Skip to content

Bind a Container to an OVN Switch

Standard LXD networks are great for single-host containers. For multi-tenant or multi-host workloads bind the container to an OVN logical switch so it picks up the tenant's IPAM, security groups, and L3 routing automatically.

Prerequisites

Quick steps

  1. Containers → ➕ New Container.
  2. Fill the basic fields as usual (Name / Host / Image / CPU / RAM).
  3. Set Network to None (no NIC) — the OVN binding will plumb the NIC itself, not LXD's network driver.
  4. Expand the OVN binding section:
  5. IPAM Pool — dropdown shows every pool. Pools without a bound switch are flagged "(no OVN switch — IPAM only)" so you don't accidentally pick one that won't reach the network.
  6. MAC — leave blank to auto-generate one in the LXD OUI range (00:16:3e:xx:xx:xx). Or paste a specific MAC.
  7. Static IP (optional) — request a specific IP from the pool. Leave blank to take the next free.
  8. Create.

The success toast confirms the OVN port binding: "Container 'webapp-01' queued for creation. OVN port lsp-webapp-01 bound, IP 10.50.10.42, MAC 00:16:3e:a4:7c:91."

What happens

  1. Master allocates an IPAM lease (ip_leases row with status='active').
  2. Picks/validates the MAC.
  3. Enqueues the LXD create task on the host's worker queue.
  4. As a fire-and-forget BackgroundTask runs ovn-nbctl lsp-add lsp-<name> on an OVN host — the LSP exists in OVN's NB DB before the container's NIC even comes up. When the NIC appears (LXD assigns the MAC inside the container), OVN binds the port and traffic starts flowing.

Inspect

ovn-nbctl show               # tree — find lsp-<name>
ovn-nbctl lsp-list <switch>  # ports on the switch
ovn-sbctl show               # which chassis the port is bound to

From inside the container:

ip a                         # NIC should have the MAC + IP MFCloud assigned
ip route                     # default via the switch's gateway IP

Removing the binding

Delete the container the usual way (Containers → row → Delete). The matching lsp-* port is removed from OVN and the IPAM lease is released — both happen as BackgroundTasks after the DELETE returns, so the UI is responsive even if OVN is briefly unreachable (non-fatal — task logs the error).

See also