docker原生网络分类：
- none
root@jyq-virtual-machine:/home/jyq# docker run -it --network=none busybox
/ #
/ #
/ # ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
/ #
容器运行后没有网络，此种网络类型可以用来做主句的隔离
- host
host网络配置信息
root@jyq-virtual-machine:/home/jyq# ifconfig
docker0 Link encap:以太网 硬件地址 02:42:16:58:29:48
inet 地址:172.17.0.1 广播:172.17.255.255 掩码:255.255.0.0
inet6 地址: fe80::42:16ff:fe58:2948/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 跃点数:1
接收数据包:39 错误:0 丢弃:0 过载:0 帧数:0
发送数据包:92 错误:0 丢弃:0 过载:0 载波:0
碰撞:0 发送队列长度:0
接收字节:2241 (2.2 KB) 发送字节:11494 (11.4 KB)
eth0 Link encap:以太网 硬件地址 00:0c:29:78:d3:1e
inet 地址:192.168.100.128 广播:192.168.100.255 掩码:255.255.255.0
inet6 地址: fe80::20c:29ff:fe78:d31e/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 跃点数:1
接收数据包:481994 错误:0 丢弃:0 过载:0 帧数:0
发送数据包:320822 错误:0 丢弃:0 过载:0 载波:0
碰撞:0 发送队列长度:1000
接收字节:609233688 (609.2 MB) 发送字节:39065355 (39.0 MB)
lo Link encap:本地环回
inet 地址:127.0.0.1 掩码:255.0.0.0
inet6 地址: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 跃点数:1
接收数据包:560 错误:0 丢弃:0 过载:0 帧数:0
发送数据包:560 错误:0 丢弃:0 过载:0 载波:0
碰撞:0 发送队列长度:1
接收字节:55305 (55.3 KB) 发送字节:55305 (55.3 KB)
veth24e3ef4 Link encap:以太网 硬件地址 c6:f2:38:9b:e0:25
inet6 地址: fe80::c4f2:38ff:fe9b:e025/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 跃点数:1
接收数据包:0 错误:0 丢弃:0 过载:0 帧数:0
发送数据包:34 错误:0 丢弃:0 过载:0 载波:0
碰撞:0 发送队列长度:0
接收字节:0 (0.0 B) 发送字节:5106 (5.1 KB)
vethbf1d8c4 Link encap:以太网 硬件地址 56:94:85:f5:94:a9
inet6 地址: fe80::5494:85ff:fef5:94a9/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 跃点数:1
接收数据包:0 错误:0 丢弃:0 过载:0 帧数:0
发送数据包:79 错误:0 丢弃:0 过载:0 载波:0
碰撞:0 发送队列长度:0
接收字节:0 (0.0 B) 发送字节:11862 (11.8 KB)
vethf8de0a7 Link encap:以太网 硬件地址 f2:51:e6:b4:ca:ce
inet6 地址: fe80::f051:e6ff:feb4:cace/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 跃点数:1
接收数据包:39 错误:0 丢弃:0 过载:0 帧数:0
发送数据包:85 错误:0 丢弃:0 过载:0 载波:0
碰撞:0 发送队列长度:0
接收字节:2787 (2.7 KB) 发送字节:10207 (10.2 KB)
容器网络配置信息：
root@jyq-virtual-machine:/home/jyq# docker run -it --network=host busybox
/ # ifconfig
docker0 Link encap:Ethernet HWaddr 02:42:16:58:29:48
inet addr:172.17.0.1 Bcast:172.17.255.255 Mask:255.255.0.0
inet6 addr: fe80::42:16ff:fe58:2948/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:39 errors:0 dropped:0 overruns:0 frame:0
TX packets:92 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2241 (2.1 KiB) TX bytes:11494 (11.2 KiB)
eth0 Link encap:Ethernet HWaddr 00:0C:29:78:D3:1E
inet addr:192.168.100.128 Bcast:192.168.100.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe78:d31e/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:482055 errors:0 dropped:0 overruns:0 frame:0
TX packets:320871 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:609238920 (581.0 MiB) TX bytes:39074119 (37.2 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:560 errors:0 dropped:0 overruns:0 frame:0
TX packets:560 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:55305 (54.0 KiB) TX bytes:55305 (54.0 KiB)
veth24e3ef4 Link encap:Ethernet HWaddr C6:F2:38:9B:E0:25
