<commit_before># Networking

On some of rkt's subcommands *([run](subcommands/run.md), [run-prepared](subcommands/run-prepared.md))*, the `--net` flag allows you to configure the pod's network.
The various options can be grouped by two categories:

* [host mode](#host mode)
* [contained mode (default)](#contained mode)

## Host mode
When `--net=host` is passed the pod's apps will inherit the network namespace of the process that is invoking rkt.

If rkt is directly called from the host the apps within the pod will share the network stack and the interfaces with the host machine.
This means that every network service that runs in the pod has the same connectivity as if it was started on the host directly.

## Contained mode
If anything other than `host` is passed to `--net=`, the pod will live in a separate network namespace with the help of [CNI](https://github.com/appc/cni) and its plugin system.
The network setup for the pod's network namespace depends on the available CNI configuration files that are shipped with rkt and also configured by the user.

### Network selection
Every network must have a unique name and can only be joined once by every pod.
Passing a list of comma separated network as in `--net=net1,net2,net3,...` tells rkt which networks should be joined.
This is useful for grouping certain pod networks together while separating others.
There is also the possibility to load all configured networks by using  `--net=all`.

### Builtin networks
rkt ships with two built in networks, named *default* and *default-restricted*.


### The default network
The *default* network is loaded automatically in three cases: 
* `--net` is not present on the command line
* `--net` is passed with no options
* `--net=default`is passed

It consists of a loopback device and a veth device.
The veth pair creates a point-to-point link between the pod and the host.
rkt will allocate an IPv4 address out of 172.16.28.0/24 for the pod's veth interface.
It will additionally set the default route in the pod namespace.
Finally, it will enable IP masquerading on the host to NAT the egress traffic.

**Note**: The default network must be explicitly listed in order to be loaded when `--net=n1,n2,...` is specified with a list of network names.

Example: If you want default networking and two more networks you need to pass `--net=default,net1,net2`.

### The default-restricted network
The *default-restricted* network does not set up the default route and IP masquerading.
It only allows communication with the host via the veth interface and thus enables the pod to communicate with the metadata service which runs on the host.
If *default* is not among the specified networks, the *default-restricted* network will be added to the list of networks automatically.
It can also be loaded directly by explicitly passing `--net=default-restricted`.
The special alias network name ***none*** (`--net=none`) will effectively load the *default-restricted* network to always guarantee access to the metadata service that runs on the host.


### Setting up additional networks
In addition to the default network (veth) described in the previous sections, rkt pods can be configured to join additional networks.
Each additional network will result in an new interface being setup in the pod.
The type of network interface, IP, routes, etc is controlled via a configuration file residing in `/etc/rkt/net.d` directory.
The network configuration files are executed in lexicographically sorted order. Each file consists of a JSON dictionary as shown below:

```sh
$ cat /etc/rkt/net.d/10-containers.conf
{
	"name": "containers",
	"type": "bridge",
	"ipam": {
		"type": "host-local",<commit_msg>docs/net: cover none networking changes<commit_after># Networking

On some of rkt's subcommands *([run](subcommands/run.md), [run-prepared](subcommands/run-prepared.md))*, the `--net` flag allows you to configure the pod's network.
The various options can be grouped by two categories:

* [host mode](#host mode)
* [contained mode (default)](#contained mode)

## Host mode
When `--net=host` is passed the pod's apps will inherit the network namespace of the process that is invoking rkt.

If rkt is directly called from the host the apps within the pod will share the network stack and the interfaces with the host machine.
This means that every network service that runs in the pod has the same connectivity as if it was started on the host directly.

## Contained mode
If anything other than `host` is passed to `--net=`, the pod will live in a separate network namespace with the help of [CNI](https://github.com/appc/cni) and its plugin system.
The network setup for the pod's network namespace depends on the available CNI configuration files that are shipped with rkt and also configured by the user.

### Network selection
Every network must have a unique name and can only be joined once by every pod.
Passing a list of comma separated network as in `--net=net1,net2,net3,...` tells rkt which networks should be joined.
This is useful for grouping certain pod networks together while separating others.
There is also the possibility to load all configured networks by using  `--net=all`.

### Builtin networks
rkt ships with two built in networks, named *default* and *default-restricted*.


### The default network
The *default* network is loaded automatically in three cases: 
* `--net` is not present on the command line
* `--net` is passed with no options
* `--net=default`is passed

It consists of a loopback device and a veth device.
The veth pair creates a point-to-point link between the pod and the host.
rkt will allocate an IPv4 address out of 172.16.28.0/24 for the pod's veth interface.
It will additionally set the default route in the pod namespace.
Finally, it will enable IP masquerading on the host to NAT the egress traffic.

**Note**: The default network must be explicitly listed in order to be loaded when `--net=n1,n2,...` is specified with a list of network names.

Example: If you want default networking and two more networks you need to pass `--net=default,net1,net2`.

### The default-restricted network
The *default-restricted* network does not set up the default route and IP masquerading.
It only allows communication with the host via the veth interface and thus enables the pod to communicate with the metadata service which runs on the host.
If *default* is not among the specified networks, the *default-restricted* network will be added to the list of networks automatically.
It can also be loaded directly by explicitly passing `--net=default-restricted`.

### No (loopback only) networking
The passing of `--net=none` will put the pod in a network namespace with only the loopback networking.
This can be used to completely isolate the pods network.

### Setting up additional networks
In addition to the default network (veth) described in the previous sections, rkt pods can be configured to join additional networks.
Each additional network will result in an new interface being setup in the pod.
The type of network interface, IP, routes, etc is controlled via a configuration file residing in `/etc/rkt/net.d` directory.
The network configuration files are executed in lexicographically sorted order. Each file consists of a JSON dictionary as shown below:

```sh
$ cat /etc/rkt/net.d/10-containers.conf
{
	"name": "containers",
	"type": "bridge",
	"ipam": {
		"type": "host-local",
{'fraction_non_alphanumeric': 0.07171689989235737, 'fraction_numerical': 0.005382131324004306, 'mean_word_length': 4.44941348973607, 'pattern_counts': {'":': 8, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3682257', 'n_tokens_mistral': 1946, 'n_tokens_neox': 1847, 'n_words': 1102}