Chapter 37 — Cloud and container networking
The idea
Everything you've learned still applies — cloud and container networks are built from the same IP, TCP, routing, and NAT. They just add a layer of software abstraction with new names.
The translation table
| Cloud/container term | What it really is |
|---|---|
| VPC / VNet | A private IP address range you chose (e.g. 10.0.0.0/16), plus routing |
| Subnet | A subnet (Chapter 10), usually pinned to one data centre |
| Route table | A routing table (Chapter 13) |
| Internet Gateway | NAT/routing to the public internet (Chapter 12) |
| NAT Gateway | NAT for private machines to reach out (Chapter 12) |
| Security Group | A stateful firewall attached to a machine — allow rules only |
| Network ACL | A stateless firewall on a subnet — so you must open return ports too |
| Elastic/Public IP | A public address 1:1 mapped to your private one |
| Container network | A software switch (Chapter 7) + veth "virtual cables" + NAT |
| Kubernetes Service | A virtual IP that gets rewritten (DNAT) to a real pod |
| Overlay network (VXLAN) | Your packet wrapped inside another packet to cross the real network |
The one thing that bites everyone: overlay networks (VXLAN, VPN, most Kubernetes CNIs) wrap your packet in another packet, which eats into the MTU (Chapter 15). Pod MTU is often 1450 or 1400, not 1500. If large requests hang in Kubernetes but small ones work, check the MTU. This is the single most common "impossible" container networking bug.
Stateful vs stateless firewalls — a crucial cloud distinction
SECURITY GROUP (stateful):
You allow inbound port 443. Return traffic is AUTOMATICALLY allowed.
Simple.
NETWORK ACL (stateless):
You allow inbound port 443. You must ALSO allow OUTBOUND on the
ephemeral port range (1024-65535), or replies are blocked.
This catches people out constantly.
Practice (20 min)
# If you have Docker: look at the software network it built
ip -br addr | grep docker # the bridge (a virtual switch)
ip route | grep docker # the route to container-land
sudo iptables -t nat -L -n | head -30 # the NAT rules Docker added
# Run two containers and watch them talk
docker run -d --name a alpine sleep 600
docker run -d --name b alpine sleep 600
docker exec a ip -br addr # container a's private IP
docker exec a ping -c2 <b's ip>
# Check a container's MTU -- often NOT 1500
docker exec a cat /sys/class/net/eth0/mtu
Further reading
- Docs: your cloud provider's VPC documentation — AWS's "VPC User Guide" is the most thorough and the concepts transfer.
- Article: "A Guide to the Kubernetes Networking Model" — search; several
good ones. Also "Container Networking From Scratch" (a talk by Kristen Jacobs)
which builds it up from
ip netnscommands. - Hands-on: build a container network by hand with
ip netns,veth, andiptables. Half a day, and it demystifies Docker completely.