1. docker容器网络
// Docker在安装后自动提供3种网络，可以使用docker network ls命令查看
[root@localhost ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
cd5819974799 bridge bridge local
06981d199d13 host host local
adea037fe3f2 none null local
// 查看bridge网络的详细配置
[root@localhost ~]# docker network inspect bridge
[
{
"Name": "bridge",
"Id": "cd5819974799e369a9eacebdefe1e07505af64cc77d7beac4bc228d088a3ea4b",
"Created": "2022-08-09T10:51:57.86409499+03:00",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Labels": {}
}
]
Docker使用Linux桥接，在宿主机虚拟一个Docker容器网桥(docker0)，Docker启动一个容器时会根据Docker网桥的网段分配给容器一个IP地址，称为Container-IP，同时Docker网桥是每个容器的默认网关。因为在同一宿主机内的容器都接入同一个网桥，这样容器之间就能够通过容器的Container-IP直接通信。
2. docker的4种网络模式
2.1 bridge模式
当Docker进程启动时，会在主机上创建一个名为docker0的虚拟网桥，此主机上启动的Docker容器会连接到这个虚拟网桥上。虚拟网桥的工作方式和物理交换机类似，这样主机上的所有容器就通过交换机连在了一个二层网络中。
从docker0子网中分配一个IP给容器使用，并设置docker0的IP地址为容器的默认网关。在主机上创建一对虚拟网卡veth pair设备，Docker将veth pair设备的一端放在新创建的容器中，并命名为eth0（容器的网卡），另一端放在主机中，以vethxxx这样类似的名字命名，并将这个网络设备加入到docker0网桥中。可以通过brctl show命令查看。
bridge模式是docker的默认网络模式，不写–network参数，就是bridge模式。使用docker run -p时，docker实际是在iptables做了DNAT规则，实现端口转发功能。可以使用iptables -t nat -vnL查看。
Docker网桥是宿主机虚拟出来的，并不是真实存在的网络设备，外部网络是无法寻址到的，这也意味着外部网络无法通过直接Container-IP访问到容器。如果容器希望外部访问能够访问到，可以通过映射容器端口到宿主主机（端口映射），即docker run创建容器时候通过 -p 或 -P 参数来启用，访问容器的时候就通过[宿主机IP]:[容器端口]访问容器。
2.1.1bridge模式配置
[root@localhost ~]# docker run -it --name b1 --rm busybox
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:06
inet addr:172.17.0.6 Bcast:172.17.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:516 (516.0 B) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
/ # exit
[root@localhost ~]# docker run -it --name b2 --rm busybox
/ # ifonfig
sh: ifonfig: not found
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:06
inet addr:172.17.0.6 Bcast:172.17.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:656 (656.0 B) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
/ # ping 172.17.0.6
PING 172.17.0.6 (172.17.0.6): 56 data bytes
64 bytes from 172.17.0.6: seq=0 ttl=64 time=0.051 ms
64 bytes from 172.17.0.6: seq=1 ttl=64 time=0.048 ms
^C
--- 172.17.0.6 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.048/0.049/0.051 ms
/ # ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: seq=0 ttl=64 time=0.026 ms
64 bytes from 127.0.0.1: seq=1 ttl=64 time=0.046 ms
^C
--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.026/0.036/0.046 ms
在创建容器时添加–network bridge与不加–network选项效果是一致的
2.2 container模式
这个模式指定新创建的容器和已经存在的一个容器共享一个 Network Namespace，而不是和宿主机共享。新创建的容器不会创建自己的网卡，配置自己的 IP，而是和一个指定的容器共享 IP、端口范围等。同样，两个容器除了网络方面，其他的如文件系统、进程列表等还是隔离的。两个容器的进程可以通过 lo 网卡设备通信。
2.2.1 container模式配置
//启动第一个容器
[root@localhost ~]# docker run -it --name b1 --rm busybox
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:06
inet addr:172.17.0.6 Bcast:172.17.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:7 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:586 (586.0 B) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
//启动第二个容器
[root@localhost ~]# docker run -it --name b2 --rm busybox
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:05
inet addr:172.17.0.5 Bcast:172.17.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:7 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:586 (586.0 B) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
发现第二个容器与第一个容器IP地址不一样，这说明没有实现网络共享
//改变第二个容器的启动方式
[root@localhost ~]# docker run -it --name b2 --rm --network container:b1 busybox
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:06
inet addr:172.17.0.6 Bcast:172.17.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:936 (936.0 B) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
