Re: allocate specific port range for container?

[Serge Hallyn <serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org>]

Quoting Hongbing Wang (hongbingwang-rphTv4pjVZMJGwgDXS7ZQA@public.gmane.org):
> Hello LXC experts:
> 
> Is it possible to allocate specific transport port range for the socket based applications inside one container? 

How do you mean?  You want ports 50000-51000 of the host to be forwarded
to container 1, and 60000-61000 to container 2?

> Say I have two containers: LXC_a and LXC_b, and each has some socket based applications I cannot modify or have no source code. If I need port range 50000 - 51000 for LXC_a and 60000 - 61000 for LXC_b. Any way to achieve this?
> 
> The /proc/sys/net/ipv4/ip_local_port_range is for the host to adjust the ephemeral port range, and we do not have the per LXC based setting on the local_port_range. Is this due to that the LXC network namespace isolation is at the L3 level? How could I achieve this per port range LXC?

The network namespaces are actually at L2, not L3.  Each container has
its own routing table.

I think you can get what you want by simply giving each container a veth
nic and using iptables on the host to forward the ports you want to the
appropriate container.  That's how I co-locate web, mail, and other
server containers on the same host.