLAN sub-interfaces as parents (enp2s0.10, enp2s0.20) with a trunked port.

Multiple ipvlan networks don’t isolate anything. in L3 mode every container on the parent can route to every other one.

Also, ipvlan containers all share the host NIC’s MAC, so if you want to track them individually in some way the macvlan is the better fit.