How do I give a docker container its own routable IP on the original network?

Question

Main question

Imagine this scenario.

• A network of 192.168.0.0/24.
• A computer with hostname 'Docker-Host' is running a docker engine at 192.168.0.2
• 'Docker-Host' has sshd server running
• On 'Docker-Host' , I'm running a application in a container that uses ssh:22 and https:443 (GitLab)

How do I assignee this container an IP of 192.168.0.3?

I need services to run on their designed default ports.

---

Additional Information

I cannot use a reverse proxy as a solution because that does not solve the problem of how to communicate with the GitLab instance over SSH.

Mapping the port 22 to a different port on the host is unprofessional in this situation, and my client developers would not like the setup.

This also would be a struggle to maintain if I was spinning up many instances of this application. and had to keep mapping each SSH to a new port on the host for each container.

My clients need to be able to resolve and run the following without additional configuration client side.

https://GitLab.internal.net.work

ssh git clone https://GitLab.internal.net.work

I have reviewed the Docker Network Documention, and unless I'm mistaken, I don't see a easy maintainable solution (although I'm still new to Docker).

How can this be done? What are other people doing in this situation as 'best practice'? (if possible, give answers in form of docker-compose syntax).

Solution

This tends to be an anti-pattern in the container space. One common solution instead of externally accessing the container directly, is to setup a load balancer per IP that you need to expose, and that load balancer maps a well known port to the unique port. In the cloud space, this is often cheaper than allocating multiple VM's with different IP's.

---

You can publish directly to a single IP address with docker. e.g.:

docker run -p 192.168.0.3:22:22 sshd

This requires that the host have each of the IP addresses configured which has been described in other SE Q&A's.

---

If you still need the original request, directly exposing the container, you can use macvlan or ipvlan network drivers to give the container an externally reachable IP. I tend to avoid this since it's often the symptom of trying to manage a container as if it is a VM. Documentation on macvlan is at: https://docs.docker.com/network/macvlan/

Comments

[Michael Hampton]

As shown in docs.gitlab.com/omnibus/docker/… they are forwarding port 22 to GitLab ssh. This means the host ssh has to be run on a different port.

[TrevorKS]

And what if I needed to set up a second gitlab server? Or anything that requires another conflicting port? There must be a way to assign these containers IPs.