容器网络
1. 网络模式¶
定义 | 描述 |
---|---|
bridge | –net=bridge,默认网络,Docker启动后创建一个docker0网桥,默认创建的容器也是添加到这个网桥中。 |
host | -net=host,容器不会获得一个独立的network namespace,而是与宿主机共用一个。这就意味着容器不会有自己的网卡信息,而是使用宿主机的。容器除了网络,其他都是隔离的。 |
none | -net=none,获取独立的network namespace,但不为容器进行任何网络配置,需要我们手动配置。 |
container | -net=container:Name/ID,与指定的容器使用同一个network namespace,具有同样的网络配置信息,两个容器除了网络,其他都还是隔离的。 |
自定义网络 | 与默认的bridge原理一样,但自定义网络具备内部DNS发现,可以通过容器名或者主机名容器之间网络通信。 |
1.1 bridge¶
docker的默认使用bridge。当Docker进程启动时,会在主机上创建一个名为docker0的虚拟网桥,此主机上启动的Docker容器会连接到这个虚拟网桥上。虚拟网桥的工作方式和物理交换机类似,这样主机上的所有容器就通过交换机连在了一个二层网络中。
d从docker0子网中分配一个IP给容器使用,并设置docker0的IP地址为容器的默认网关。在主机上创建一对虚拟网卡veth pair设备,Docker将veth pair设备的一端放在新创建的容器中,并命名为eth0(容器的网卡),另一端放在主机中,以vethxxx这样类似的名字命名,并将这个网络设备加入到docker0网桥中。可以通过brctl show命令查看。
dbridge模式是docker的默认网络模式,不写--net参数,就是bridge模式。使用docker run -p时,docker实际是在iptables做了DNAT规则,实现端口转发功能。可以使用iptables -t nat -vnL查看。

docker run -tid --net=bridge --name docker_bri1 nginx docker run -tid --net=bridge --name docker_bri2 nginx brctl show docker exec -ti docker_bri1 /bin/bash docker exec -ti docker_bri1 /bin/bash ifconfig –a route –n
操作
[root@localhost ~]# ifconfig docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255 inet6 fe80::42:8aff:febb:5880 prefixlen 64 scopeid 0x20<link> ether 02:42:8a:bb:58:80 txqueuelen 0 (Ethernet) RX packets 57 bytes 7304 (7.1 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 81 bytes 5746 (5.6 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.186.139 netmask 255.255.255.0 broadcast 192.168.186.255 inet6 fe80::7bc6:bc62:db29:8a1b prefixlen 64 scopeid 0x20<link> ether 00:0c:29:94:bd:ca txqueuelen 1000 (Ethernet) RX packets 407793 bytes 562312090 (536.2 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 128762 bytes 8661406 (8.2 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 1000 (Local Loopback) RX packets 408 bytes 29445 (28.7 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 408 bytes 29445 (28.7 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 [root@localhost ~]# docker run -tid --net=bridge --name docker_bri1 nginx 9bcd1b5593257439bcc7cec9a23b6578bbbd60a003cad55bab764472259d181a [root@localhost ~]# docker run -tid --net=bridge --name docker_bri2 nginx 3a9321502e283f0855deff50bf9abf279cbf02cd2712853af50cfb88a26dddeb [root@localhost ~]# ifconfig docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255 inet6 fe80::42:8aff:febb:5880 prefixlen 64 scopeid 0x20<link> ether 02:42:8a:bb:58:80 txqueuelen 0 (Ethernet) RX packets 57 bytes 7304 (7.1 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 81 bytes 5746 (5.6 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.186.139 netmask 255.255.255.0 broadcast 192.168.186.255 inet6 fe80::7bc6:bc62:db29:8a1b prefixlen 64 scopeid 0x20<link> ether 00:0c:29:94:bd:ca txqueuelen 1000 (Ethernet) RX packets 407848 bytes 562316300 (536.2 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 128789 bytes 8666068 (8.2 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 1000 (Local Loopback) RX packets 408 bytes 29445 (28.7 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 408 bytes 29445 (28.7 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 veth46caa6b: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet6 fe80::1897:a4ff:feeb:d0bf prefixlen 64 scopeid 0x20<link> ether 1a:97:a4:eb:d0:bf txqueuelen 0 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 8 bytes 656 (656.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 vetha2c7d51: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet6 fe80::fc50:59ff:fe52:3738 prefixlen 64 scopeid 0x20<link> ether fe:50:59:52:37:38 txqueuelen 0 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 8 bytes 656 (656.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 [root@localhost ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.186.2 0.0.0.0 UG 100 0 0 ens33 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 192.168.186.0 0.0.0.0 255.255.255.0 U 100 0 0 ens33 可见启动了两个虚拟机网卡
