Looking for advice on Docker networking / multiple Compose stacks + selective egress.
I’m rebuilding the networking on my Docker host (LeopARRd) and would appreciate some architectural advice.
My requirements are:
– ALL services must be reachable on my network by one of the host IP (the host has one on VLAN-10 and one on VLAN-30)
– Two independent Compose projects (2 different compose.yaml files), but containers from both projects must communicate using container/service names, e.g. http://navidrome, rather than hard-coded IPs.
– Some services need Internet egress through 192.168.30.1 (a VPN gateway on 192.168.30.0/24)
– Other services need normal Internet egress through 192.168.10.1
– Ideally, the solution should survive container/host restarts and be reasonably easy to maintain.
My current approach is to create Docker networks corresponding to VLANs 31 and 32–33 (one per composer, defined in the composer as bridge/ipam), with policy routing and two different masquerades to select the appropriate gateway
It mostly works, but I’m running into issues with:
- policy-routing routes and their persistence;
- /etc/iproute2/rt_tables not being persistent as currently configured;
- containers on 192.168.31.0/24 being unreachable from the other Docker VLANs when addressed by hostname/service name (while direct access using their actual IP works).
I suspect I may be overcomplicating this and would be happy to redesign it rather than keep patching the current setup.
What would be the cleanest Docker networking architecture for these requirements? I’m particularly interested in solutions that minimize custom routing/iptables maintenance while retaining service-name DNS between the two Compose projects. Ideally I’d rather prefer to have all networking settings specified in each individual composer file
Source: r/docker · by /u/lucads87