实例解析Docker网络管理机制(bridge network,overlay network),介绍Docker默认的网络方式,并创建自己的网络桥接方式,将开发的容器添加至自己新建的网络,提高Docker网络安全和通信.
给docker名称的好处是:
- 容易记
- 可以通过特殊命令,使得名称可以在容器和容器之间使用
wxl@wxl-pc:~$ docker images
wxl@wxl-pc:~$ docker run -d -P --name wangxiaoleiweb training/webapp python app.py
最后一行可以看到wangxiaoleiweb已经命名成功
可以使用docker inspect通过刚刚设置的名称来查看wangxiaoleiweb
wxl@wxl-pc:~$ docker inspect wangxiaoleiweb
#停止运行中的镜像
wxl@wxl-pc:~$ docker stop wangxiaoleiweb
#删除自定义的名称
docker rm wangxiaoleiweb
web
wxl@wxl-pc:~$ docker rm web
web
wxl@wxl-pc:~$ docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
centos latest 50dae1ee8677 2 weeks ago 196.7 MB
hello-world latest c54a2cc56cbb 4 weeks ago 1.848 kB
training/webapp latest 6fae60ef3446 14 months ago 348.8 MB
training/sinatra latest 49d952a36c58 2 years ago 447 MB
#查看Docker默认的三种网络
wxl@wxl-pc:~$ docker network ls
NETWORK ID NAME DRIVER SCOPE
7f6b9cbd3eec bridge bridge local
0cb106f52e66 host host local
cfb50541161b none null local
为一个容器桥接网络
wxl@wxl-pc:~$ docker run -itd --name=networktest ubuntu:14.04
2a433c9467d3d35474daa544dcac665ecc4b71b202b82d0bd59049f7d52e397f
wxl@wxl-pc:~$ docker network inspect bridge
[
{
"Name": "bridge",
"Id": "7f6b9cbd3eece7301d196363b5250c44fd0b275f3c3d38a952af2ad8b2fd38c2",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},
"Internal": false,
"Containers": {
"2a433c9467d3d35474daa544dcac665ecc4b71b202b82d0bd59049f7d52e397f": {
"Name": "networktest",
"EndpointID": "d0b94ec934b390784faa5ad8946e9ba6031afe4467889e1f7fe0eda5d79deac1",
"MacAddress": "02:42:ac:11:00:02",
"IPv4Address": "172.17.0.2/16",
"IPv6Address": ""
}
},
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Labels": {}
}
]
可以看到通过检查网络可以看到容器的IP地址,名称等信息.
wxl@wxl-pc:~$ docker network disconnect bridge networktest
再用docker network inspect bridge
会发现已经没有networktest信息了
容器的网络(network)是用来隔离容器和容器之间或者网络与网络之间的方法,所以,所以我们通过建立网络来隔离容器.其中,内置的bridge网络是无法删除的.
Docker Engine 支持两种网络桥接网络(bridge network)和覆盖网络(overlay network),桥接的网络局限于单个主机运行的Docker Engine,而覆盖网络可以包含多个主机.
wxl@wxl-pc:~$ docker network create -d bridge my-bridge-network
3bfde1ba62a75e38236517f4f0731f48c281cec107e976039773be134968c453
其中,-d
指使用Dockerbridge
(桥接)方式的网络,如果没有加默认的也是桥接网络.
通过docker network ls
来查看已经创建好的网络
#这里创建了一个db的容器(若本地没有该镜像会自动拉取)
wxl@wxl-pc:~$ docker run -d --network=my-bridge-network --name db training/postgres
通过inspect命令查看已经添加至网络的db容器
wxl@wxl-pc:~$ docker inspect --format='{{json .NetworkSettings.Networks}}' db
{"my-bridge-network":{"IPAMConfig":null,"Links":null,"Aliases":["237e0f7060b6"],"NetworkID":"3bfde1ba62a75e38236517f4f0731f48c281cec107e976039773be134968c453","EndpointID":"33516faca38c0f76bd2c6ebb6e8c2574c62e242d5a0c10b77c49e14b2549f3e5","Gateway":"172.18.0.1","IPAddress":"172.18.0.2","IPPrefixLen":16,"IPv6Gateway":"","GlobalIPv6Address":"","GlobalIPv6PrefixLen":0,"MacAddress":"02:42:ac:12:00:02"}}
wxl@wxl-pc:~$ docker run -d --name web training/webapp python app.py
8f12cfaaedda2b348bef437fa2eeed19ef69ad07cd98aa72e0c2113710413e6f
wxl@wxl-pc:~$ docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' web
172.17.0.2
#进入db容器
wxl@wxl-pc:~$ docker exec -it db bash
#首次尝试ping web容器
root@237e0f7060b6:/# ping 172.17.0.2
PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.
^C
--- 172.17.0.2 ping statistics ---
24 packets transmitted, 0 received, 100% packet loss, time 23183ms
root@237e0f7060b6:/# exit
wxl@wxl-pc:~$ docker network connect my-bridge-network web
#再次进入db容器
wxl@wxl-pc:~$ docker exec -it db bash
#ping web容器,发现已经可以ping通
root@237e0f7060b6:/# ping web
PING web (172.18.0.3) 56(84) bytes of data.
64 bytes from web.my-bridge-network (172.18.0.3): icmp_seq=1 ttl=64 time=0.097 ms
64 bytes from web.my-bridge-network (172.18.0.3): icmp_seq=2 ttl=64 time=0.110 ms
64 bytes from web.my-bridge-network (172.18.0.3): icmp_seq=3 ttl=64 time=0.109 ms
^C
--- web ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1998ms
rtt min/avg/max/mdev = 0.097/0.105/0.110/0.010 ms
可见,不同的容器在不同的网络是可以起到隔离作用的,所以,自定义一个网络可以保证容器和容器之间通信安全.