Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Docker Application Management using IPv6 Address

Updated: June 12, 2026

Want to summarize with AI?

Explains how Docker applications are managed using IPv6 addressing schemes, including configuration and operational details.

A Docker application is a software workload hosted within a container that

is managed through virtual routing and forwarding (VRF) instances
enables seamless integration across network namespaces within the host system, and
supports both IPv4 and IPv6 management interfaces for enhanced accessibility.

Table 1. Feature History Table
Feature Name	Release Information	Description
Docker Application Management using IPv6 Address	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
Docker Application Management using IPv6 Address	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
Docker Application Management using IPv6 Address	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is now supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
Docker Application Management using IPv6 Address	Release 7.11.1	In this release, you gain the ability to manage Docker applications within containers using IPv6 addresses via the router's management interface. Leveraging IPv6 addresses provides expanded addressing options, enhances network scalability, and enables better segmentation and isolation of applications within the network. Prior to this update, only IPv4 addresses could be used to manage docker applications.

The Application Manager in IOS-XR software release 7.3.15 introduces application networking that enables traffic forwarding between VRF instances using a relay agent deployed inside an independent Docker container. The relay agent acts as a bridge, connecting two network namespaces within the host system and actively transferring traffic between them. Configuration permits forwarding between either a single pair or multiple pairs of ports according to network requirements.

A primary use case is managing Linux-based Docker applications running in the default VRF through a management interface located in a separate VRF. This allows application management to occur seamlessly across VRF boundaries.

Starting with IOS-XR software release 7.11.1, management capabilities are enhanced: Docker applications hosted within containers can now be managed using IPv6 addresses via the Cisco 8000 router's management interface. This update improves accessibility and control compared to earlier versions that only supported IPv4 address management.

Consider a scenario where you need to manage Docker applications in the default VRF from a distinct management VRF. With IPv6 integration, you can access applications through their IPv6 addresses for configuration and monitoring, leveraging the Cisco 8000 router management interface.

Restrictions and limitations

The Virtual Routing and Forwarding (VRF) is only supported for Docker apps with host networking.
Relay Agent Availability and Management: The relay agent container is designed to be highly available. It will be managed by the App Manager.
Relay Agent Creation: For each pair of forwarded ports, one relay agent container will be created.
Port Limitation per Application: The total effective number of ports for each application is limited to a maximum of 10.

Configure VRF forwarding for application manager

To manage a Docker application using the Application Manager through the Management Interface, follow these steps:

Procedure

Configure the app manager.

The application manager is configured to access the docker application. Use the appmgr application application-name keyword to enable and specify configuration parameters for the VRF forwarding. A typical example would look like this

Example:

RP/0/RP0/CPU0:ios#appmgr
RP/0/RP0/CPU0:ios#application Testapp

Note

The VRF forwarding related run options like --vrf-forward and --vrf-forward-ip-range will not be passed to the Docker engine when the app container is run.

Enable Basic Forwarding Between Two Ports.

To enable traffic forwarding between two ports in different VRFs, use the following configuration:

Example:

RP/0/RP0/CPU0:ios#activate type docker source swanagent docker-run-opts "--vrf-forward vrf-mgmt:5001 vrf-default:8001 --net=host -it"

This command enables traffic on port 5000 at all addresses in vrf-mgmt to be forwarded to the destination veth device in vrf-default on port 8000.

To enable VRF forwarding between multiple ports, follow the steps below:

Enable Forwarding Between a Range of Ports: To enable traffic forwarding between port ranges in different VRFs, use the following configuration:
```
RP/0/RP0/CPU0:ios#--vrf-forward vrf-mgmt:5000-5002 vrf-default:8000-8002
```
This command enables traffic on ports 5000, 5001, and 5002 at all addresses in vrf-mgmt to be forwarded to the destination veth device in vrf-default on ports 8000, 8001, and 8002 respectively.
Enable Forwarding Between Multiple VRF Pairs or Port Ranges: To enable traffic forwarding between multiple VRF pairs, use multiple --vrf-forward command.
```
RP/0/RP0/CPU0:ios#--vrf-forward vrf-mgmt:5000 vrf-default:8000 --vrf-forward vrf-mgmt:5003-5004 vrf-default:8003-8004
RP/0/RP0/CPU0:ios#--vrf-forward vrf-mgmt1:5000 vrf-default:8000 --vrf-forward vrf-mgmt2:5000 vrf-default:8001
```
You can provide any number of --vrf-forward options, but the total number of port pairs involved should not exceed 10.

Verify the VRF forwarding.

Use the show appmgr application name keyword to verify the VRF forwarding.

Example:

RP/0/RP0/CPU0:ios#show appmgr application name swan info detail 
Thu Oct 26 11:59:32.798 UTC
Application: swan
  Type: Docker
  Source: swanagent
  Config State: Activated
  Docker Information:
    Container ID: f230a2396b85f6b3eeb01a8a4450a47e5bd8499fe5cfdb141c2d0fba905b63ec
    Container name: swan
    Labels: com.azure.dev.image.build.buildnumber=2.3.2-dev-ricabrah-partho-xr-dev.1+28,
      com.azure.dev.image.build.definitionname=swanagentXR,com.azure.dev.image.build.
      repository.uri=https://1Wan@dev.azure.com/1Wan/SWAN/_git/swanagentXR,com.azure.dev.
      image.system.teamfoundationcollectionuri=https://dev.azure.com/1Wan/,com.azure.dev.
      image.build.builduri=vstfs:///Build/Build/8518,com.azure.dev.image.build.repository.
      name=swanagentXR,com.azure.dev.image.build.sourcebranchname=partho-xr-dev,
      com.azure.dev.image.build.sourceversion=0ebd43521870844688660c131b0921ea7e2dcb27,com.azure.
      dev.image.system.teamproject=SWAN,image.base.ref.name=mcr.microsoft.com
      /mirror/docker/library/alpine:3.15
    Image: swancr.azurecr.io/swanagentxr-iosxr:2.4.0-0ebd435
    Command: "./agentxr"
    Created at: 2023-10-26 11:58:45 +0000 UTC
    Running for: 48 seconds ago
    Status: Up 47 seconds
    Size: 0B (virtual 29.3MB)
    Ports: 
    Mounts: /var/lib/docker/appmgr/config/swanagent/hostname,/var/lib/docker/appmgr/config/swanagent,/var/lib/docker/ems/grpc.sock,/var/run/netns
    Networks: host
    LocalVolumes: 0
    Vrf Relays:
      Vrf Relay: vrf_relay.swan.6a98f0ed060bffa
        Source VRF: vrf-management
        Source Port: 11111
        Destination VRF: vrf-default
        Destination Port: 10000
        IP Address Range: 172.16.0.0/12
        Status: Up 45 seconds

Use the show running-config appmgr keyword to check the running configuration.

Example:

RP/0/RP0/CPU0:ios#show running-config appmgr 
Thu Oct 26 12:04:06.063 UTC
appmgr
 application swan
  activate type docker source swanagent docker-run-opts "--vrf-forward vrf-management:11111 vrf-default:10000 -it --restart always --cap-add=SYS_ADMIN --net=host --log-opt max-size=20m --log-opt max-file=3 -e HOSTNAME=$HOSTNAME -v /var/run/netns:/var/run/netns -v {app_install_root}/config/swanagent:/root/config -v {app_install_root}/config/swanagent/hostname:/etc/hostname -v /var/lib/docker/ems/grpc.sock:/root/grpc.sock"
 !
!

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.