Docker学习笔记七：Docker网络

网络配置

安装Docker默认自动创建三个网络：

$ docker network ls

NETWORK ID          NAME                DRIVER
7fca4eb8c647        bridge              bridge
9f904ee27bf5        none                null
cf03ee007fb4        host                host

Docker 容器默认运行在bridge网络。默认的bridge不支持自动服务发现，因此基于容器名或者期望的/etc/hosts ping将会失败，但是自定义的bridge网络支持自动服务发现，可以基于容器名的ping。如果想在默认的bridge支持名称和IP的互联互通，可以使用docker run --link命令。

自定义bridge网络

$ docker network create simple-network

69568e6336d8c96bbf57869030919f7c69524f71183b44d80948bd3927c87f6a

$ docker network inspect simple-network
[
    {
        "Name": "simple-network",
        "Id": "69568e6336d8c96bbf57869030919f7c69524f71183b44d80948bd3927c87f6a",
        "Scope": "local",
        "Driver": "bridge",
        "IPAM": {
            "Driver": "default",
            "Config": [
                {
                    "Subnet": "172.22.0.0/16",
                    "Gateway": "172.22.0.1/16"
                }
            ]
        },
        "Containers": {},
        "Options": {}
    }
]

$ docker network ls

NETWORK ID          NAME                DRIVER
9f904ee27bf5        none                null
cf03ee007fb4        host                host
7fca4eb8c647        bridge              bridge
c5ee82f76de3        isolated_nw         bridge

使用docker run --network=选项在自定义网络启动容器：

$ docker run --network=isolated_nw -itd --name=container3 busybox

8c1a0a5be480921d669a073393ade66a3fc49933f08bcc5515b37b8144f6d47c

$ docker network inspect isolated_nw
[
    {
        "Name": "isolated_nw",
        "Id": "1196a4c5af43a21ae38ef34515b6af19236a3fc48122cf585e3f3054d509679b",
        "Scope": "local",
        "Driver": "bridge",
        "IPAM": {
            "Driver": "default",
            "Config": [
                {}
            ]
        },
        "Containers": {
            "8c1a0a5be480921d669a073393ade66a3fc49933f08bcc5515b37b8144f6d47c": {
                "EndpointID": "93b2db4a9b9a997beb912d28bcfc117f7b0eb924ff91d48cfa251d473e6a9b08",
                "MacAddress": "02:42:ac:15:00:02",
                "IPv4Address": "172.21.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {}
    }
]

使用Docker Engine swarm模式的覆盖网络

在swarm模式的管理节点创建的覆盖网络仅对集群中需要服务的节点可用，创建使用覆盖网络时，管理节点会自动将覆盖网络扩展到运行服务任务的节点。

创建覆盖网络并应用到swarm中管理节点的服务：

# Create an overlay network `my-multi-host-network`.
$ docker network create \
  --driver overlay \
  --subnet 10.0.9.0/24 \
  my-multi-host-network

400g6bwzd68jizzdx5pgyoe95

# Create an nginx service and extend the my-multi-host-network to nodes where
# the service's tasks run.
$ docker service create --replicas 2 --network my-multi-host-network --name my-web nginx

716thylsndqma81j6kkkb5aus

用于swarm的覆盖网络对于以docker run启动而不是集群一部分的容器不可用。

创建一个swarm集群

1.创建一个swarm主：

 $ docker-machine create \
 -d virtualbox \  --swarm --swarm-master \  --swarm-discovery="consul://$(docker-machine ip mh-keystore):8500" \  --engine-opt="cluster-store=consul://$(docker-machine ip mh-keystore):8500" \  --engine-opt="cluster-advertise=eth1:2376" \  mhs-demo0

2.创建另外一台主机，并将其加入到swarm集群：

 $ docker-machine create -d virtualbox \
     --swarm \      --swarm-discovery="consul://$(docker-machine ip mh-keystore):8500" \      --engine-opt="cluster-store=consul://$(docker-machine ip mh-keystore):8500" \      --engine-opt="cluster-advertise=eth1:2376" \    mhs-demo1

3.查看机器，并确定所有主机已经启动并运行：

$ docker-machine ls

 NAME         ACTIVE   DRIVER       STATE     URL                         SWARM
 default      -        virtualbox   Running   tcp://192.168.99.100:2376
 mh-keystore  *        virtualbox   Running   tcp://192.168.99.103:2376
 mhs-demo0    -        virtualbox   Running   tcp://192.168.99.104:2376 mhs-demo0 (master)
 mhs-demo1    -        virtualbox   Running   tcp://192.168.99.105:2376 mhs-demo0

创建覆盖网路

1.将docker环境设置为swarm主机：

$ eval $(docker-machine env --swarm mhs-demo0)

使用docker-machine的--swarm标志将docker命令限制为单独的swarm信息。

2.使用docker info命令查看这个swarm：

 $ docker info

 Containers: 3
 Images: 2
 Role: primary
 Strategy: spread
 Filters: affinity, health, constraint, port, dependency
 Nodes: 2
 mhs-demo0: 192.168.99.104:2376
 └ Containers: 2
 └ Reserved CPUs: 0 / 1
 └ Reserved Memory: 0 B / 1.021 GiB
 └ Labels: executiondriver=native-0.2, kernelversion=4.1.10-boot2docker, operatingsystem=Boot2Docker 1.9.0 (TCL 6.4); master : 4187d2c - Wed Oct 14 14:00:28 UTC 2015, provider=virtualbox, storagedriver=aufs
 mhs-demo1: 192.168.99.105:2376
 └ Containers: 1
 └ Reserved CPUs: 0 / 1
 └ Reserved Memory: 0 B / 1.021 GiB
 └ Labels: executiondriver=native-0.2, kernelversion=4.1.10-boot2docker, operatingsystem=Boot2Docker 1.9.0 (TCL 6.4); master : 4187d2c - Wed Oct 14 14:00:28 UTC 2015, provider=virtualbox, storagedriver=aufs
 CPUs: 2
 Total Memory: 2.043 GiB
 Name: 30438ece0915

