## 3 Research Method
### Container Networking
_Support for the Container Network Interface specification._ A noteworthy standardization initiative for network plugins is the Container Network interface (CNI) project [128], which consists of a specification, a library for writing network plugins and a set of helper plugins. Currently, Kubernetes [129], Mesos [130] and DC/OS [131] support CNI. The CNI specification also allows for multiple networks to exist simultaneously. However, mainstream Kubernetes installation tools currently do not support the creation of multiple co-existing networks. Instead, a single network must be installed for the entire cluster when bootstrapping the master node. As such, exhaustion of the number of available subnet IP addresses is an issue. Another limitation is that most CNI plugins do not yet support hairpin mode which allows containers to reach themselves via their Service IPs [132]. _Support for Docker Swarm's libnetwork._ Docker Swarm uses its own networking plugin architecture, libnetwork [133]. The advantage of this architecture is that multiple networking plugins can be dynamically installed/removed and co-exist in an already running cluster. Mesos v1.0.0+ [134] and DC/OS v1.9+ [135] also support Docker's libnetwork architecture. Due to Mesos' architecture, it is however not possible to add or remove virtual networks at run-time [136], nor is it possible to connect a container to multiple Docker networks [137]. _Separation of data and control traffic._ Docker v17.12 [138] can be configured to use separate network interfaces for handling data traffic and swarm control traffic. For CNI-based networks, a specific Kubernetes network plugin, named Multus [139], also supports separating data and control traffic by means of distinct container network interfaces. **Service discovery and external access. **  
_Internal DNS service._ All CO frameworks support an internal DNS service for mapping service DNS names to IP addresses. A DNS service can be either deployed _centrally_, _distributed_ across all nodes of the cluster, or in a _hybrid_ fashion where a central and a distributed DNS service co-exist. _DNS SRV records._ It is also possible to lookup named ports as SRV records [140] in Kubernetes [141], Aurora [120] and DC/OS [142]. _Bypassing the Layer 4 load balancer._ Kubernetes and Docker Swarm allow to bypass the built-in Layer 4 load balancer of respectively the virtual network layer and routing mesh by means of round-robin DNS. In Kubernetes [143], this feature is supported as Headless Services, which don't have a Service IP address. Instead, the IP addresses of the containers are stored as a DNS record in the internal DNS service. Of course, clients need to implement the load-balancing themselves. In Docker Swarm integrated mode [119] it is only possible to bypass the L4 load balancer if the service is exposed as a global service port via the routing mesh. A DNS lookup for the service name returns a list of IP addresses for the nodes running the containers behind that service. _Support for access to services from outside the cluster via the routing mesh._ In order to support access to services from external clients that run outside the cluster, an external load balancer solution must be used. In CO frameworks with a routing mesh, the built-in L4 load balancer can play the role of such load balancer if the public or private IP addresses of one or more nodes of the cluster and the global service port of the service are reachable for external clients. DC/OS' Edge-LB load balancer is specifically designed for this purpose [144] and also allows to load balance non-container orchestrated services of DC/OS [145]. It is also possible to let a cloud provider's load balancing service forward client requests to the L4 load balancer. However, only Kubernetes [146] supports automated configuration for this feature. _Co-existence of service IPs and service ports for a single service._ Docker Swarm integrated mode [147] and Kubernetes [115] allow assigning to a single service both a global service port and a service IP.