Cfrtjryk

I have a docker host (CentOs7) where I am running multiple dockerized applications and will be having even more in the future.
The problem that I have an external service which I need to access from the host, which uses an 172.18.100.101 address.

Docker automatically assigns subnets for the bridge networks it creates, 172.18.x, 172.19.x, etc:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

0.0.0.0         10.x.x.x        0.0.0.0         UG    0      0        0 eth0

172.17.1.0      0.0.0.0         255.255.255.0   U     0      0        0 docker0

172.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-0a7f3df38b5c

172.19.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-636432c82f83

The options I see:

1. Tell Docker NOT to use the 172.18.0.0 subnet for the bridges. I don't think this is possible in docker.

2. For each docker container I could start specifying a subnet - but this becomes very problematic, as you need to ensure they don't clash, plus docker-compose.yml files are shared across hosts, so this is a management nightmare.

3. Try to route the required ip (172.18.100.101) differently on the host - while the 172.18.0.0 subnet is still there. I am not sure whether this is possible. I have tried it with adding routes, but no help, probably because it gets added after the 172.18.0.0 rule and not before it.

$ sudo route add -host 172.18.100.101 dev eth0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

0.0.0.0         10.x.x.x        0.0.0.0         UG    0      0        0 eth0

172.17.1.0      0.0.0.0         255.255.255.0   U     0      0        0 docker0

172.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-0a7f3dfsudo ip route show to match 172.18.198.12038b5c

172.18.100.101  0.0.0.0         255.255.255.255 UH    0      0        0 eth0

172.19.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-636432c82f83

Any ideas? I guess the question is how to add an "exception" routing for a select ip (or subnet) and make sure that it is applied before the main rule.

EDIT (2018-06-21):
The issue is not about trying to connect t a service in a Docker container. My problem is that on my network there is a service (on a different server, not owned/controlled by me) with ip 172.18.100.101, but I cannot connect to this service from this host, as on this host Docker automatically assigns the 172.18.0.0 range to a bridge network it creates, so any connection attempts to 172.18.100.101 gets sent to bridge Docker created and not to that external host.

The Docker bridge network is just one of many options for configuring the networking. The Docker network documentation lists many different network plugins you can use for communications with containers.

If you just need to connect to a service in a Docker container, messing with the network is a bit overkill as you are able to open a service port on the host attached to port in Docker. Docker calls this "publishing ports" and is used in the docker run command with the flag --publish or -p. There should be no need to connect to a Docker container directly.

Though, if you do want to connect directly to the container, Docker will certainly let you configure that.

EDIT: I misunderstood the original question was about host routing.

Regarding host routing, Docker does let you change the network ranges it uses. If you are using docker to create your networks, you can configure the docker0 interface to whatever range you want, make sure to pick one not currently in use on your network.

If you use docker-compose to create the networks, then you need to configure the network ranges in the docker-compose.yml file for that project.

Routes with larger prefixes (like your 172.18.100.101 host route) will have higher priority than routes with a smaller prefix (like the /16 routes added by docker). So, your initial approach should work. However, unless 172.18.100.101 is directly reachable on eth0, you will need to specify a gateway for it as well.

e.g:

ip route add 172.18.100.101/32 via 10.x.x.x dev eth0