What Is ContainerLab? The Complete 2026 Guide

ContainerLab is the tool that turned network labs into code. Instead of dragging routers around a GUI, you describe a topology in a YAML file, run one command, and get a running multi-vendor network of real network-OS containers wired together. It has become the default lab engine for DevOps-minded network teams, SONiC developers, and anyone building network-as-code pipelines.

In one line: ContainerLab (open-source, originally from Nokia's SR Linux team) deploys containerized network operating systems — Nokia SR Linux, Arista cEOS, Juniper cRPD, Cisco XRd, FRR, Linux — from a declarative YAML file, wiring them with virtual links. It's free, fast, and reproducible — once you've built the host.

How ContainerLab works

A lab is a single .clab.yml file. You declare nodes (each with a kind that tells ContainerLab how to launch and bootstrap it) and links (veth pairs between interfaces):

name: srl-frr
topology:
  nodes:
    srl1:
      kind: nokia_srlinux
      image: ghcr.io/nokia/srlinux:latest
    frr1:
      kind: linux
      image: quay.io/frrouting/frr:latest
  links:
    - endpoints: ["srl1:e1-1", "frr1:eth1"]

Then:

containerlab deploy -t srl-frr.clab.yml
# ... containers start, links are wired, configs applied
containerlab inspect -t srl-frr.clab.yml   # see node names, IPs, status
containerlab destroy -t srl-frr.clab.yml   # tear it all down

The magic is the kind. Each kind knows how to start that platform, push a startup config, and expose its real CLI. Container-native NOSes (SR Linux, cEOS, FRR, cRPD) run directly; VM-based platforms (many Cisco/Juniper full images) run through vrnetlab, which packages a VM inside a container so ContainerLab can treat everything uniformly.

What ContainerLab is great at

• Network-as-code. The topology is a version-controlled file. Diff it, review it in a PR, spin it up in CI, tear it down — the same lab, every time.
• Scale on one host. Containers are cheap; ContainerLab routinely runs 100+ nodes on a single beefy Linux box, far past what nested-VM emulators manage.
• Real NOS, real CLIs. These aren't simulations — show output matches production because you're running the actual network operating system.
• CI/CD and automation native. It pairs naturally with GitHub Actions, Ansible, and tools like netlab for config generation.
• Free and open-source. No license, no node cap.

If you want raw control of the host, an offline lab on hardware you own, or a lab baked into your own CI runners, ContainerLab is the right tool — and we say so in our GNS3 vs EVE-NG vs ContainerLab comparison.

The setup tax

The catch is everything that happens before containerlab deploy:

• A Linux host with Docker (and usually root) — ContainerLab doesn't run natively on macOS or Windows.
• Image sourcing. SR Linux and FRR are freely pullable; the commercial NOSes (Cisco, Juniper, Arista, Palo Alto, Fortinet) are bring-your-own-image and frequently need a vrnetlab build step — download the VM, build the container, push it to a registry, debug boot issues.
• You still write every config. ContainerLab wires the topology; it doesn't generate the BGP, OSPF, or EVPN config — that's on you, per vendor.

For a quick SR Linux + FRR lab that's minutes. For a five-vendor EVPN fabric, it's an afternoon of vrnetlab builds before you configure a single neighbor.

Skip the setup: cloud + AI

This is where NetPilot fits. NetPilot runs ContainerLab on isolated cloud infrastructure and puts an AI agent in front of it, so you keep ContainerLab's real-NOS fidelity without the host work:

• No Docker, no Linux host. It's browser-based — describe the lab and it deploys.
• Upload an image once, we auto-build it. Built in are Nokia SR Linux, FRR, and a multi-purpose Linux host; commercial NOSes are still bring-your-own-image, but you upload yours once and NetPilot automatically builds and bakes it into the platform — no vrnetlab build, no registry plumbing. (Enterprise plans build any custom vendor or NOS you bring.)
• The agent writes the YAML and the configs. Describe the topology in plain English; the agent generates the ContainerLab topology and the per-vendor configs, then deploys it.

It's the same engine underneath — you can still SSH into every node and run real CLIs. You're just trading host setup and manual YAML for a prompt.

When to use each

• Run ContainerLab yourself when you need fully offline / air-gapped labs on hardware you own, want low-level control of the Docker host, or are baking labs into your own CI runners.
• Use the cloud + AI path when you want a multi-vendor lab in minutes, don't want to manage images or a Linux host, or want the topology and configs generated for you. Many teams do both — ContainerLab on the CI host, NetPilot for fast ad-hoc and multi-vendor work.

FAQ

What is ContainerLab used for?

Building reproducible network labs as code. Engineers use it to test routing designs (BGP, OSPF, EVPN/VXLAN), develop and CI-test network automation, reproduce production issues, and study for certifications — all with real network-OS containers instead of simulations.

Is ContainerLab free?

Yes. ContainerLab is open-source with no node cap. The cost is indirect: a Linux host, Docker, and sourcing/building the commercial NOS images (bring-your-own-image), which for VM-based platforms means a vrnetlab build.

What's the difference between ContainerLab and GNS3 or EVE-NG?

ContainerLab is CLI- and YAML-driven and container-native — ideal for automation and scale. GNS3 and EVE-NG are GUI-driven and lean on full VMs, which is friendlier for click-through study but heavier and slower to scale. See the full comparison.

Can I run ContainerLab without Docker or a Linux host?

Not locally — it needs Docker on Linux. To get ContainerLab's real CLIs without that, run it cloud-hosted: ContainerLab in the Cloud covers the managed path.

Does ContainerLab generate device configs?

No — it deploys the topology and applies startup configs you provide. Generating per-vendor BGP/OSPF/EVPN config is on you, unless you pair it with a config generator or an AI network emulator that writes the configs from a prompt.

Copy-paste ready: Browse the example-prompts library — 40+ ContainerLab-compatible scenarios (BGP, EVPN-VXLAN, multi-vendor, security) you can deploy in ~2 minutes.

Want ContainerLab without the host setup? Run real NOS labs in an online network lab, or let the AI network emulator generate the topology and configs from plain English. Try NetPilot — same engine, zero setup.