<p><strong>SOLUTION APPROACH</strong></p>

<p>The approach is to create a macvlan. This will create a virtual adapter, that is allowed to lease an IP address from the subnet defined.</p>

<p><strong>1) Activate Promiscous Mode</strong></p>

<p>For the virtual adapter one must enable promiscuous mode in the network. For Unifi controllers, do a SSH to your gateway and set:</p>

<pre><code>ifconfig [interface] promisc
</code></pre>

<p>Some network gateways/controllers have set promiscuous mode by default. Continue with step 2 before you're wasting time to find that out.</p>

<p><strong>2) Create macvlan</strong></p>

<p>Then one can create the macvlan.</p>

<pre><code>$ docker network create -d macvlan \
  --subnet=192.168.2.0/23 \
  --ip-range=192.168.2.5/25 \
  --gateway=192.168.2.1 \
  --aux-address="my-router=192.168.2.10" \
  -o parent=eth0 unifinet
</code></pre>

<ul>
<li><p>Limiting the IP range: use <code>--ip-range</code> to scope the possible IPs to lease.</p></li>
<li><p>Avoiding certain IPs: The <code>--aux-address</code> marks my Synology host, which should never ever battle for that IP address (It's marked in the unifi controller's DHCP service as a fixed IP anyways).</p></li>
<li>the <code>-o parent</code> is your network interface you want to attach your macvlan. In my case <code>unifinet</code>.</li>
</ul>

<p>Check with <code>docker network ls</code> if the macvlan has been properly created.</p>

<pre><code>NETWORK ID          NAME                DRIVER              SCOPE
c49094a4c914        bridge              bridge              local
b2315de1aa7e        host                host                local
c124eda0f9d2        none                null                local
a60da50f0d12        unifinet            macvlan             local
</code></pre>

<p><strong>3) Start Docker Container</strong></p>

<p>While you define the image (--name UnifiController jacobalberty/unifi) assign the freshly created macvlan (--network unifinet) to the container (UnifiController). It will grab the latest image respectively the latest Unifi Controller version available from Docker Hub.</p>

<pre><code>docker run -dit --network unifinet --name UnifiController jacobalberty/unifi
</code></pre>

<p>Verify if the container has been assigned to the network in the container section of the JSON config.</p>

<pre><code>sudo docker network inspect unifinet.

[
    {
        "Name": "unifinet",
        "Id": "a60da50f0d1229d1a3c76210141e0c81567c17daf6c2b49d4f1c83d5ec9f02b3",
        "Created": "2019-10-04T14:39:37.377311991+02:00",
        "Scope": "local",
        "Driver": "macvlan",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "192.168.2.0/24",
                    "Gateway": "192.168.2.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "b819bf1d6f3af459825a1a7b58f9a44e15e6e09489e7bf50653ed8e1e176fd73": {
                "Name": "UnifiController",
                "EndpointID": "41a048034ad63e48b46b58aed65661c9eaa2bf6937d3eebacefde4478ad26cce",
                "MacAddress": "02:42:c0:a8:02:02",
                "IPv4Address": "192.168.2.2/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "parent": "eth0"
        },
        "Labels": {}
    }
]
</code></pre>

<p>The IP 192.168.2.2 is assigned. The container workes properly and stable. </p>

<p><strong>4) Optional/Reminder</strong></p>

<p>If the IP was not assigned respectively one cannot connect to it for any service, the follow up on the promiscious mode setting as described in Step 1.</p>

CC BY-SA 4.0
2019-10-05T08:09:42.673Z
Is this possible when the container is launched by kubernetes?
LLlAMnYP
CC BY-SA 4.0
2019-10-06T12:21:37.827Z
@LLlAMnYP I see no reason why that should not be the case if you keep the macvlan up and assign it to the container. I bet it works. But that is merely an assumption. Let us know.
feder
CC BY-SA 4.0
2019-10-06T14:29:19.000Z
Well, the intended question is more like "how to do this in practice". The internet usually responds vaguely with something like "use the macvlan cni driver", but I haven't found a proper detailed description so far.
LLlAMnYP
CC BY-SA 4.0
2019-10-06T15:00:37.903Z
@LLlAMnYP I hear you. I'll check at work. I'm certain rather sooner than later I run into this - and then I'll document it. Since I strongly believe it's consequent to allocate an IP address to every single service one has. This fosters the decoupling and isolation of service even more than just sharing an IP and the set services on ports. Of course, that decision depends on your network setup (available IPs), number of services, etc.
feder
CC BY-SA 4.0
2019-10-03T18:06:16.047Z
2019-10-04T14:03:32.790Z
2019-10-04T14:03:32.790Z
feder
<p><strong>Objective</strong>: Assign fixed IP address to Docker container (Unifi Controller instance).</p>

<p><strong>History</strong>: I fetched the <a href="https://hub.docker.com/r/jacobalberty/unifi" rel="nofollow noreferrer">unifi controller</a> image from Docker Hub to my Synology Docker host. The container of the unifi controller runs properly if I attach it to the network of the host (not the default bridge). That blocks though multiple ports I need for other services (in the future). Thus it would be much easier to assign that unifi container with it's own designated IP --> 192.168.2.2 (than changing all the ports).</p>

<p>I guess that is a cinch to deal with for most in here.</p>

<p><strong>Indications of my misconception</strong>:</p>

<ul>
<li>I created my own network in the Synology Docker GUI (with the subnet 192.168.2.0/23 and gateway 192.168.2.1)</li>
<li>I assigned it to a new unifi-controller container instance. </li>
<li>The GUI suggests to map the host ports with "auto" to the container ports, <strong>which indicates me that I do NOT understand completly the network concept</strong> of Docker. Because if I'm able to set an individual IP, why should it allow to map host ports (to container ports)?</li>
</ul>

<p><strong>Questions</strong>: </p>

<ul>
<li>Why can I not assign a fixed IP to the container in the GUI? </li>
<li>What am I conceptually missing?</li>
<li>If not in the GUI, how can I accomplish it over SSH/Bash?</li>
</ul>

<docker>
How can I assign an IP address to a docker container different from the host's IP?
feder
# How can I assign an IP address to a docker container different from the host's IP?

