Docker网络模型

1. Docker支持的网络类型

# 查看docker支持的网络类型
[root@bdc01 ~]# docker network ls 
NETWORK ID          NAME                DRIVER              SCOPE
f40c126df9e7        bridge              bridge              local
1012f87c966b        host                host                local
f6e867b802ac        none                null                local

bridge网络类型：相当于搭建虚拟机时候使用的NAT网络模型：

# 宿主机安装docker之后，生成了一块网卡,IP为172.17.0.1
# 后续启动的容器，其网段就是172.17.0.0，IP地址从2开始递增，启动的第一个容器的IP为172.17.0.2，第二个容器的IP地址为172.17.0.3，依此类推
# 在172.17.0.0网段之内的各个容器之间、容器与宿主机之间都可以进行网络访问
# 容器也可以通过宿主机的网卡访问外网，前提是宿主机本身可以访问外网
# 但是跨主机的容器之间是无法访问的
docker0: flags=4099  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet6 fe80::42:2cff:fef3:7b26  prefixlen 64  scopeid 0x20
        ether 02:42:2c:f3:7b:26  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3  bytes 266 (266.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

host网络类型：容器与宿主机共用网络模式，即容器的IP与宿主机的一样，容器内开通的端口就是占用宿主机同样的端口，包括主机名都是相同的

container网络类型：容器与容器之间共用网络模式，即各个容器的IP一样，端口也是使用的一套端口，不能重复

none网络类型：无网络

# 启动容器的时候可以设置网络类型，默认就是bridge
docker container run -it --name centos6.9 --network bridge centos:6.9 /bin/bash

2. Docker跨主机网络

Docker容器之间的跨主机访问有很多实现方法，macvlan和overlay是两种轻量级的方式

2.1 macvlan方式实现Docker跨主机网络

# 创建名为"macvlan_1"的网络通道，并设置了其网段，网卡名
[root@bdc01 ~]# docker network create --driver macvlan --subnet=100.0.0.0/24 --gateway=100.0.0.254 -o parent=eth0 macvlan_1
02eb9a47bd4bd9b7e42f744b921a43987be9556cb08ea89dc2beb316673daf84
# 另一台机器上也用相同的方式创建了名为"macvlan_1"的网络通道
[root@bdc02 ~]# docker network create --driver macvlan --subnet=100.0.0.0/24 --gateway=100.0.0.254 -o parent=eth0 macvlan_1
7fd34135700dd47c8164a571fe7f671bb85948f39644f5e51ddbce937fb11481

# 分别在两台机器上启动容器
# 由于默认没有ping命令，且容器内不能访问外网安装ping命令，所以我用有ping命令的镜像启动的容器，镜像是自己制作的
[root@bdc01 ~]# docker run -it --network macvlan_1 --ip 100.0.0.1 yyh/centos6.9:v1.0 /bin/bash
[root@dff3a3697efe /]# ifconfig 
eth0      Link encap:Ethernet  HWaddr 02:42:64:00:00:01  
          inet addr:100.0.0.1  Bcast:100.0.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:60 (60.0 b)  TX bytes:0 (0.0 b)
...

[root@bdc02 ~]# docker run -it --network macvlan_1 --ip 100.0.0.2 yyh/centos6.9:v1.0 /bin/bash
[root@34cd6063adf2 /]# ifconfig  
eth0      Link encap:Ethernet  HWaddr 02:42:64:00:00:01  
          inet addr:100.0.0.2  Bcast:100.0.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:276 (276.0 b)  TX bytes:0 (0.0 b)
...

# 容器之间可以ping通
[root@dff3a3697efe /]# ping 100.0.0.2
PING 100.0.0.2 (100.0.0.2) 56(84) bytes of data.
64 bytes from 100.0.0.2: icmp_seq=1 ttl=64 time=0.416 ms
64 bytes from 100.0.0.2: icmp_seq=2 ttl=64 time=3.74 ms
...
[root@34cd6063adf2 /]# ping 100.0.0.1
PING 100.0.0.1 (100.0.0.1) 56(84) bytes of data.
64 bytes from 100.0.0.1: icmp_seq=1 ttl=64 time=0.790 ms
64 bytes from 100.0.0.1: icmp_seq=2 ttl=64 time=1.09 ms

macvlan方式的缺点：容器不能访问外网，且两台容器的IP可以相同

2.2 overlay方式实现Docker跨主机网络

# 1.启动consul容器，实现网络的统一配置管理
docker run -d -p 8500:8500 -h consul --name consul progrium/consul -server -bootstrap

# 2.Docker所有的客户端修改配置文件，重启docker服务
vim /etc/docker/daemon.json

{
  # IP是宿主机的IP
  ...
  "hosts":["tcp://0.0.0.0:2376","unix:///var/run/docker.sock"],
  "cluster-store": "consul://10.0.0.11:8500",
  "cluster-advertise": "10.0.0.11:2376"
}

systemctl daemon-reload
systemctl restart docker

# 3.创建overlay网络，只需要在一个节点创建
[root@bdc01 ~]# docker network create -d overlay --subnet 172.16.0.0/24 --gateway 172.16.0.254  overlay
b6ed34ef1071d48f1990dc4fe68b57c3323ebae5be45d3750d86ad4f4a9ab620

# 4.启动容器测试
[root@bdc01 ~]# docker run -it --network overlay busybox /bin/sh
Unable to find image 'busybox:latest' locally
latest: Pulling from library/busybox
9758c28807f2: Pull complete 
Digest: sha256:a9286defaba7b3a519d585ba0e37d0b2cbee74ebfe590960b0b1d6a5e97d1e1d
Status: Downloaded newer image for busybox:latest
/ # ifconfig
# 每个容器有两块网卡,eth0实现容器间的通讯,eth1实现容器访问外网
eth0      Link encap:Ethernet  HWaddr 02:42:AC:10:00:01  
          inet addr:172.16.0.1  Bcast:172.16.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1450  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth1      Link encap:Ethernet  HWaddr 02:42:AC:13:00:02  
          inet addr:172.19.0.2  Bcast:172.19.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1222 (1.1 KiB)  TX bytes:0 (0.0 B)
...
/ # ping www.baidu.com
PING www.baidu.com (220.181.38.150): 56 data bytes
64 bytes from 220.181.38.150: seq=0 ttl=127 time=6.180 ms
64 bytes from 220.181.38.150: seq=1 ttl=127 time=13.048 ms

[root@bdc02 sshd]# docker run -it --network overlay busybox /bin/sh
Unable to find image 'busybox:latest' locally
latest: Pulling from library/busybox
9758c28807f2: Pull complete 
Digest: sha256:a9286defaba7b3a519d585ba0e37d0b2cbee74ebfe590960b0b1d6a5e97d1e1d
Status: Downloaded newer image for busybox:latest
/ # ifconfig
eth0      Link encap:Ethernet  HWaddr 02:42:AC:10:00:02  
          inet addr:172.16.0.2  Bcast:172.16.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1450  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth1      Link encap:Ethernet  HWaddr 02:42:AC:12:00:02  
          inet addr:172.18.0.2  Bcast:172.18.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1222 (1.1 KiB)  TX bytes:0 (0.0 B)
...
/ # ping www.baidu.com
PING www.baidu.com (220.181.38.150): 56 data bytes
64 bytes from 220.181.38.150: seq=0 ttl=127 time=7.446 ms
64 bytes from 220.181.38.150: seq=1 ttl=127 time=9.846 ms

这里，跨主机的两个容器可以访问外网，但是互相不能ping通....原因以及解决方案待更新