inet6 addr: fe80::c4f2:38ff:fe9b:e025/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:34 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:5106 (4.9 KiB)
vethbf1d8c4 Link encap:Ethernet HWaddr 56:94:85:F5:94:A9
inet6 addr: fe80::5494:85ff:fef5:94a9/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:79 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:11862 (11.5 KiB)
vethf8de0a7 Link encap:Ethernet HWaddr F2:51:E6:B4:CA:CE
inet6 addr: fe80::f051:e6ff:feb4:cace/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:39 errors:0 dropped:0 overruns:0 frame:0
TX packets:85 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2787 (2.7 KiB) TX bytes:10207 (9.9 KiB)
容器运行后使用host的网络配置，与host共享网络空间，可以看到和host的网络配置一致
- bridge
用户可创建自己的网络，使用bridge驱动
# 创建网络名称为my_netde 网络
[root@localhost ~]# docker network create --driver bridge --subnet 172.18.10.0/24 --gateway 172.18.10.1 my_net
bea2cc942d2af7037a51ea6e73610bc2e60c573374e59c97aee082e288cc6c3f
# 查看创建成功的网络
[root@localhost ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
bea2cc942d2a my_net bridge local
# 查看网络的具体配置信息
[root@localhost ~]# docker network inspect my_net
[
{
"Name": "my_net",
"Id": "bea2cc942d2af7037a51ea6e73610bc2e60c573374e59c97aee082e288cc6c3f",
"Created": "2019-03-06T13:33:52.02555834+08:00",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": {},
"Config": [
{
"Subnet": "172.18.10.0/24",
"Gateway": "172.18.10.1"
}
]
},
"Internal": false,
"Attachable": false,
"Containers": {},
"Options": {},
"Labels": {}
}
]
网络基本操作
查看网络
docker network ls
docker network inspect 网络名称
创建网络
docker network create --driver bridge --subnet 192.168.1.0/24 --gateway 192.168.100.1
运行容器连接到网络
docker run -it -d --network=网络名称 --name 容器名称 镜像名称
# 启动一个web01的容器将网络配置为自己新建的网络my_net上
[root@localhost ~]# docker run -d -it --network my_net -p 8080:80 --name web01 httpd
fe1a52a9a91c2f74407a72eaded72f4d78e95389eca4215692a037a73fd16d50
[root@localhost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
fe1a52a9a91c httpd "httpd-foreground" 6 seconds ago Up 4 seconds 0.0.0.0:8080->80/tcp web01
[root@localhost ~]# docker network inspect my_net
[
{
"Name": "my_net",
"Id": "bea2cc942d2af7037a51ea6e73610bc2e60c573374e59c97aee082e288cc6c3f",
"Created": "2019-03-06T13:33:52.02555834+08:00",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": {},
"Config": [
{
"Subnet": "172.18.10.0/24",
"Gateway": "172.18.10.1" #网关地址
}
]
},
"Internal": false,
"Attachable": false,
"Containers": {
"fe1a52a9a91c2f74407a72eaded72f4d78e95389eca4215692a037a73fd16d50": {
"Name": "web01",
"EndpointID": "9d770e90b4b9f2c09c4ad838320516fb08e8f715b35e05b0ef45b00a2535958b",
"MacAddress": "02:42:ac:12:0a:02",
"IPv4Address": "172.18.10.2/24", ##docker 为web01分配的ip地址
"IPv6Address": ""
}
},
"Options": {},
"Labels": {}
}
]
为容器分配静态ip地址
docker run -it -d --network=网络名称 --ip ip地址 --name 容器名称 镜像名称
只有手动指定subnet的网络才可以分配静态地址
[root@localhost ~]# docker run -d -it --network my_net --ip 172.18.10.5 -p 8088:80 --name web02 httpd
15000eb612ece2620aa57a15f8e67c433a5bc2e8e2a46f037195ced90213917c
[root@localhost ~]# docker network inspect my_net
