Host Network Configuration

The default "full" images include NetworkManager. Unless otherwise configured, Fedora/CentOS bootc will attempt DHCP on every interface with a cable plugged in.

However, if you need to use static addressing or more complex networking (vlans, bonds, bridges, teams, etc.), you can do so in a number of ways which are summarized below. Regardless of the way you choose to configure networking it all ends up as configuration for NetworkManager, which takes the form of NetworkManager keyfiles. More information on the keyfile format can be found here. More information on the subsection options for keyfiles can be found here.

Complex networking configuration often also requires per-machine state. It is of course possible to generate machine-specific container images that have e.g. static IP addressing included. Another pattern is to include code to generate network configuration from inside the image by inspecting the host’s MAC address.

nmcli, the NetworkManager command line tool, provides an "offline" mode that doesn’t talk with the NetworkManager daemon and just writes the keyfile content to standard output. Run the tool for each connection profile you want to create:

See the settings man page for a list of the properties that can be specified via nmcli. Bash autocompletion is available.

NetworkManager ships a tool, nm-initrd-generator, that can generate keyfiles from dracut kernel argument syntax. This might be a good way to either convert from kernel arguments to keyfiles or to just quickly generate some keyfiles giving a small amount of input and then tweak some more detailed settings.

Here’s an example of generating keyfiles for a bond via nm-initrd-generator:

This run generates three keyfiles. One for bond0, one for ens3, and one for ens2. You can take the generated output, add more settings or tweak existing settings, and then commit the files into a container image.

It’s recommended to store NetworkManager configuration embedded in container images in /usr/lib/NetworkManager/system-connections/ because this forms part of the immutable image state.

You can also write configuration to /etc/NetworkManager/system-connections/ as part of the container image; the default OSTree "3 way merge" will apply with any machine-specific configuration.

The keyfiles must have root-only access permissions (600), otherwise NetworkManager will ignore them.

By default, NetworkManager will attempt to autoconfigure (DHCP/SLAAC) on every interface with a cable plugged in. In some network environments this may not be desirable. It’s possible to change this behavior of NetworkManager with a configuration file dropin to e.g. /usr/lib/NetworkManager/conf.d/noauto.conf.