VeilNet

Docker Hosts

Connect containers on one Docker host to a database and a queue on another host, with conflux on each host instead of Swarm or a Docker overlay network.

Needs
Two Linux hosts running Docker, with root access and outbound internet access
Uses
conflux proxy on host B, conflux up on host A

Before and After VeilNet

Use this setup when containers on one Docker host need services on another host, and you do not want to run Swarm or a service mesh.

Today, a Swarm overlay network or a service mesh connects the hosts. When the traffic is encrypted at all, mTLS or IPsec protects it with ECDHE and ECDSA, and a quantum computer can break both.

With VeilNet, conflux runs on each host, and the containers stay as they are. Services stay published on their host's loopback address. The containers that call them connect to an overlay address, as they would to any other address their host can reach.

Today and with VeilNetDocker

Today, mTLS, IPsec, ECDHE and ECDSA protect these links. A quantum computer can break all of them. With VeilNet, ML-DSA-87, ML-KEM-1024 and AES-256-GCM protect every link.

In this guide, host B runs the database and the queue, and host A runs the containers that call them. Conflux runs on each host, not in the containers.

Connecting the Hosts

0 of 5 done

  1. Install conflux on each host as a system service, not in a container. Follow Installation on each host.

On a sovereign network, the guardian commissions each host and issues its manifest. Install it with sudo conflux enrol --manifest FILE, then follow the same steps, running conflux proxy and conflux up without --taint, because the credential carries the taints. See Joining a sovereign network.

Verifying the Setup

From host A, query each service from a temporary container. You should see these replies:

host A
$ docker run --rm postgres:17 pg_isready -h 10.128.0.2 -p 5432
10.128.0.2:5432 - accepting connections
$ docker run --rm valkey/valkey:8 valkey-cli -h 10.128.0.2 -a 'change-me' --no-auth-warning ping
PONG

On host A, sudo conflux peers lists host B with DATA yes. On host B, sudo conflux anchorctl proxy lists each published port with its live, opened and failed connections, and the last error from its backend.

Reference

ConfluxPublishing ServicesProxy specs, how to change them while conflux runs, and how to publish from a host with an interface.ConfluxProxy and TUN ModesWhat each mode gives the host, and how to switch between them.GuideKubernetes ClustersRun conflux without privileges in a container, in proxy mode.Anchor protocolRun ModesInterface, userspace and reverse-proxy modes, and which of them need privileges.