1.2 host¶
如果启动容器的时候使用host模式,那么这个容器将不会获得一个独立的Network Namespace,而是和宿主机共用一个Network Namespace。容器将不会虚拟出自己的网卡,配置自己的IP等,而是使用宿主机的IP和端口。但是,容器的其他方面,如文件系统、进程列表等还是和宿主机隔离的。Host模式如下图所示:

docker run -itd --net=host busybox docker exec -it 容器id ifconfig
操作
[root@localhost ~]# docker run -itd --net=host busybox 7d0549a3e1aa4b60263adf72144d91a5aaa6694bc813ed0a51deb4874c2b8282 [root@localhost ~]# docker exec -it 7d0549a3e1 ifconfig docker0 Link encap:Ethernet HWaddr 02:42:8A:BB:58:80 inet addr:172.17.0.1 Bcast:172.17.255.255 Mask:255.255.0.0 inet6 addr: fe80::42:8aff:febb:5880/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:57 errors:0 dropped:0 overruns:0 frame:0 TX packets:81 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:7304 (7.1 KiB) TX bytes:5746 (5.6 KiB) ens33 Link encap:Ethernet HWaddr 00:0C:29:94:BD:CA inet addr:192.168.186.139 Bcast:192.168.186.255 Mask:255.255.255.0 inet6 addr: fe80::7bc6:bc62:db29:8a1b/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:409454 errors:0 dropped:0 overruns:0 frame:0 TX packets:129573 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:563238476 (537.1 MiB) TX bytes:8758019 (8.3 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:412 errors:0 dropped:0 overruns:0 frame:0 TX packets:412 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:29661 (28.9 KiB) TX bytes:29661 (28.9 KiB) veth46caa6b Link encap:Ethernet HWaddr 1A:97:A4:EB:D0:BF inet6 addr: fe80::1897:a4ff:feeb:d0bf/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:8 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:656 (656.0 B) vetha2c7d51 Link encap:Ethernet HWaddr FE:50:59:52:37:38 inet6 addr: fe80::fc50:59ff:fe52:3738/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:8 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:656 (656.0 B) 可见容器内的网络是使用了宿主机的网络,没有再次创建docker的私有网络。
1.3 container¶
这个模式指定新创建的容器和已经存在的一个容器共享一个 Network Namespace,而不是和宿主机共享。新创建的容器不会创建自己的网卡,配置自己的 IP,而是和一个指定的容器共享 IP、端口范围等。同样,两个容器除了网络方面,其他的如文件系统、进程列表等还是隔离的。两个容器的进程可以通过 lo 网卡设备通信。

docker run -itd --name cmz busybox docker run -tid --net=container:cmz --name docker_con1 busybox
两个docker容器,使用一个网络
操作
[root@localhost ~]# docker rm -f $(docker ps -a |awk '{print $1}') 925479e72c73 0c51527887a3 Error: No such container: CONTAINER [root@localhost ~]# docker run -itd --name cmz busybox b1c62a22bfc9db38b69d234b0ba0745dd7a0a206b47e6420e442547990026162 [root@localhost ~]# docker ps -l CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES b1c62a22bfc9 busybox "sh" 5 seconds ago Up 4 seconds cmz [root@localhost ~]# docker run -tid --net=container:cmz --name docker_con1 busybox b74c16e949a9fa6cf17d5a05ab950db2440bbc0a874ab15657bdad70a1077981 [root@localhost ~]# docker ps -l CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES b74c16e949a9 busybox "sh" 4 seconds ago Up 3 seconds docker_con1 [root@localhost ~]# docker exec -it b1c62a22bfc9 ifconfig eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02 inet addr:172.17.0.2 Bcast:172.17.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:8 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:656 (656.0 B) TX bytes:0 (0.0 B) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) [root@localhost ~]# docker exec -it b74c16e949a9 ifconfig eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02 inet addr:172.17.0.2 Bcast:172.17.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:8 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:656 (656.0 B) TX bytes:0 (0.0 B) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
