How to Put Containers on Your VLANs With Docker macvlan

Step by step

1. Configure the switch port

   Make the edge server's switch port a trunk that carries the VLANs the containers need, for example 30 (CCTV) and 40 (IoT).

2. Create the macvlan network

   Docker creates the VLAN sub-interface (eth0.30) for you. Reserve an IP range that your DHCP server does not hand out.

   docker network create -d macvlan \
     --subnet 10.1.30.0/24 --gateway 10.1.30.1 \
     --ip-range 10.1.30.224/28 \
     -o parent=eth0.30 cctv30
   

3. Attach a container

   Give the container a fixed address in the reserved range.

   docker run -d --name analytics --restart unless-stopped \
     --network cctv30 --ip 10.1.30.230 \
     ghcr.io/example/video-analytics:1.8.0
   

4. Allow host-to-container traffic

   By design the host cannot talk to its own macvlan containers. Add a small macvlan shim interface on the host if it needs to.

   ip link add cctv-shim link eth0.30 type macvlan mode bridge
   ip addr add 10.1.30.239/32 dev cctv-shim
   ip link set cctv-shim up
   ip route add 10.1.30.224/28 dev cctv-shim
   

5. Firewall the VLAN

   The container is now a normal host on VLAN 30, so the gateway's inter-VLAN rules apply to it like any camera or NVR.

6. Document

   Add the container IPs to your IP plan so nobody assigns them twice.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.