network/80-container-ve.network

# SPDX-License-Identifier: MIT-0
#
# This config file is installed as part of systemd.
# It may be freely copied and edited (following the MIT No Attribution license).
#
# To make local modifications, use "networkctl edit". See networkctl(1) for details.
# This file should not be edited in place, because it'll be overwritten on upgrades.

# This .network file matches the host-side of the virtual Ethernet link
# created by systemd-nspawn's --network-veth switch. See systemd-nspawn(1) for
# details.

[Match]
Kind=veth
Name=ve-*

[Link]
RequiredForOnline=no

[Network]
# Default to using a /28 prefix, giving up to 13 addresses per container.
Address=0.0.0.0/28
LinkLocalAddressing=yes
DHCPServer=yes
IPMasquerade=both
LLDP=yes
EmitLLDP=customer-bridge
IPv6AcceptRA=no
IPv6SendRA=yes

[DHCPServer]
PersistLeases=runtime
LocalLeaseDomain=_dhcp
network: change license of examples to MIT-0 Arguably, CC0 is just fine for examples since they are not code. But it's easier to be consistent and just use MIT-0 for all "documentation". Thus, the license is changed similarly code examples under man/. Based on 'git shortlog -ns network/*' and 'git log -p', the following folks should ack this: Zbigniew Jędrzejewski-Szmek Lennart Poettering Tom Gundersen Yu Watanabe Daan De Meyer Marc-André Lureau 2022-10-26 08:34:13 +02:00			`# SPDX-License-Identifier: MIT-0`
Add SPDX license headers to various assorted files 2017-11-18 18:18:16 +01:00			`#`
network: license all config files as CC0 Same justification as the previous commit. $ for i in network/-; do git blame $i;done \| less shows that those files were written by Tom Gundersen, Lennart Poettering, Yu Watanabe, me, and Marc-André Lureau. 2022-01-11 17:52:35 +01:00			`# This config file is installed as part of systemd.`
network: change license of examples to MIT-0 Arguably, CC0 is just fine for examples since they are not code. But it's easier to be consistent and just use MIT-0 for all "documentation". Thus, the license is changed similarly code examples under man/. Based on 'git shortlog -ns network/*' and 'git log -p', the following folks should ack this: Zbigniew Jędrzejewski-Szmek Lennart Poettering Tom Gundersen Yu Watanabe Daan De Meyer Marc-André Lureau 2022-10-26 08:34:13 +02:00			`# It may be freely copied and edited (following the MIT No Attribution license).`
network: always take possession of host side of nspawn veth tunnels and do IPv4LL on them 2014-05-17 21:32:13 +02:00			`#`
network: suggest using "networkctl edit" instead of copying manually 2024-04-23 19:51:07 +08:00			`# To make local modifications, use "networkctl edit". See networkctl(1) for details.`
network: license all config files as CC0 Same justification as the previous commit. $ for i in network/-; do git blame $i;done \| less shows that those files were written by Tom Gundersen, Lennart Poettering, Yu Watanabe, me, and Marc-André Lureau. 2022-01-11 17:52:35 +01:00			`# This file should not be edited in place, because it'll be overwritten on upgrades.`
network: always take possession of host side of nspawn veth tunnels and do IPv4LL on them 2014-05-17 21:32:13 +02:00
network: take explicit ownership of our own interfaces This is a follow-up for #30786 and uses it to assign ID_NET_MANAGED_BY=io.systemd.Network to all all network interfaces that we consider ours to manage. This should hopefully have the effect that other well-behaving managers won't fight for these devices. This doesn't bother with network interfaces we match inside containers, since udev is not available there anyway. 2024-01-10 16:18:41 +01:00			`# This .network file matches the host-side of the virtual Ethernet link`
network: add automatic configuration for the networks created by nspawn --network-zone= This way, they "just work", similar to --network-veth behaves, as long as networkd is enabled and running on all involved nodes. 2016-05-06 21:03:40 +02:00			`# created by systemd-nspawn's --network-veth switch. See systemd-nspawn(1) for`
			`# details.`

network: always take possession of host side of nspawn veth tunnels and do IPv4LL on them 2014-05-17 21:32:13 +02:00			`[Match]`
network: use Kind= instead of Driver= networkd ignores errors in reading driver through ethtool. The kind of network interface is retrieved through netlink, and networkd checks checks many failures. So, using Kind= should be safer. No functional change, just for safety. 2023-11-08 22:59:33 +09:00			`Kind=veth`
network: always take possession of host side of nspawn veth tunnels and do IPv4LL on them 2014-05-17 21:32:13 +02:00			`Name=ve-*`

