Docker 的几种网络配置1. bridge2. host3. container4. none1. bridge当docker进程启动时会在主机上创建一个名为docker0的虚拟网桥此主机上的docker容器会链接到这个虚拟网桥上。虚拟网桥的工作方式和交换机类似这样主机上的所有容器就通过交换机连接在了一个二层网络中。从docker0子网中分配一个IP给容器使用并设置docker0的IP地址为容器的默认网关。在主机上创建一对虚拟网卡veth pair 设备Docker将veth pair设备的一端放在容器中并命名为eth0(容器的网卡)另一端放在主机中以vethxxx这样的类似的名字命名并将这个网络设备加入到docker网桥中。可以通过brctl show命令查看。[rootlocalhost /]# brctl show bridge name bridge id STP enabled interfaces docker0 8000.02420fde8acb no veth10e3061bridge 是docker默认的网络模式我们只使用docker run 不加-net指定网络模式默认的就是这个模式。使⽤docker run -d -p 80:80 nginx时docker 实际是在 iptables 做了 DNAT 规则实现端⼝转发功能。可以使⽤iptables -t nat -vnL查看。bridge 模式如下图所示演示先创建一个虚拟网桥docker network create -d bridge my-net[rootlocalhost docker]# docker network create -d bridge my-net ee2f3aa673263ba5439c2b9c4d339f6be43a5c665d06741f645c3cc8215baf15-d 指定网络类型有bridge 和 overlay两种overlay用于Swarm mode运行并连接到新建的网络docker run -it --rm --name busybox1 --network my-net busybox sh[rootlocalhost docker]# docker run -it --rm --name busybox1 --network my-net busybox sh Unable to find image busybox:latest locally latest: Pulling from library/busybox d9cbbca60e5f: Pull complete Digest: sha256:836945da1f3afe2cfff376d379852bbb82e0237cb2925d53a13f53d6e8a8c48c Status: Downloaded newer image for busybox:latest / #打开另一个终端在运行并连接到新建网络docker run -it --rm --name busybox2 --network my-net busybox sh[rootlocalhost ~]# docker run -it --rm --name busybox2 --network my-net busybox sh / # ifconfig eth0 Link encap:Ethernet HWaddr 02:42:AC:12:00:03 inet addr:172.18.0.3 Bcast:172.18.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:8 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:656 (656.0 B) TX bytes:0 (0.0 B) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) / # ping 172.18.0.2 PING 172.18.0.2 (172.18.0.2): 56 data bytes 64 bytes from 172.18.0.2: seq0 ttl64 time0.059 ms 64 bytes from 172.18.0.2: seq1 ttl64 time0.068 ms 64 bytes from 172.18.0.2: seq2 ttl64 time0.064 ms 64 bytes from 172.18.0.2: seq3 ttl64 time0.065 ms 64 bytes from 172.18.0.2: seq4 ttl64 time0.078 ms ^C --- 172.18.0.2 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max 0.059/0.066/0.078 ms / #在第一个新建的busybox1中pingbusybox2/ # ifconfig eth0 Link encap:Ethernet HWaddr 02:42:AC:12:00:02 inet addr:172.18.0.2 Bcast:172.18.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:16 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1312 (1.2 KiB) TX bytes:0 (0.0 B) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) / # ping 172.18.0.3 PING 172.18.0.3 (172.18.0.3): 56 data bytes 64 bytes from 172.18.0.3: seq0 ttl64 time0.202 ms 64 bytes from 172.18.0.3: seq1 ttl64 time0.061 ms 64 bytes from 172.18.0.3: seq2 ttl64 time0.315 ms 64 bytes from 172.18.0.3: seq3 ttl64 time0.068 ms ^C --- 172.18.0.3 ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max 0.061/0.161/0.315 ms / #查看一个主机虚拟网桥br-ee2f3aa67326就是my-net[rootlocalhost ~]# ifconfig br-ee2f3aa67326: flags4163UP,BROADCAST,RUNNING,MULTICAST mtu 1500 inet 172.18.0.1 netmask 255.255.0.0 broadcast 172.18.255.255 inet6 fe80::42:60ff:febf:82f2 prefixlen 64 scopeid 0x20link ether 02:42:60:bf:82:f2 txqueuelen 0 (Ethernet) RX packets 12 bytes 1008 (1008.