[MESOS-2044] Use one IP address per container for network isolation

• Type: Epic
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Labels: mesosphere
• Epic Name: per-container ip
• Story Points: 40
• Assignee: Unassigned
• Reporter: Cong Wang
• Created: 04/Nov/14 22:39
• Updated: 24/Jul/17 23:03
• Resolved: 24/Jul/17 23:03

Description

If there are enough IP addresses, either IPv4 or IPv6, we should use one IP address per container, instead of the ugly port range based solution. One problem with this is the IP address management, usually it is managed by a DHCP server, maybe we need to manage them in mesos master/slave.

Also, maybe use macvlan instead of veth for better isolation.

Issue Links

• is duplicated by: MESOS-1909 Network monitoring and isolation using macvlan.
• is related to: MESOS-2728 Introduce concept of cluster wide resources.
• is related to: MESOS-2999 Implement a linux/iptables isolator
• relates to: MESOS-3333 Allow executors to create nested containers.
• relates to: MESOS-1027 IPv6 support