//此时我们在b1上创建一个目录
/ # mkdir /aaa
/ # ls
aaa bin dev etc home proc root sys tmp usr var
//这个时候我们到b2上检查会发现并没有aaa这个目录，因为仅仅是共享网络但不会共享文件系统
在b2容器上部署一个站点
/ # cd /tmp
/tmp # ls
/tmp # echo 'hiahaihaihaiahi' > index.html
/tmp # ls
index.html
/tmp # cd
~ # cd /
/ # httpd -h /tmp
/ # netstat -antl
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 :::80 :::* LISTEN
在b1容器上用本地地址去访问此站点
/ # wget -O - 172.17.0.6
Connecting to 172.17.0.6 (172.17.0.6:80)
writing to stdout
hiahaihaihaiahi
- 100% |****************************************************************************************| 16 0:00:00 ETA
written to stdout
2.3 host模式
如果启动容器的时候使用host模式，那么这个容器将不会获得一个独立的Network Namespace，而是和宿主机共用一个Network Namespace。容器将不会虚拟出自己的网卡，配置自己的IP等，而是使用宿主机的IP和端口。但是，容器的其他方面，如文件系统、进程列表等还是和宿主机隔离的。
使用host模式的容器可以直接使用宿主机的IP地址与外界通信，容器内部的服务端口也可以使用宿主机的端口，不需要进行NAT，host最大的优势就是网络性能比较好，但是docker host上已经使用的端口就不能再用了，网络的隔离性不好。
2.3.1 host 模式配置
启动容器时直接指明模式为host
[root@localhost ~]# docker run -it --name v1 --rm --network host busybox
/ # ifconfig
docker0 Link encap:Ethernet HWaddr 02:42:E8:68:46:02
inet addr:172.17.0.1 Bcast:172.17.255.255 Mask:255.255.0.0
inet6 addr: fe80::42:e8ff:fe68:4602/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:446 (446.0 B)
eth0 Link encap:Ethernet HWaddr 00:0C:29:68:24:B7
inet addr:192.168.253.140 Bcast:192.168.253.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe68:24b7/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:128 errors:0 dropped:0 overruns:0 frame:0
TX packets:112 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:10640 (10.3 KiB) TX bytes:7850 (7.6 KiB)
eth1 Link encap:Ethernet HWaddr 00:0C:29:68:24:C1
inet addr:192.168.253.141 Bcast:192.168.253.255 Mask:255.255.255.0
inet6 addr: fe80::1dd6:8cd3:4ffc:c661/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:408934 errors:0 dropped:0 overruns:0 frame:0
TX packets:120358 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:526845899 (502.4 MiB) TX bytes:7960778 (7.5 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:54 errors:0 dropped:0 overruns:0 frame:0
TX packets:54 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:77532 (75.7 KiB) TX bytes:77532 (75.7 KiB)
veth2d2255a Link encap:Ethernet HWaddr 46:E2:B3:14:59:84
inet6 addr: fe80::44e2:b3ff:fe14:5984/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:1216 (1.1 KiB)
veth3ee9772 Link encap:Ethernet HWaddr 46:7D:11:FA:FE:56
inet6 addr: fe80::447d:11ff:fefa:fe56/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:1216 (1.1 KiB)
vetheb5d071 Link encap:Ethernet HWaddr 86:D3:35:02:29:7F
inet6 addr: fe80::84d3:35ff:fe02:297f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:22 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:1732 (1.6 KiB)
在容器中启动一个http站点，就可以直接用宿主机的IP直接在浏览器中访问这个容器中的站点了。
2.4 none模式
使用none模式，Docker容器拥有自己的Network Namespace，但是，并不为Docker容器进行任何网络配置。也就是说，这个Docker容器没有网卡、IP、路由等信息。需要我们自己为Docker容器添加网卡、配置IP等。
这种网络模式下容器只有lo回环网络，没有其他网卡。none模式可以在容器创建时通过–network none来指定。这种类型的网络没有办法联网，封闭的网络能很好的保证容器的安全性。
应用场景：
启动一个容器处理数据，比如转换数据格式
一些后台的计算和处理任务
2.4.1 none模式配置
[root@localhost ~]# docker run -it --name b1 --network none --rm busybox
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
3. docker容器网络配置
3.1 Linux内核实现名称空间的创建
3.1.1 ip netns命令
ip netns命令来自于iproute安装包，一般系统会默认安装，如果没有的话，请自行安装。
注意：ip netns命令修改网络配置时需要 sudo 权限。
可以通过ip netns命令完成对Network Namespace 的相关操作，可以通过ip netns help查看命令帮助信息：
[root@localhost ~]# ip netns help
Usage: ip netns list
ip netns add NAME
ip netns attach NAME PID
ip netns set NAME NETNSID
ip [-all] netns delete [NAME]
ip netns identify [PID]
ip netns pids NAME
ip [-all] netns exec [NAME] cmd ...