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 28 bytes 2320 (2.2 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 docker0: flags4163UP,BROADCAST,RUNNING,MULTICAST mtu 1500 inet 172.17.0.1 netmask 255.255.0.0 broadcast 0.0.0.0 inet6 fe80::42:fff:fede:8acb prefixlen 64 scopeid 0x20link ether 02:42:0f:de:8a:cb txqueuelen 0 (Ethernet) RX packets 173 bytes 13867 (13.5 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 113 bytes 9658 (9.4 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ens33: flags4163UP,BROADCAST,RUNNING,MULTICAST mtu 1500 inet 192.168.110.136 netmask 255.255.255.0 broadcast 192.168.110.255 inet6 fe80::2e65:af6f:2d5d:5acc prefixlen 64 scopeid 0x20link ether 00:0c:29:33:99:ac txqueuelen 1000 (Ethernet) RX packets 1048441 bytes 907093889 (865.0 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 613943 bytes 67627865 (64.4 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags73UP,LOOPBACK,RUNNING mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10host loop txqueuelen 1000 (Local Loopback) RX packets 214 bytes 20449 (19.9 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 214 bytes 20449 (19.9 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 veth1843878: flags4163UP,BROADCAST,RUNNING,MULTICAST mtu 1500 inet6 fe80::d876:fcff:fea7:5228 prefixlen 64 scopeid 0x20link ether da:76:fc:a7:52:28 txqueuelen 0 (Ethernet) RX packets 12 bytes 1008 (1008.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 28 bytes 2320 (2.2 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 veth10e3061: flags4163UP,BROADCAST,RUNNING,MULTICAST mtu 1500 inet6 fe80::54d5:32ff:fece:c43d prefixlen 64 scopeid 0x20link ether 56:d5:32:ce:c4:3d txqueuelen 0 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 8 bytes 656 (656.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 veth71126a7: flags4163UP,BROADCAST,RUNNING,MULTICAST mtu 1500 inet6 fe80::5094:6fff:fe2e:5b20 prefixlen 64 scopeid 0x20link ether 52:94:6f:2e:5b:20 txqueuelen 0 (Ethernet) RX packets 12 bytes 1008 (1008.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 20 bytes 1664 (1.6 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 [rootlocalhost ~]#之所以是172.18而不是172.17是因为有一个nginx使用bridge而新建busybox的使用my-netdocker network ls[rootlocalhost docker]# docker network ls NETWORK ID NAME DRIVER SCOPE 26a939b44652 bridge bridge local 4c49d87c423a host host local ee2f3aa67326 my-net bridge local 38981edf292a none null local查看容器信息这里查看的是nginxdocker inspect gracious_roentgen[rootlocalhost ~]# brctl show bridge name bridge id STP enabled interfaces br-ee2f3aa67326 8000.024260bf82f2 no veth1843878 veth71126a7 docker0 8000.02420fde8acb no veth10e3061 [rootlocalhost ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 498013203fe7 busybox sh 18 minutes ago Up 18 minutes busybox2 c24a3737ca3c busybox sh 19 minutes ago Up 19 minutes busybox1 53450637c41a nginx:latest nginx -g daemon of… About an hour ago Up About an hour 0.0.0.0:80-80/tcp gracious_roentgen [rootlocalhost ~]# docker inspect gracious_roentgen [ { ... NetworkSettings: { ... Networks: { bridge: { IPAMConfig: null, Links: null, Aliases: null, NetworkID: 26a939b44652765b61581ef9de0859c5861788c49bcf4fec4ece68215cd95073, EndpointID: 816bfdb505ca0bb720440d608a4c36acdb1731accf7bc1c8a98d6d52f69096ac, Gateway: 172.17.0.1, IPAddress: 172.17.0.2, IPPrefixLen: 16, IPv6Gateway: , GlobalIPv6Address: , GlobalIPv6PrefixLen: 0, MacAddress: 02:42:ac:11:00:02, DriverOpts: null } } } } ] [rootlocalhost ~]#删除自建的虚拟网桥docker network rm ee2f3aa67326[rootlocalhost docker]# docker network rm ee2f3aa67326 ee2f3aa673262. host如果启动容器的时候使用 host 模式那么这个容器将不会获得⼀个独立的 Network Namespace 而是和宿主机共⽤⼀个 Network Namespace。容器将不会虚拟出自己的网卡配置自己的 IP 等而是使用宿主机的 IP 和端口。但是容器的其他方面如文件系统、进程列表等还是和宿主机隔离的。