Management¶

Each lab is assigned a management network with a unique IPv4 and IPv6 prefix. Management networks are implemented as a Libvirt NAT network with some differences. Containers join the same bridge, brm-<lab-id>, through a Docker bridge network.

Spanning tree is off on the management bridge, so a node's management interface forwards as soon as it is attached, and nodes receive no STP BPDUs on it. A lab created before Sherpa 0.4.14 keeps spanning tree on, and each new management interface in it passes no traffic for its first four seconds, until the lab is destroyed and created again.

The allocated network acts as a NAT router and upstream DNS forwarder. The DHCP and DNS functions for the lab are performed by a lab-router container instance.

Management network: the brm bridge with source NAT to the host uplink, shared by a Docker bridge network for the lab router, Tailscale gateway and containers, and a libvirt NAT network for VMs and unikernels

Lab Router¶

Each lab management network has a dedicated lab router. The lab router runs the following services.

DHCP¶

A DHCP server with a range covering the lab node block, offsets 21 to 254. Each node has a reservation for its own address in that range. See IP addressing.

DNS¶

A DNS service with the domain name sherpa.lab.local. Each node has a forward and reverse DNS entry allocated in DNS. Nodes can be looked up via the hostname and FQDN.

Access through Tailscale¶

An optional [tailscale] manifest section creates a dedicated subnet router on the lab's management network. It advertises that lab's IPv4 and optional IPv6 management prefixes to the owner's tailnet. The gateway uses address offset 3 in each prefix, below the node allocation range.

Remote clients connect to the node management IPs shown by sherpa inspect after the routes are approved and tailnet access policy allows them. Generated SSH configurations continue to use the configured Sherpa jump host.

See Tailscale setup, lifecycle, and recovery.