Packet communication between container data compute nodes and a managed forwarding element

1. A method of communicating packets in a physical host, the physical host comprising a managed forwarding element (MFE) configured to communicate packets to a set of containers in a data compute node (DCN) hosted by the physical host, the method comprising:

receiving a packet from a particular container in the DCN, the packet comprising a tag that comprises an identification of the particular container;

using the identification of the particular container included in the tag to identify a port of the MFE that corresponds to the particular container;

removing the tag from the packet; and

forwarding the un-tagged packet to the port of the MFE that corresponds to the particular container.

2. The method of claim 1 , wherein receiving the packet from the particular container comprises intercepting the packet by a dispatching filter, wherein identifying the port of the MFE that corresponds to the particular container comprises searching a mapping table that maps identifications of containers to corresponding MFE ports by the dispatching filter.

3. The method of claim 1 , wherein the MFE is a flow-based MFE that utilizes a set of match action criteria to dispatch packets, wherein using the identification of the particular container included in the tag to identify the port of the MFE that corresponds to the particular container comprises:

utilizing a match criteria by the MFE to determine identification of the particular container included in the tag; and

utilizing a corresponding action criteria by the MFE to identify the port of the MFE that corresponds to the particular container.

4. The method of claim 1 further comprising:

at the MFE, receiving a second packet addressed to the particular container;

determining the port of the MFE that corresponds to the particular container based on a media access control (MAC) address of the container included in the received second packet;

tagging the second packet with the identification of the particular container; and

sending the tagged second packet to a virtual network interface card (VNIC) of the DCN.

5. The method of claim 1 further comprising:

at the MFE, receiving a second packet addressed to the particular container;

determining the port of the MFE that corresponds to the particular container based on at least one of a destination virtual local area network identification (VLAN ID) and destination Virtual eXtensible LAN network identification (VXLAN VNI) included in the received second packet;

tagging the second packet with the identification of the particular container; and

sending the tagged second packet to a virtual network interface card (VNIC) of the DCN.

6. The method of claim 1 , wherein the identification of the particular container comprises a virtual local area network identifier (VLAN ID) that uniquely identifies the particular container.

7. The method of claim 1 , wherein the DCN is a virtual machine (VM).

8. A non-transitory machine readable medium storing a program for communicating packets in a physical host, the physical host comprising a managed forwarding element (MFE) configured to communicate packets to a set of containers in a data compute node (DCN) hosted by the physical host, the program executable by a processing unit, the program comprising sets of instructions for:

receiving a packet from a particular container in the DCN, the packet comprising a tag that comprises an identification of the particular container;

using the identification of the particular container included in the tag to identify a port of the MFE that corresponds to the particular container;

removing the tag from the packet; and

forwarding the un-tagged packet to the port of the MFE that corresponds to the particular container.

9. The non-transitory machine readable medium of claim 8 , wherein the set of instructions for receiving the packet from the particular container comprises a set of instructions for intercepting the packet by a dispatching filter, wherein the set of instructions for identifying the port of the MFE that corresponds to the particular container comprises a set of instructions for searching a mapping table that maps identifications of containers to corresponding MFE ports by the dispatching filter.

10. The non-transitory machine readable medium of claim 8 , wherein the MFE is a flow-based MFE that utilizes a set of match action criteria to dispatch packets, wherein the set of instructions for using the identification of the particular container included in the tag to identify a port of the MFE that correspond to the particular container comprises sets of instructions for:

utilizing a match criteria by the host MFE to determine identification of the particular container included in the tag; and

utilizing a corresponding action criteria by the host MFE to identify the port of the MFE that correspond to the particular container.

11. The non-transitory machine readable medium of claim 8 , the program further comprising sets of instructions for:

receiving, at the MFE, a packet addressed to the particular container;

determining the port of the MFE that corresponds to the particular container based on a media access control (MAC) address of the container included in the received packet;

tagging the packet with an identification of the particular container; and

sending the tagged packet to a virtual network interface card (VNIC) of the DCN.

12. The non-transitory machine readable medium of claim 8 , the program further comprising sets of instructions for:

receiving, at the MFE, a packet addressed to the particular container;

determining the port of the MFE that corresponds to the particular container based on at least one of a destination virtual local area network identification (VLAN ID) and destination Virtual eXtensible LAN network identification (VXLAN VNI) included in the received packet;

tagging the packet with an identification of the particular container; and

sending the tagged packet to a virtual network interface card (VNIC) of the DCN.

13. The non-transitory machine readable medium of claim 8 , wherein the identification of the particular container comprises a virtual local area network identifier (VLAN ID) that uniquely identifies the particular container.

14. The non-transitory machine readable medium of claim 8 , wherein the DCN is a virtual machine (VM).

15. A system comprising:

a set of processing units; and

a non-transitory machine readable medium storing a program for communicating packets in a physical host, the physical host comprising a managed forwarding element (MFE) configured to communicate packets to a set of containers in a data compute node (DCN) hosted by the physical host, the program executable by a processing unit in the set of processing units, the program comprising sets of instructions for:

receiving a packet from a particular container in the DCN, the packet comprising a tag that comprises an identification of the particular container;

using the identification of the particular container included in the tag to identify a port of the MFE that corresponds to the particular container;

removing the tag from the packet; and

forwarding the un-tagged packet to the port of the MFE that corresponds to the particular container.

16. The system of claim 15 , wherein the set of instructions for receiving the packet from the particular container comprises a set of instructions for intercepting the packet by a dispatching filter, wherein the set of instructions for identifying the port of the MFE that corresponds to the particular container comprises a set of instructions for searching a mapping table that maps identifications of containers to corresponding MFE ports by the dispatching filter.

17. The system of claim 15 , wherein the MFE is a flow-based MFE that utilizes a set of match action criteria to dispatch packets, wherein the set of instructions for using the identification of the particular container included in the tag to identify a port of the MFE that correspond to the particular container comprises sets of instructions for:

utilizing a match criteria by the host MFE to determine identification of the particular container included in the tag; and

utilizing a corresponding action criteria by the host MFE to identify the port of the MFE that correspond to the particular container.

18. The system of claim 15 , the program further comprising sets of instructions for:

receiving, at the MFE, a packet addressed to the particular container;

determining the port of the MFE that corresponds to the particular container based on a media access control (MAC) address of the container included in the received packet;

tagging the packet with an identification of the particular container; and

sending the tagged packet to a virtual network interface card (VNIC) of the DCN.

19. The system of claim 15 , the program further comprising sets of instructions for:

receiving, at the MFE, a packet addressed to the particular container;

determining the port of the MFE that corresponds to the particular container based on at least one of a destination virtual local area network identification (VLAN ID) and destination Virtual eXtensible LAN network identification (VXLAN VNI) included in the received packet;

tagging the packet with an identification of the particular container; and

sending the tagged packet to a virtual network interface card (VNIC) of the DCN.

20. The system of claim 15 , wherein the identification of the particular container comprises a virtual local area network identifier (VLAN ID) that uniquely identifies the particular container.

21. The system of claim 15 , wherein the DCN is a virtual machine (VM).