I'm trying to build a Docker-based network simulation for testing subnet-aware tunnel behavior. I know a Docker network can use a custom IPAM subnet, and individual containers can be given fixed IPv4 addresses. However, I'm not sure how to handle replicated services.
For example, I might want one group of replicas to use addresses from 10.0.0.0/16 and another group to use 10.53.0.0/16, or ideally have replicas receive addresses that appear scattered across multiple ranges. Is there a Docker or Docker Compose configuration that assigns replicas from specific subnets, rather than allocating them sequentially from one network's address pool?
I initially considered publicly routable addresses for an ephemeral network simulation, but private RFC1918 ranges are also fine. The main requirement is to distribute containers across multiple subnets for testing, not to expose them to the public Internet.
2 Answers
For an I2P test network, it may be easier and safer to modify the testnet behavior of the routers so they simulate peers in different private subnets. Docker itself is not designed to make one replicated service draw arbitrary addresses from multiple disconnected pools. You could create one network per simulated subnet and deploy the desired number of containers to each, or build a custom IPAM solution that assigns addresses during deployment.
Don’t use publicly routable address space for an internal Docker simulation. Use private RFC1918 ranges instead: 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. Docker’s normal bridge IPAM allocates addresses from the configured subnet, so it won’t randomly place replicas across unrelated ranges. In practice, create separate Docker networks for the subnets you want and attach each service or replica group to the appropriate network. If you need automatic allocation across many pools, you would need custom orchestration or an IPAM plugin.
Separate networks make sense for different replica groups, but I need the containers to appear in several ranges at once—for example, some in 10.0.0.0/16 and others in 10.53.0.0/16. Is there a way to automate that rather than assigning every container manually?
I’m testing a mix of i2pd and I2P implementations. The exact choice between public and private addresses isn’t the important part; I need to distribute replicas across ranges such as 10.0.0.0/16 and 10.53.0.0/16. The separate-network approach seems like the most practical option.