docker --net and firejail --net cant use the same interface simultaneously?

[slowpeek]

In my network there are two gateways:

• x.x.x.1 = a router connected to the ISP
• x.x.x.2 = a node routing traffic through a vpn

The router advertises x.x.x.2 as the default gateway over DHCP.

When I need to bypass the default gw and send traffic directly through the router, I usually use firejail. For example:

firejail --net=eth0 --defaultgw=x.x.x.1 --dns=x.x.x.1 curl icanhazip.com

When I need to run a docker container over a direct connection, I use

docker run --net direct ..

where the direct net was previously created like:

docker network create --driver ipvlan --subnet x.x.x.0/24 --gateway x.x.x.1 -o parent=eth0 direct

Both ways work fine by themselves. But having a docker container with --net direct running I tried to run the above mentioned firejail command and got such output:

RTNETLINK answers: Device or resource busy
Error: failed to run /usr/lib/x86_64-linux-gnu/firejail/fnet, exiting...
Error ioctl: interface.c:100 net_if_up: No such device
Error: failed to run /run/firejail/lib/fnet, exiting...
Error: proc 62826 cannot sync with peer: unexpected EOF
Peer 62827 unexpectedly exited with status 1

Should it be like that? What is the problem?

[kmk3]

docker --net and firejail --net cant use the same interface simultaneously?

It might be because firejail --net= always creates a new network namespace.

Does docker run --net do the same?

See this part from network_namespaces(7):

A physical network device can live in exactly one network namespace. When a
network namespace is freed (i.e., when the last process in the namespace
terminates), its physical network devices are moved back to the initial
network namespace (not to the namespace of the parent of the process).

A virtual network (veth(4)) device pair provides a pipe-like abstraction that
can be used to create tunnels between network namespaces, and can be used to
create a bridge to a physical network device in another namespace. When a
namespace is freed, the veth(4) devices that it contains are destroyed.

Maybe veth(4) devices are needed?

[slowpeek]

It looks like they do something different, yet it does clash.

When I run firejail --net=enp42s0 --defaultgw=x.x.x.1 --dns=x.x.x.1 bash there is such message in dmesg:

device enp42s0 entered promiscuous mode

When I exit the sandbox, it says

device enp42s0 left promiscuous mode

When I start a docker container with --net direct, it says

eth0: renamed from veth82e4b98

When the container stops, it says

veth82e4b98: renamed from eth0

If the sandbox is running and I try to start a container, it says

r8169 0000:2a:00.0 enp42s0: Device is already in use.

If I do the reverse, nothing appears in dmesg but firejail says

RTNETLINK answers: Device or resource busy
Error: failed to run /usr/lib/x86_64-linux-gnu/firejail/fnet, exiting...
Error ioctl: interface.c:100 net_if_up: No such device
Error: failed to run /run/firejail/lib/fnet, exiting...
Error: proc 33791 cannot sync with peer: unexpected EOF
Peer 33792 unexpectedly exited with status 1