Host模式如下图所示使用主机模式运行容器会发现和主机的网络空间是一样的docker run -it --rm --name busybox1 --nethost busybox sh[rootlocalhost ~]# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES [rootlocalhost ~]# docker run -it --rm --name busybox1 --nethost busybox sh / # ifconfig docker0 Link encap:Ethernet HWaddr 02:42:0F:DE:8A:CB inet addr:172.17.0.1 Bcast:0.0.0.0 Mask:255.255.0.0 inet6 addr: fe80::42:fff:fede:8acb/64 Scope:Link UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:173 errors:0 dropped:0 overruns:0 frame:0 TX packets:113 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:13867 (13.5 KiB) TX bytes:9658 (9.4 KiB) ens33 Link encap:Ethernet HWaddr 00:0C:29:33:99:AC inet addr:192.168.110.136 Bcast:192.168.110.255 Mask:255.255.255.0 inet6 addr: fe80::2e65:af6f:2d5d:5acc/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1060021 errors:0 dropped:0 overruns:0 frame:0 TX packets:630427 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:908344370 (866.2 MiB) TX bytes:69546957 (66.3 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:214 errors:0 dropped:0 overruns:0 frame:0 TX packets:214 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:20449 (19.9 KiB) TX bytes:20449 (19.9 KiB) / #3. container这个模式指定新创建的容器和已经存在的⼀个容器共享⼀个 Network Namespace而不是和宿主机共享。新创建的容器不会创建自己的网卡配置配置的 IP而是和⼀个指定的容器共享 IP、端口范围等。同样两个容器除了网络方面其他的如文件系统、进程列表等还是隔离的。两个容器的进程可以通过 lo 网卡设备通信。 Container模式示意图运行一个容器busybox1docker run -it --rm --name busybox1 busybox sh[rootlocalhost ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES [rootlocalhost ~]# docker run -it --rm --name busybox1 busybox sh / # ifconfig eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02 inet addr:172.17.0.2 Bcast:172.17.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:8 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:656 (656.0 B) TX bytes:0 (0.0 B) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) / #使用busybox1的网络运行busybox2docker run -it --rm --name busybox2 --netcontainer:busybox1 busybox sh[rootlocalhost ~]# docker run -it --rm --name busybox2 --netcontainer:busybox1 busybox sh / # ifconfig eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02 inet addr:172.17.0.2 Bcast:172.17.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:8 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:656 (656.0 B) TX bytes:0 (0.0 B) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) / #在未删除容器前查看主机网络[rootlocalhost ~]# ifconfigdocker0:flags4163UP,BROADCAST,RUNNING,MULTICASTmtu1500inet172.17.0.1 netmask255.255.0.0 broadcast0.0.0.0 inet6 fe80::42:fff:fede:8acb prefixlen64scopeid 0x20linkether 02:42:0f:de:8a:cb txqueuelen0(Ethernet)RX packets173bytes13867(13.5KiB)RX errors0dropped0overruns0frame0TX packets113bytes9658(9.4KiB)TX errors0dropped0overruns0carrier0collisions0ens33:flags4163UP,BROADCAST,RUNNING,MULTICASTmtu1500inet192.168.110.136 netmask255.255.255.0 broadcast192.168.110.255 inet6 fe80::2e65:af6f:2d5d:5acc prefixlen64scopeid 0x20linkether 00:0c:29:33:99:ac txqueuelen1000(Ethernet)RX packets1063057bytes908801394(866.7MiB)RX errors0dropped0overruns0frame0TX packets633428bytes69913689(66.6MiB)TX errors0dropped0overruns0carrier0collisions0lo:flags73UP,LOOPBACK,RUNNINGmtu65536inet127.0.0.1 netmask255.0.0.0 inet6 ::1 prefixlen128scopeid 0x10hostloop txqueuelen1000(Local Loopback)RX packets214bytes20449(19.9KiB)RX errors0dropped0overruns0frame0TX packets214bytes20449(19.9KiB)TX errors0dropped0overruns0carrier0collisions0veth0ebcc94:flags4163UP,BROADCAST,RUNNING,MULTICASTmtu1500inet6 fe80::b459:3aff:fe1d:f652 prefixlen64scopeid 0x20linkether b6:59:3a:1d:f6:52 txqueuelen0(Ethernet)RX packets0bytes0(0.0B)RX errors0dropped0overruns0frame0TX packets8bytes656(656.0B)TX errors0dropped0overruns0carrier0collisions04. none使用 none 模式Docker 容器拥有自己的 Network Namespace但是并不为Docker 容器进行任何网络配置。也就是说这个 Docker 容器没有网卡、IP、路由等信息。需要我们自己为 Docker 容器添加网卡、配置 IP 等。 None模式示意图:运行一个none网络配置的容器docker run -it --rm --name busybox --netnone busybox sh[rootlocalhost ~]# docker run -it --rm --name busybox --netnone busybox sh / # ifconfig lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) / #