清除所有的不用的镜像、容器、数据卷、网络
dcoekr system prune
[root@k8s2 harbor]# docker network ls
NETWORK ID NAME DRIVER SCOPE
696489daaaf3 bridge bridge local
daf109ce4ab0 host host local
41928efc6031 none null local
• bridge模式下容器没有一个公有ip,只有宿主机可以直接访问,外部主机
是不可见的。
• 容器通过宿主机的NAT规则后可以访问外网。
[root@k8s2 harbor]# docker run -it --rm busybox
/ # ip addr
1: lo: ,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
23: eth0@if24: ,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
yum install -y bridge-utils
docker安装时会创建一个名为 docker0 的Linux bridge,新建的容器
会自动桥接到这个接口。
[root@k8s2 harbor]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.02425d314189 no
[root@k8s2 harbor]# ip addr
1: lo: ,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth0: ,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:16:3e:09:e9:3a brd ff:ff:ff:ff:ff:ff
inet 172.27.84.9/20 brd 172.27.95.255 scope global dynamic eth0
valid_lft 315359423sec preferred_lft 315359423sec
3: docker0: ,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:5d:31:41:89 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
防火墙策略查看
[root@k8s2 harbor]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (1 references)
target prot opt source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target prot opt source destination
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target prot opt source destination
DROP all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
[root@k8s2 harbor]# docker run -d --name vm1 nginx
69935dabfb2a1f059b8ed97c7a2da1c58825a7bdc4edc84f79b2e55eff950d99
[root@k8s2 harbor]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
69935dabfb2a nginx "/docker-entrypoint.…" 4 seconds ago Up 3 seconds 80/tcp vm1
[root@k8s2 harbor]# docker inspect vm1|grep Pid
"Pid": 11664,
"PidMode": "",
"PidsLimit": null,
[root@k8s2 harbor]# cd /proc/11664
[root@k8s2 11664]# ls
attr cmdline environ io mem ns pagemap sched stack task
autogroup comm exe limits mountinfo numa_maps patch_state schedstat stat timers
auxv coredump_filter fd loginuid mounts oom_adj personality sessionid statm uid_map
cgroup cpuset fdinfo map_files mountstats oom_score projid_map setgroups status wchan
clear_refs cwd gid_map maps net oom_score_adj root smaps syscall
[root@k8s2 11664]# cd ns/
[root@k8s2 ns]# ls
ipc mnt net pid user uts
docker inspect vm1
可查看vm1容器被分配到ip地址
[root@k8s2 ns]# curl 172.17.0.2
<!DOCTYPE html>
Welcome to nginx!</title>