3.创建overlay网络：

 $ docker network create --driver overlay --subnet=10.0.9.0/24 my-net

强烈推荐使用--subnet参数，如果不指定，docker守护进程会自动选择一个子网，并且可能与已经存在的网络重复。

4.检测网络正在运行：

 $ docker network ls

 NETWORK ID          NAME                DRIVER
 412c2496d0eb        mhs-demo1/host      host
 dd51763e6dd2        mhs-demo0/bridge    bridge
 6b07d0be843f        my-net              overlay
 b4234109bd9b        mhs-demo0/none      null
 1aeead6dd890        mhs-demo0/host      host
 d0bb78cbe7bd        mhs-demo1/bridge    bridge
 1c0eb8f69ebb        mhs-demo1/none      null

5.一次切换到每个代理并列出网络：

 eval $(docker-machine env mhs-demo0)

 $ docker network ls

 NETWORK ID          NAME                DRIVER
 6b07d0be843f        my-net              overlay
 dd51763e6dd2        bridge              bridge
 b4234109bd9b        none                null
 1aeead6dd890        host                host

 $ eval $(docker-machine env mhs-demo1)

 $ docker network ls

 NETWORK ID          NAME                DRIVER
 d0bb78cbe7bd        bridge              bridge
 1c0eb8f69ebb        none                null
 412c2496d0eb        host                host
 6b07d0be843f        my-net              overlay

在网络上运行一个应用:

1.将您的环境指向swarm主：

 $ eval $(docker-machine env --swarm mhs-demo0)

2.在mhs-demo0实例启动一个Nginx web服务：

 $ docker run -itd --name=web --network=my-net --env="constraint:node==mhs-demo0" nginx

3.在mhs-demo1实例上运行一个BusyBox实例，并获取Nginx服务的主页内容：

 $ docker run -it --rm --network=my-net --env="constraint:node==mhs-demo1" busybox wget -O- http://web

 Unable to find image 'busybox:latest' locally
 latest: Pulling from library/busybox
 ab2b8a86ca6c: Pull complete
 2c5ac3f849df: Pull complete
 Digest: sha256:5551dbdfc48d66734d0f01cafee0952cb6e8eeecd1e2492240bf2fd9640c2279
 Status: Downloaded newer image for busybox:latest
 Connecting to web (10.0.0.2:80)
 
 <html>
 <head>
 <title>Welcome to nginx!title>
 <style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; } style>
 head>
 <body>
 <h1>Welcome to nginx!h1>
 <p>If you see this page, the nginx web server is successfully installed and
 working. Further configuration is required.p>

 <p>For online documentation and support please refer to
 <a href="http://nginx.org/">nginx.orga>.<br/>
 Commercial support is available at
 <a href="http://nginx.com/">nginx.coma>.p>

 <p><em>Thank you for using nginx.em>p>
 body>
 html>
 -                    100% |*******************************|   612   0:00:00 ETA

检查外部的连通性

连接到多主机网络的容器会自动连接到docker_gwbridge网络。此网络允许容器在其集群外部具有外部链接。

1.切换环境到swarm代理：

 $ eval $(docker-machine env mhs-demo1)

2.通过列出网络查看docker_gwbridge网络:

 $ docker network ls

 NETWORK ID          NAME                DRIVER
 6b07d0be843f        my-net              overlay
 dd51763e6dd2        bridge              bridge
 b4234109bd9b        none                null
 1aeead6dd890        host                host
 e1dbd5dff8be        docker_gwbridge     bridge

3.在swarm主上重复1、2步操作：

 $ eval $(docker-machine env mhs-demo0)

 $ docker network ls

 NETWORK ID          NAME                DRIVER
 6b07d0be843f        my-net              overlay
 d0bb78cbe7bd        bridge              bridge
 1c0eb8f69ebb        none                null
 412c2496d0eb        host                host
 97102a22e8d2        docker_gwbridge     bridge

4.检测Nginx容器的网络接口:

 $ docker exec web ip addr

 1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default
 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
 inet 127.0.0.1/8 scope host lo
     valid_lft forever preferred_lft forever
 inet6 ::1/128 scope host
     valid_lft forever preferred_lft forever
 22: eth0:  mtu 1450 qdisc noqueue state UP group default
 link/ether 02:42:0a:00:09:03 brd ff:ff:ff:ff:ff:ff
 inet 10.0.9.3/24 scope global eth0
     valid_lft forever preferred_lft forever
 inet6 fe80::42:aff:fe00:903/64 scope link
     valid_lft forever preferred_lft forever
 24: eth1:  mtu 1500 qdisc noqueue state UP group defaMacvlan Network Driver¶
ult
 link/ether 02:42:ac:12:00:02 brd ff:ff:ff:ff:ff:ff
 inet 172.18.0.2/16 scope global eth1
     valid_lft forever preferred_lft forever
 inet6 fe80::42:acff:fe12:2/64 scope link
     valid_lft forever preferred_lft forever