[
{
"Name": "my_net",
"Id": "bea2cc942d2af7037a51ea6e73610bc2e60c573374e59c97aee082e288cc6c3f",
"Created": "2019-03-06T13:33:52.02555834+08:00",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": {},
"Config": [
{
"Subnet": "172.18.10.0/24",
"Gateway": "172.18.10.1"
}
]
},
"Internal": false,
"Attachable": false,
"Containers": {
"15000eb612ece2620aa57a15f8e67c433a5bc2e8e2a46f037195ced90213917c": {
"Name": "web02",
"EndpointID": "c9fea1d8fe8d7883b90a3ca47ba721bf76fc99af409c193c0f5c3e184736e2ba",
"MacAddress": "02:42:ac:12:0a:05",
"IPv4Address": "172.18.10.5/24",
"IPv6Address": ""
},
"fe1a52a9a91c2f74407a72eaded72f4d78e95389eca4215692a037a73fd16d50": {
"Name": "web01",
"EndpointID": "9d770e90b4b9f2c09c4ad838320516fb08e8f715b35e05b0ef45b00a2535958b",
"MacAddress": "02:42:ac:12:0a:02",
"IPv4Address": "172.18.10.2/24",
"IPv6Address": ""
}
},
"Options": {},
"Labels": {}
}
]
将一个容器连接到已有网络：
docker network connect 网络名称 容器名称/id
容器间通信：
- IP通信
创建两个链接在同一网络下的容器测试网络连通性：
[root@localhost ~]# docker run -it --network my_net --name test01 busybox
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:12:0A:03
inet addr:172.18.10.3 Bcast:0.0.0.0 Mask:255.255.255.0 ## docker 为其分配的ip地址
inet6 addr: fe80::42:acff:fe12:a03/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:508 (508.0 B) TX bytes:508 (508.0 B)
[root@localhost ~]# docker run -it --network my_net --name test02 busybox
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:12:0A:04
inet addr:172.18.10.4 Bcast:0.0.0.0 Mask:255.255.255.0 ## docker 为其分配的ip地址
inet6 addr: fe80::42:acff:fe12:a04/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:508 (508.0 B) TX bytes:508 (508.0 B)
## ping测试 在.4中可以ping通.3 ,说明在同一个网络里容器时可以互相通信的
/ # ping 172.18.10.3
PING 172.18.10.3 (172.18.10.3): 56 data bytes
64 bytes from 172.18.10.3: seq=0 ttl=64 time=0.392 ms
64 bytes from 172.18.10.3: seq=1 ttl=64 time=0.105 ms
64 bytes from 172.18.10.3: seq=2 ttl=64 time=0.147 ms
^C
--- 172.18.10.3 ping statistics ---
创建链接在不同网络下的容器测试网络连通性
root@localhost ~]# docker run -it --name test03 busybox
/ #
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02
inet addr:172.17.0.2 Bcast:0.0.0.0 Mask:255.255.0.0
inet6 addr: fe80::42:acff:fe11:2/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:19 errors:0 dropped:0 overruns:0 frame:0
TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2196 (2.1 KiB) TX bytes:578 (578.0 B)
/ # ping 172.18.10.4
PING 172.18.10.4 (172.18.10.4): 56 data bytes
^C
--- 172.18.10.4 ping statistics ---
14 packets transmitted, 0 packets received, 100% packet loss 不能相互通信
##查看路由表，查看主机ip forwording是否打开
[root@localhost ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1======路由转发已经打开
[root@localhost ~]# ip route
default via 192.168.136.2 dev ens33 proto static metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 ===================host已经存在路由
172.18.10.0/24 dev br-bea2cc942d2a proto kernel scope link src 172.18.10.1 ==========host已经存在路由
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1