ip netns monitor
ip netns list-id [target-nsid POSITIVE-INT] [nsid POSITIVE-INT]
NETNSID := auto | POSITIVE-INT
3.2 创建Network Namespace
[root@localhost ~]# ip netns list
[root@localhost ~]# ip netns add es0
[root@localhost ~]# ip netns list
es0
新创建的 Network Namespace 会出现在/var/run/netns/目录下。如果相同名字的 namespace 已经存在，命令会报Cannot create namespace file “/var/run/netns/ns0”: File exists的错误。
[root@localhost ~]# ls /var/run/netns/
es0
[root@localhost ~]# ip netns add es0
Cannot create namespace file "/var/run/netns/es0": File exists
3.3 操作Network Namespace
ip命令提供了ip netns exec子命令可以在对应的 Network Namespace 中执行命令。
//查看新创建 Network Namespace 的网卡信息
//此时网卡处于关闭状态
[root@localhost ~]# ip netns exec es0 ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
通过下面的命令启用lo回环网卡：
[root@localhost ~]# ip netns exec es0 ip link set lo up
[root@localhost ~]# ip netns exec es0 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
[root@localhost ~]# ip netns exec es0 ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.017 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.057 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.025 ms
^C
--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2060ms
rtt min/avg/max/mdev = 0.017/0.033/0.057/0.017 ms
3.4 转移设备
我们可以在不同的 Network Namespace 之间转移设备（如veth）。由于一个设备只能属于一个 Network Namespace ，所以转移后在这个 Network Namespace 内就看不到这个设备了。
其中，veth设备属于可转移设备，而很多其它设备（如lo、vxlan、ppp、bridge等）是不可以转移的。
3.5 veth pair
veth pair是成对出现的一种虚拟网络设备接口，一端连着网络协议栈，一端彼此相连，在容器的网络方案中基本都能看到veth pair的身影，它的跨网络命名空间联通性很好的匹配了容器网络需求
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:68:24:b7 brd ff:ff:ff:ff:ff:ff
inet 192.168.253.140/24 brd 192.168.253.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe68:24b7/64 scope link
valid_lft forever preferred_lft forever
·······
·······
10: veth3ee9772@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether 46:7d:11:fa:fe:56 brd ff:ff:ff:ff:ff:ff link-netnsid 2
inet6 fe80::447d:11ff:fefa:fe56/64 scope link
valid_lft forever preferred_lft forever
12: vethb58ccca@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether ca:23:ca:61:1b:f7 brd ff:ff:ff:ff:ff:ff link-netnsid 3
inet6 fe80::c823:caff:fe61:1bf7/64 scope link
valid_lft forever preferred_lft forever
[root@localhost ~]# ip link add type veth
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:68:24:b7 brd ff:ff:ff:ff:ff:ff
inet 192.168.253.140/24 brd 192.168.253.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe68:24b7/64 scope link
valid_lft forever preferred_lft forever
······
······
10: veth3ee9772@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether 46:7d:11:fa:fe:56 brd ff:ff:ff:ff:ff:ff link-netnsid 2
inet6 fe80::447d:11ff:fefa:fe56/64 scope link
valid_lft forever preferred_lft forever
12: vethb58ccca@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether ca:23:ca:61:1b:f7 brd ff:ff:ff:ff:ff:ff link-netnsid 3
inet6 fe80::c823:caff:fe61:1bf7/64 scope link
valid_lft forever preferred_lft forever
13: veth0@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether ee:c8:45:53:cb:9c brd ff:ff:ff:ff:ff:ff
14: veth1@veth0: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether fa:e2:6a:9f:8d:7d brd ff:ff:ff:ff:ff:ff
这里新增加了一对veth pair 将veth0和veth1两个虚拟网卡连接了起来 现在veth pair还处于未开启的状态
3.6 实现Network Namespace间通信
- 再创建一个名为es1的ns0的 Network Namespace
[root@localhost ~]# ip netns add es1
[root@localhost ~]# ip netns list
es1
es0
- 将veth0和veth1 分别加入到es0和es1
并分别给它们配置IP地址然后启用
[root@localhost ~]# ip link set veth0 netns es0
[root@localhost ~]# ip link set veth1 netns es1
//配置ip并启用
[root@localhost ~]# ip netns exec es0 ip link set veth0 up
[root@localhost ~]# ip netns exec es1 ip link set veth1 up
[root@localhost ~]# ip netns exec es0 ip addr add 192.168.253.1/24 dev veth0
[root@localhost ~]# ip netns exec es1 ip addr add 192.168.253.3/24 dev veth1