network: mark container/VM/namespace networks as not required for online + disable DHCP lease persistency These networks are not connections to upstream routers, but where we are ourselves are the upstream router, hence it doesn't make too much sense to require them to be up as default to determine if we are "online", because they lead "in the wrong direction". Also, disable DHCP lease persistency for these networks, since container/VM/namespaces are generally shortlived, and typically have no persistent identity. Moreover, the IP range we assign each VM/container connection is just too small to permit persistency, as otherwise we'll run out of leases way too quickly if VM/containers are restarted a bunch of times with different MAC addresses (which I ran into). I think these are better defaults, but of course these are only defaults. 2025-02-07 18:08:51 +01:00			`[Link]`
			`RequiredForOnline=no`

network: always take possession of host side of nspawn veth tunnels and do IPv4LL on them 2014-05-17 21:32:13 +02:00			`[Network]`
doc: network - add comment about default prefix size Should hopefully make it clear that this is not some magic value, just the default we picked. Suggested by Jan Engelhardt. 2015-01-13 18:23:53 +01:00			`# Default to using a /28 prefix, giving up to 13 addresses per container.`
network: automatically assign each container veth link a /28 IP address range 2014-06-18 18:27:55 +02:00			`Address=0.0.0.0/28`
network: fix 'LinkLocal' -> 'LinkLocalAddressing' in network files 'LinkLocal' was renamed to 'LinkLocalAddressing' in: commit 56fd6bf795926409b087bce406ea851ad89f9fe8 Author: Tom Gundersen <teg@jklm.no> Date: Sat Feb 14 00:32:26 2015 +0100 networkd: .network - rename LinkLocal to LinkLocalAddressing ..but apparently the network files were not updated. Fix this. 2015-02-14 15:31:26 +01:00			`LinkLocalAddressing=yes`
network: automatically assign each container veth link a /28 IP address range 2014-06-18 18:27:55 +02:00			`DHCPServer=yes`
network: use IPMasquerade=both instead of yes Follow-up for 4c72d851cd007e945a85811f89376a2675daa1a5. 2021-02-24 20:29:24 +09:00			`IPMasquerade=both`
network: turn on LLDP tx+rx for the default container network configuration Containers are relatively trusted and the veth tunnels are small networks, hence let's turn on LLDP both ways for them. 2016-02-21 14:06:08 +01:00			`LLDP=yes`
network: allow LLDP packets to cross non-customer bridges for container network interfaces This changes the default .network files we ship for nspawn containers to set EmitLLDP=customer-bridge in order to allow propagation of the LLDP packets across bridges. This is useful so that "networkctl status" shows all peers connected to a virtual container network, collecting this data via LLDP. This is safe since the default configuration for these interfaces does not bridge these links to external interfaces, but relies on IP routing for this. 2016-05-06 22:44:13 +02:00			`EmitLLDP=customer-bridge`
network: disable IPv6AcceptRA= in several default config Also, - drop DHCP=no, as it is the default setting, - enable IPv6SendRA= for wifi access point, - enable MulticastDNS= for wifi adhoc mode. 2023-11-02 13:29:45 +09:00			`IPv6AcceptRA=no`
networkd: Enable IPv6SendRA on builtin network files RAs trigger neighbor discovery which allows users to query the LL address of the container/VM via `ip neighbor get dev`. This is useful as it gives users an easy way to connect to the container without needing LLMNR or mDNS to resolve the hostname of the container to an IP address. In practice, this allows connecting with only networkd enabled and without resolved running in the host/container. 2020-12-26 15:27:55 +01:00			`IPv6SendRA=yes`
network: mark container/VM/namespace networks as not required for online + disable DHCP lease persistency These networks are not connections to upstream routers, but where we are ourselves are the upstream router, hence it doesn't make too much sense to require them to be up as default to determine if we are "online", because they lead "in the wrong direction". Also, disable DHCP lease persistency for these networks, since container/VM/namespaces are generally shortlived, and typically have no persistent identity. Moreover, the IP range we assign each VM/container connection is just too small to permit persistency, as otherwise we'll run out of leases way too quickly if VM/containers are restarted a bunch of times with different MAC addresses (which I ran into). I think these are better defaults, but of course these are only defaults. 2025-02-07 18:08:51 +01:00
			`[DHCPServer]`
network: use PersistLeases=runtime on container/VM/namespace network interfaces Follow-up for 9ccc369ff30138b9c2cf3ed8faf28d8fe42f8377. Then, we can safely restart networkd or reconfigure the interface. 2025-06-14 03:46:17 +09:00			`PersistLeases=runtime`
network: make use of LocalLeaseDomain= by default Let's expose local VMs/containers under ._dhcp by default. Let's also expose WIFI AP clients under .home.arpa (i.e. the RFC8375 domain for home networks). 2025-10-13 11:42:25 +02:00			`LocalLeaseDomain=_dhcp`