Following One Flow from Host into Custom Node Image

Overview

This article walks through the packet flow from the host into a custom node image, explains how health checks can report success while the actual lab datapath is still broken, and provides troubleshooting steps and CLI examples.

Host and Custom Node Image

• Host: Linux kernel ≥ 5.10 running Containerlab.
• Custom node image (built from a minimal base, e.g., ubuntu:22.04) includes:
  • FRR suite for routing protocols.
  • A lightweight web server (nginx or python3 -m http.server) bound only to the management interface for health checks.
  • An entrypoint that creates two network namespaces:
    • mgmt – for CLI/API traffic.
    • data – for the lab datapath.
  • Two veth pairs:
    • Management veth (veth-mgmt-host ↔ veth-mgmt-ns) attached to Containerlab’s management bridge (clab-mgmt).
    • Data veth (veth-data-host ↔ veth-data-ns) attached to a lab‑specific bridge (Linux bridge or OVS).

The packet we follow originates on the host, destined for the node’s data plane address 10.0.0.10/24 via the data interface:

host (eth0) → veth-data-host → lab bridge → veth-data-ns → data namespace → application socket

Management Bridge and Namespace Wiring

Containerlab creates a Linux bridge named clab-mgmt on the host. For each node:

• The management veth host end (veth-mgmt-host) is enslaved to clab-mgmt.
• The peer (veth-mgmt-ns) is moved into the node’s mgmt namespace and assigned an IP from the 172.20.20.0/24 pool (e.g., 172.20.20.10/24).
• The bridge provides L2 connectivity between host and all node management interfaces, DHCP/static IP assignment via Containerlab’s internal DHCPd, and isolates data‑plane traffic by namespace.

Data Interfaces and Lab Datapath

For each data interface, Containerlab creates a second veth pair (veth-data-host ↔ veth-data-ns):

• Host end attached to a lab bridge (Linux bridge br0 or OVS ovs-br0).
• Peer placed in the node’s data namespace and configured with the lab address (10.0.0.10/24).

Health checks target the management address (172.20.20.10) and never enter the data namespace.

Health Check Mechanisms

Types

1. ICMP echo to the management IP (ping -c 3 172.20.20.10).
2. TCP connect to a listening port on the management interface (nc -z 172.20.20.10 8080).
3. HTTP GET to a health endpoint (curl -s -o /dev/null -w "%{http_code}" http://172.20.20.10:8080/health).
4. Scripted check inside the mgmt namespace returning 0/1.

All rely solely on the management bridge