- 查看这一对veth pair的状态
[root@localhost ~]# ip netns exec es0 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
13: veth0@if14: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether ee:c8:45:53:cb:9c brd ff:ff:ff:ff:ff:ff link-netns es1
inet 192.168.253.1/24 scope global veth0
valid_lft forever preferred_lft forever
inet6 fe80::ecc8:45ff:fe53:cb9c/64 scope link
valid_lft forever preferred_lft forever
[root@localhost ~]# ip netns exec es1 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
14: veth1@if13: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether fa:e2:6a:9f:8d:7d brd ff:ff:ff:ff:ff:ff link-netns es0
inet 192.168.253.3/24 scope global veth1
valid_lft forever preferred_lft forever
inet6 fe80::f8e2:6aff:fe9f:8d7d/64 scope link
valid_lft forever preferred_lft forever
- 验证一下连通性
[root@localhost ~]# ip netns exec es0 ping 192.168.253.3
PING 192.168.253.3 (192.168.253.3) 56(84) bytes of data.
64 bytes from 192.168.253.3: icmp_seq=1 ttl=64 time=0.038 ms
64 bytes from 192.168.253.3: icmp_seq=2 ttl=64 time=0.047 ms
^C
--- 192.168.253.3 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1004ms
rtt min/avg/max/mdev = 0.038/0.042/0.047/0.007 ms
[root@localhost ~]# ip netns exec es1 ping 192.168.253.1
PING 192.168.253.1 (192.168.253.1) 56(84) bytes of data.
64 bytes from 192.168.253.1: icmp_seq=1 ttl=64 time=0.031 ms
64 bytes from 192.168.253.1: icmp_seq=2 ttl=64 time=0.031 ms
^C
--- 192.168.253.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1051ms
rtt min/avg/max/mdev = 0.031/0.031/0.031/0.000 ms
3.7 veth设备重命名
[root@localhost ~]# ip netns exec es0 ip link set veth0 down
[root@localhost ~]# ip netns exec es0 ip link set dev veth0 name eth0
[root@localhost ~]# ip netns exec es1 ip link set veth1 down
[root@localhost ~]# ip netns exec es1 ip link set dev veth1 name eth1
[root@localhost ~]# ip netns exec es0 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
13: eth0@if14: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether ee:c8:45:53:cb:9c brd ff:ff:ff:ff:ff:ff link-netns es1
inet 192.168.253.1/24 scope global eth0
valid_lft forever preferred_lft forever
[root@localhost ~]# ip netns exec es1 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
14: eth1@if13: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether fa:e2:6a:9f:8d:7d brd ff:ff:ff:ff:ff:ff link-netns es0
inet 192.168.253.3/24 scope global eth1
valid_lft forever preferred_lft forever
4.容器的常用操作
查看容器的主机名
[root@localhost ~]# docker run -it --name v1 --network bridge --rm busybox
/ # hostname
5b9b91fcfe81
在容器启动时注入主机名
[root@localhost ~]# docker run -it --name v1 --network bridge --hostname renweiwei --rm busybox
/ # hostname
renweiwei
/ # cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.5 renweiwei
//注入主机名时会自动创建主机名到IP的映射关系
/ # cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.5 renweiwei
/ # cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 192.168.253.2
nameserver 193.168.253.2 // DNS也会自动配置为宿主机的DNS
手动指定容器要使用的 DNS
/ # cat /etc/resolv.conf
search localdomain
nameserver 114.114.114.114
/ # nslookup -type=a www.baidu.com
Server: 114.114.114.114
Address: 114.114.114.114:53
Non-authoritative answer:
Name: www.baidu.com
Address: 36.152.44.96
Name: www.baidu.com
Address: 36.152.44.95
手动往/etc/hosts文件中注入主机名到IP地址的映射
[root@localhost ~]# docker run -it --name v1 --network bridge --hostname renweiwei --add-host www.123.com:2.2.2.2 --rm busybox
/ # cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
2.2.2.2 www.123.com
172.17.0.5 renweiwei
开放容器端口
动态端口指的是随机端口，具体的映射结果可使用docker port命令查看。
[root@localhost ~]# docker run -dit --name renweiwei -p 192.168.253.139::80 busybox
c1eab2e3b0b1d8cb7ace80813bb64ff04f9506215fe7439a6da67b0988f6cd82
[root@localhost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c1eab2e3b0b1 busybox "sh" 18 seconds ago Up 17 seconds 192.168.253.139:49153->80/tcp renweiwei