192.168.136.0/24 dev ens33 proto kernel scope link src 192.168.136.132 metric 100
疑问！！host路由转发已经打开并且已经存在两个网络的路由，为什么还是不同网络的容器不能互相访问，请看iptables表项：
可以看到两个网桥双向流量都被丢弃。
[root@localhost ~]# iptables-save
-A DOCKER-ISOLATION -i docker0 -o br-bea2cc942d2a -j DROP
-A DOCKER-ISOLATION -i br-bea2cc942d2a -o docker0 -j DROP
直接使用docker network connect 命令为需要通信的容器分配相同网络的网卡
# 将test03连接到自己新建的网络my_net
[root@localhost ~]# docker network connect my_net test03
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02
inet addr:172.17.0.2 Bcast:0.0.0.0 Mask:255.255.0.0
inet6 addr: fe80::42:acff:fe11:2/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:23 errors:0 dropped:0 overruns:0 frame:0
TX packets:23 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2448 (2.3 KiB) TX bytes:2062 (2.0 KiB)
eth1 Link encap:Ethernet HWaddr 02:42:AC:12:0A:06
inet addr:172.18.10.6 Bcast:0.0.0.0 Mask:255.255.255.0 #新增一快网卡，网卡地址为my_net 地址段
inet6 addr: fe80::42:acff:fe12:a06/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:508 (508.0 B) TX bytes:508 (508.0 B)
# ping测试
/ # ping 172.18.10.3 可以和test2 的地址通信
PING 172.18.10.3 (172.18.10.3): 56 data bytes
64 bytes from 172.18.10.3: seq=0 ttl=64 time=0.451 ms
64 bytes from 172.18.10.3: seq=1 ttl=64 time=0.138 ms
- docker dns server
当网络是用户自建网络时，在容器运行时通过--name 容器名 指定容器名称后，以后可以使用容器名称通信
/ # ping test01
PING test01 (172.18.10.3): 56 data bytes
64 bytes from 172.18.10.3: seq=0 ttl=64 time=0.270 ms
64 bytes from 172.18.10.3: seq=1 ttl=64 time=0.120 ms
- joined容器
在容器运行时，使用--network=container:容器名称 直接将容器连接到指定容器的网络与指定容器共享地址
创建容器test04连接到test02
[root@localhost ~]# docker run -it --network=container:test02 busybox
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:12:0A:04
inet addr:172.18.10.4 Bcast:0.0.0.0 Mask:255.255.255.0 ## 和test02的ip地址和mac地址都一样，说明网络共用
inet6 addr: fe80::42:acff:fe12:a04/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:23 errors:0 dropped:0 overruns:0 frame:0
TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1758 (1.7 KiB) TX bytes:1026 (1.0 KiB)
容器与外部网络通信
- 容器访问外部世界
默认情况下容器能访问外部网络，通过使用源地址转换
[root@localhost ~]# iptables -t nat -S
-A POSTROUTING -s 172.18.10.0/24 ! -o br-bea2cc942d2a -j MASQUERADE
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
## 可以看到发送到非自身网络的流量都走MASQUERADE，也就是源地址转换
- 外部世界访问容器
在运行容器时通过指定-p 外部端口:容器端口，将容器服务端口映射出去，从而实现外部世界能够访问容器
可以使用iptables -t nat -S 查看所在容器网络的nat转换表
以下为web01 和web02 配置地址转换后的地址转化表
[root@localhost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
15000eb612ec httpd "httpd-foreground" 3 hours ago Up 3 hours 0.0.0.0:8088->80/tcp web02
fe1a52a9a91c httpd "httpd-foreground" 3 hours ago Up 3 hours 0.0.0.0:8080->80/tcp web01
[root@localhost ~]# iptables -t nat -S
-A DOCKER ! -i br-bea2cc942d2a -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.18.10.2:80
-A DOCKER ! -i br-bea2cc942d2a -p tcp -m tcp --dport 8088 -j DNAT --to-destination 172.18.10.5:80
# 访问转换后的虚拟地址就能访问到容器内部地址如下：
[root@localhost ~]# curl 127.0.0.1:8088
It works!
[root@localhost ~]# curl 127.0.0.1:8088
It works!
[root@localhost ~]# curl 127.0.0.1:8080
It works!
。。。。待续！！！