What Is containerlab? How It Works, Kinds and First Lab (2026)

containerlab is the tool that turned network labs into code. Instead of dragging routers around a GUI, you describe a topology in a YAML file, run one command, and get a running multi-vendor network of real network-OS containers wired together. Engineers use it for network-as-code pipelines, SONiC development and everyday protocol labs.

In one line: containerlab (open source, started by Nokia engineers) deploys containerized network operating systems such as Nokia SR Linux, Arista cEOS, Juniper cRPD, Cisco XRd, FRR and Linux from a declarative YAML file, and wires them with virtual links. It's free, fast and reproducible once you have the host.

We write this guide as users and contributors: NetPilot runs containerlab as its lab engine, and the NetPilot team built the mikrotik_chr kind that shipped in containerlab v0.82.0.

How containerlab works

A lab is a single .clab.yml file. You declare nodes (each with a kind that tells containerlab how to launch and bootstrap it) and links (veth pairs between interfaces):

name: srl-frr
topology:
  nodes:
    srl1:
      kind: nokia_srlinux
      image: ghcr.io/nokia/srlinux:latest
    frr1:
      kind: linux
      image: quay.io/frrouting/frr:latest
  links:
    - endpoints: ["srl1:e1-1", "frr1:eth1"]

Then:

containerlab deploy -t srl-frr.clab.yml
# ... containers start, links are wired, configs applied
containerlab inspect -t srl-frr.clab.yml   # see node names, IPs, status
containerlab destroy -t srl-frr.clab.yml   # tear it all down

The key idea is the kind. Each kind knows how to start that platform, push a startup config, and expose its real CLI. Container-native NOSes (SR Linux, cEOS, FRR, cRPD) run directly. VM-based platforms (many Cisco and Juniper full images) run through vrnetlab, which packages a VM inside a container so containerlab can treat everything the same way. New kinds keep arriving: the mikrotik_chr kind, built by the NetPilot team, runs the official MikroTik CHR image with no vrnetlab build.

What containerlab is great at

• Network-as-code. The topology is a version-controlled file. Diff it, review it in a PR, spin it up in CI, tear it down. The same lab, every time.
• Light on resources. Containerized NOSes need far less memory and CPU than full VMs, so one Linux host goes further. The generate command can even build Clos topologies of arbitrary scale.
• Real NOS, real CLIs. These aren't simulations. show output matches production because you're running the actual network operating system.
• CI/CD and automation native. One command starts a lab from any CI runner, every lab gets a generated Ansible inventory, and it pairs well with netlab for config generation.
• Free and open source. BSD 3-Clause license, no node cap.

If you want raw control of the host, an offline lab on hardware you own, or a lab baked into your own CI runners, containerlab is the right tool, and we say so in our GNS3 vs EVE-NG vs containerlab comparison.

What running it yourself takes

Everything before containerlab deploy is yours to set up:

• A Linux host with Docker, and sudo rights. On Windows that means WSL, and on macOS a Linux VM or dev container.
• Images. SR Linux and FRR are free to pull. Most commercial NOSes (Cisco, Juniper, Arista, Palo Alto, Fortinet) are bring-your-own-image, and VM-based ones need a vrnetlab build: download the VM image, build the container, and debug the first boot.
• Configs. containerlab wires the topology and applies the startup configs you give it. Writing the BGP, OSPF or EVPN config per vendor is your job.

For a quick SR Linux and FRR lab that's minutes. For a five-vendor EVPN fabric, plan an afternoon of image builds before you configure a single neighbor.

containerlab also has a GUI now. The containerlab GUI, built on TopoViewer, comes as a VS Code extension, a desktop app and a web app, and works against a Linux host that runs containerlab.

containerlab in the cloud, with an AI agent

This is where NetPilot fits. NetPilot runs containerlab on isolated cloud infrastructure and puts an AI agent in front of it, so you keep the real-NOS fidelity and hand off the host work:

• No Docker, no Linux host. It's browser-based: describe the lab and it deploys.
• Upload an image once, we build it. Built in are Nokia SR Linux, FRR, and a multi-purpose Linux host, and MikroTik RouterOS (CHR) and SONiC are preloaded on every lab VM. Other commercial NOSes are bring-your-own-image: you upload yours once and NetPilot builds it for you, with no vrnetlab step on your side. (Any custom vendor or NOS you bring can be built for you.)
• The agent writes the YAML and the configs. Describe the topology in plain English. The agent generates the containerlab topology and the per-vendor configs, then deploys it.

It's the same engine underneath, and you can SSH into every node and run real CLIs. NetPilot also contributes to containerlab upstream, so the work we do for our labs reaches every containerlab user.

When to use each

• Run containerlab yourself when you need fully offline or air-gapped labs on hardware you own, want low-level control of the Docker host, or are baking labs into your own CI runners.
• Use the cloud and AI path when you want a multi-vendor lab in minutes, don't want to manage images or a Linux host, or want the topology and configs generated for you. The two fit together: containerlab on the CI host, NetPilot for fast multi-vendor work.

FAQ

What is containerlab used for?

Building reproducible network labs as code. Engineers use it to test routing designs (BGP, OSPF, EVPN/VXLAN), develop and CI-test network automation, reproduce production issues, and study for certifications, all with real network-OS containers instead of simulations.

Is containerlab free?

Yes. containerlab is open source under the BSD 3-Clause license. The cost is indirect: a Linux host, Docker, and sourcing or building commercial NOS images, which for VM-based platforms means a vrnetlab build.

What's the difference between containerlab and GNS3 or EVE-NG?

containerlab is YAML-driven and container-native, which suits automation and repeatable labs. GNS3 and EVE-NG start from a graphical canvas and lean on full VMs, which suits click-through study and shared lab servers. See the full comparison.

Is containerlab CLI only?

No. containerlab has a GUI built on TopoViewer, available as a VS Code extension, a desktop app and a web app. All three work against a Linux host that runs containerlab.

Can I run containerlab without Docker or a Linux host?

Not locally. It needs Docker on Linux, which on Windows means WSL and on macOS means a Linux VM or dev container. To skip the host, run it hosted: containerlab in the cloud covers the managed path.

Does containerlab generate device configs?

No. It deploys the topology and applies the startup configs you provide. Generating per-vendor BGP, OSPF or EVPN config is on you, unless you pair it with a config generator or an AI network emulator that writes the configs from a prompt.

Copy-paste ready: Browse the example-prompts library: 40+ containerlab-compatible scenarios (BGP, EVPN-VXLAN, multi-vendor, security) you can deploy in ~2 minutes.

Want containerlab without the host setup? Run real NOS labs in an online network lab, or let the AI network emulator generate the topology and configs from plain English. Try NetPilot: same engine, zero setup.