(Asked by: username_0 on 2019-10-03)

**Objective**: Assign fixed IP address to Docker container (Unifi Controller instance).

**History**: I fetched the [unifi controller](https://hub.docker.com/r/jacobalberty/unifi) image from Docker Hub to my Synology Docker host. The container of the unifi controller runs properly if I attach it to the network of the host (not the default bridge). That blocks though multiple ports I need for other services (in the future). Thus it would be much easier to assign that unifi container with it's own designated IP --> 192.168.2.2 (than changing all the ports).

I guess that is a cinch to deal with for most in here.

**Indications of my misconception**:

* I created my own network in the Synology Docker GUI (with the subnet 192.168.2.0/23 and gateway 192.168.2.1)
* I assigned it to a new unifi-controller container instance.
* The GUI suggests to map the host ports with "auto" to the container ports, **which indicates me that I do NOT understand completly the network concept** of Docker. Because if I'm able to set an individual IP, why should it allow to map host ports (to container ports)?

**Questions**:

* Why can I not assign a fixed IP to the container in the GUI?
* What am I conceptually missing?
* If not in the GUI, how can I accomplish it over SSH/Bash?

**Tags:** docker


---

## 1 answers

### Answer by username_0 on 2019-10-03. Score: 2 | Accepted answer

SOLUTION APPROACH
The approach is to create a macvlan. This will create a virtual adapter, that is allowed to lease an IP address from the subnet defined.
1) Activate Promiscous Mode
For the virtual adapter one must enable promiscuous mode in the network. For Unifi controllers, do a SSH to your gateway and set:
ifconfig [interface] promisc

Some network gateways/controllers have set promiscuous mode by default. Continue with step 2 before you're wasting time to find that out.
2) Create macvlan
Then one can create the macvlan.
$ docker network create -d macvlan \
  --subnet=192.168.2.0/23 \
  --ip-range=192.168.2.5/25 \
  --gateway=192.168.2.1 \
  --aux-address="my-router=192.168.2.10" \
  -o parent=eth0 unifinet


Limiting the IP range: use --ip-range to scope the possible IPs to lease.
Avoiding certain IPs: The --aux-address marks my Synology host, which should never ever battle for that IP address (It's marked in the unifi controller's DHCP service as a fixed IP anyways).
the -o parent is your network interface you want to attach your macvlan. In my case unifinet.

Check with docker network ls if the macvlan has been properly created.
NETWORK ID          NAME                DRIVER              SCOPE
c49094a4c914        bridge              bridge              local
b2315de1aa7e        host                host                local
c124eda0f9d2        none                null                local
a60da50f0d12        unifinet            macvlan             local

3) Start Docker Container
While you define the image (--name UnifiController jacobalberty/unifi) assign the freshly created macvlan (--network unifinet) to the container (UnifiController). It will grab the latest image respectively the latest Unifi Controller version available from Docker Hub.
docker run -dit --network unifinet --name UnifiController jacobalberty/unifi

Verify if the container has been assigned to the network in the container section of the JSON config.
sudo docker network inspect unifinet.

[
    {
        "Name": "unifinet",
        "Id": "a60da50f0d1229d1a3c76210141e0c81567c17daf6c2b49d4f1c83d5ec9f02b3",
        "Created": "2019-10-04T14:39:37.377311991+02:00",
        "Scope": "local",
        "Driver": "macvlan",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "192.168.2.0/24",
                    "Gateway": "192.168.2.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "b819bf1d6f3af459825a1a7b58f9a44e15e6e09489e7bf50653ed8e1e176fd73": {
                "Name": "UnifiController",
                "EndpointID": "41a048034ad63e48b46b58aed65661c9eaa2bf6937d3eebacefde4478ad26cce",
                "MacAddress": "02:42:c0:a8:02:02",
                "IPv4Address": "192.168.2.2/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "parent": "eth0"
        },
        "Labels": {}
    }
]

The IP 192.168.2.2 is assigned. The container workes properly and stable. 
4) Optional/Reminder
If the IP was not assigned respectively one cannot connect to it for any service, the follow up on the promiscious mode setting as described in Step 1.

> **Comments:**
> **username_1**: Is this possible when the container is launched by kubernetes?  
> **username_0**: @username_1 I see no reason why that should not be the case if you keep the macvlan up and assign it to the container. I bet it works. But that is merely an assumption. Let us know.  
> **username_1**: Well, the intended question is more like "how to do this in practice". The internet usually responds vaguely with something like "use the macvlan cni driver", but I haven't found a proper detailed description so far.  
> **username_0**: @username_1 I hear you. I'll check at work. I'm certain rather sooner than later I run into this - and then I'll document it. Since I strongly believe it's consequent to allocate an IP address to every single service one has. This fosters the decoupling and isolation of service even more than just sharing an IP and the set services on ports. Of course, that decision depends on your network setup (available IPs), number of services, etc.  

---

