Separate IP for Nextcloud container

[Faebu93]

Hi,

I want to run my Nextcloud AIO container with a separate IP, so that the hosts IP is free for other services. For this I thought to use a docker network with the ipvlan driver.

Two questions:

• Is it safe to use Nextcloud AIO with an ipvlan network (no other unprotected ports opened to the local network)?
• Is this the recommended/best way to achieve a separate IP for the Nextcloud container? Any other/better approaches?

Bonus question: I can't reach the container from my host via it's IPv6 interface and vice versa, it says no route. Connecting via the IPv4 address or from another client in my network via any address works perfectly fine. It seems that the neighbour announcements of host/container don't reach each other. If someone happens to know how to resolve this I'm happy to hear it.

Thank you so much!

My docker compose file (adapted from the docker compose file in the repository, IPv6 address changed):

services:
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
    networks:
      nextcloud-ext-ipvlan:
        ipv6_address: 1f97:1bc1:e360:0195::7
    environment:
      NEXTCLOUD_ENABLE_DRI_DEVICE: "true"
      NEXTCLOUD_ADDITIONAL_APKS: imagemagick bash ffmpeg libva-utils libva-vdpau-driver libva-intel-driver intel-media-driver mesa-va-gallium
      AIO_COMMUNITY_CONTAINERS: memories fail2ban
      NEXTCLOUD_MOUNT: /srv/nc-data-no-bkp
      NEXTCLOUD_DATADIR: /srv/nc-data
volumes: # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work
networks:
  nextcloud-ext-ipvlan:
    driver: ipvlan
    driver_opts:
      parent: enp0s31f6
    ipam:
      config:
        - subnet: 1f97:1bc1:e360:0195::/64
          gateway: 1f97:1bc1:e360:0195::1
    enable_ipv6: "true"

I am on Ubuntu 22, this is the output of docker info:

Client: Docker Engine - Community
 Version:    27.3.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.17.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.29.7
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 16
  Running: 4
  Paused: 0
  Stopped: 12
 Images: 9
 Server Version: 27.3.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: journald
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 57f17b0a6295a39009d861b89e3b3b87b005ca27
 runc version: v1.1.14-0-g2c9f560
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 5.15.0-125-generic
 Operating System: Ubuntu 22.04.4 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 15.02GiB
 Name: mf-srv
 ID: 4c795dcc-4588-40a8-8ff4-dc8a736e3527
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled

[szaimen]

Hi, I fear this is not going to work as you think. You might want to create the nextcloud-aio network beforehand which all containers are going to be joined to. You can customize that network if you need custom options.

[Faebu93]

Hi Simon,

thanks for the answer! Actually this makes sense, I assume the AIO container publishes the required ports (in particular 443) itself via calls to the docker socket. Thus I would have to mess with the nextcloud-aio network and maybe AIO itself, which is just not worth it I guess.
Setting the option com.docker.network.bridge.host_binding_ipv4 on the nextcloud-aio option might work, but I want to enable both IPv4 and IPv6 connectivity, thus I would have to choose or setup the iptables forwarding rules myself I guess. Again, not really worth it.

Thanks again!