以上命令执行后会一直占用着前端，我们新开一个终端连接来看一下容器的80端口被映射到了宿主机的什么端口上
[root@localhost ~]# docker port renweiwei
80/tcp -> 192.168.253.139:49153
由此可见，容器的80端口被暴露到了宿主机的49153端口上，此时我们在宿主机上访问一下这个端口看是否能访问到容器内的站点
[root@localhost ~]# curl http://192.168.253.139:49153
<html><body><h1>It works!</h1></body></html>
ptables防火墙规则将随容器的创建自动生成，随容器的删除自动删除规则。
[root@localhost ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 90 packets, 71367 bytes)
pkts bytes target prot opt in out source destination
5 64487 DOCKER all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 4 packets, 208 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 74 packets, 5440 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 74 packets, 5440 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER all -- * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0
自定义 docker0 桥的网络属性信息
自定义docker0桥的网络属性信息需要修改/etc/docker/daemon.json配置文件
[root@localhost ~]# cat /etc/docker/daemon.json
{
"registry-mirrors": ["https://docker.mirrors.ustc.edu.cn/"],
"bip": "192.168.88.8/24"
}
[root@localhost ~]# systemctl restart docker
//–restart always
[root@localhost ~]# docker run -dit --name web --restart always httpd
docker 远程连接
[root@localhost ~]# vim /lib/systemd/system/docker.service
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock
[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]# systemctl restart docker
在客户端上向 dockerd 直接传递 “-H|–host” 选项指定要控制哪台主机上的 docker 容器
[root@localhost ~]# docker -H 192.168.253.139:2375 images
REPOSITORY TAG IMAGE ID CREATED SIZE
httpd latest f2a976f932ec 7 days ago 145MB
创建新网络
[root@localhost ~]# docker network create rww -d bridge
362fd13b8be9b48d11ca945ce9cec94f2ffe7c3629302ed19dcd5d67bd8754f3
[root@localhost ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
d15b8b5b71c4 bridge bridge local
ba12e57da138 host host local
cbaa03b3f433 none null local
362fd13b8be9 rww bridge local
创建一个额外的自定义桥，区别于docker0
[root@localhost ~]# docker network create star --subnet "192.168.99.0/24" --gateway "192.168.99.1" -d bridge
93300ede825f70af10b3b5784370a546bdb1e5f1a98ba65f7b81c19c93bb9558
[root@localhost ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
d15b8b5b71c4 bridge bridge local
ba12e57da138 host host local
cbaa03b3f433 none null local
362fd13b8be9 rww bridge local
93300ede825f star bridge local
使用新创建的自定义桥来创建容器：
[root@localhost ~]# docker network create star --subnet "192.168.99.0/24" --gateway "192.168.99.1" -d bridge
93300ede825f70af10b3b5784370a546bdb1e5f1a98ba65f7b81c19c93bb9558
[root@localhost ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
d15b8b5b71c4 bridge bridge local
ba12e57da138 host host local
cbaa03b3f433 none null local
362fd13b8be9 rww bridge local
93300ede825f star bridge local
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:68:24:b7 brd ff:ff:ff:ff:ff:ff
inet 192.168.253.139/24 brd 192.168.253.255 scope global dynamic noprefixroute ens33
valid_lft 1756sec preferred_lft 1756sec
inet6 fe80::61fb:85dd:bc5b:a789/64 scope link noprefixroute
valid_lft forever preferred_lft forever
11: veth345db2b@if10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether 86:9e:2d:3f:d4:d0 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::849e:2dff:fe3f:d4d0/64 scope link
valid_lft forever preferred_lft forever
12: br-362fd13b8be9: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:16:55:42:c7 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global br-362fd13b8be9
valid_lft forever preferred_lft forever
13: br-93300ede825f: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:34:57:3b:6c brd ff:ff:ff:ff:ff:ff
inet 192.168.99.1/24 brd 192.168.99.255 scope global br-93300ede825f
valid_lft forever preferred_lft forever
版权声明：本文为m0_56681539原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接和本声明。