1.3 none¶
使用none模式,Docker容器拥有自己的Network Namespace,但是,并不为Docker容器进行任何网络配置。也就是说,这个Docker容器没有网卡、IP、路由等信息。需要我们自己为Docker容器添加网卡、配置IP等。

docker run -tid --net=none --name docker_non1 busybox
操作
[root@localhost ~]# docker run -tid --net=none --name docker_non1 busybox 6340546f63b83fbfc3cddd5e52337dc4d567496a2b6ab504e29c049cb766da46 [root@localhost ~]# docker ps -l CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 6340546f63b8 busybox "sh" 5 seconds ago Up 5 seconds docker_non1 [root@localhost ~]# docker exec -it 6340546f63b8 ifconfig lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
自定义网络
docker run -itd --name web busybox docker run -itd --name db busybox docker network create cmz_network docker run -itd --name web1 --net=cmz_network busybox docker run -itd --name db1 --net=cmz_network busybox docker exec -it web1 ping -c1 db1 docker exec -it db1 ping -c1 web1
操作
[root@localhost ~]# docker run -itd --name web busybox edf0be0c17e79a39db7b32a60d989ac3fbfe6d00491fb7308aa8c118fabb5b0c [root@localhost ~]# docker run -itd --name db busybox 35c3c0f6cce62c8148469505806e82e67bbe123cfc3ddd6ddca946b2d43a2183 [root@localhost ~]# docker exec -it web sh / # ping db ping: bad address 'db' / # [root@localhost ~]# docker exec -it db sh / # ping web ping: bad address 'web' / # [root@localhost ~]# [root@localhost ~]# docker network ls NETWORK ID NAME DRIVER SCOPE fded918d7084 bridge bridge local 7fb098cc4817 host host local bd86d4f496b9 none null local [root@localhost ~]# docker network create cmz_network e08426e96c48d072c108352f43fb88134e1e451fb40eddf1be541cb25f11ad66 [root@localhost ~]# docker network ls NETWORK ID NAME DRIVER SCOPE fded918d7084 bridge bridge local e08426e96c48 cmz_network bridge local 7fb098cc4817 host host local bd86d4f496b9 none null local [root@localhost ~]# docker run -itd --name web1 --net=cmz_network busybox 607659807fbdf5f07849e496218c0f4c5b8fc65211f21d5098498cbaa3d4fa16 [root@localhost ~]# docker run -itd --name db1 --net=cmz_network busybox 5ca91003c39e0157e416d0408d4f2a597e4eb009cde2c36e21dd56eda2b86dae [root@localhost ~]# docker exec -it web1 ping -c1 db1 PING db1 (172.18.0.3): 56 data bytes 64 bytes from 172.18.0.3: seq=0 ttl=64 time=0.121 ms --- db1 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max = 0.121/0.121/0.121 ms [root@localhost ~]# docker exec -it db1 ping -c1 web1 PING web1 (172.18.0.2): 56 data bytes 64 bytes from 172.18.0.2: seq=0 ttl=64 time=0.047 ms --- web1 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max = 0.047/0.047/0.047 ms 其实是hosts文件中解析 [root@localhost ~]# docker exec -it db1 cat /etc/hosts 127.0.0.1 localhost ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters 172.18.0.3 5ca91003c39e [root@localhost ~]# docker exec -it web1 cat /etc/hosts 127.0.0.1 localhost ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters 172.18.0.2 607659807fbd
查看新建网络信息
操作
[root@localhost ~]# docker network inspect cmz_network [ { "Name": "cmz_network", "Id": "e08426e96c48d072c108352f43fb88134e1e451fb40eddf1be541cb25f11ad66", "Created": "2019-04-15T01:44:55.96203805-04:00", "Scope": "local", "Driver": "bridge", "EnableIPv6": false, "IPAM": { "Driver": "default", "Options": {}, "Config": [ { "Subnet": "172.18.0.0/16", "Gateway": "172.18.0.1" } ] }, "Internal": false, "Attachable": false, "Ingress": false, "ConfigFrom": { "Network": "" }, "ConfigOnly": false, "Containers": { "5ca91003c39e0157e416d0408d4f2a597e4eb009cde2c36e21dd56eda2b86dae": { "Name": "db1", "EndpointID": "a03f17674d25f6d701cc82bd55f56f2ddd8e7195366279c44de43e0df8ccbeec", "MacAddress": "02:42:ac:12:00:03", "IPv4Address": "172.18.0.3/16", "IPv6Address": "" }, "607659807fbdf5f07849e496218c0f4c5b8fc65211f21d5098498cbaa3d4fa16": { "Name": "web1", "EndpointID": "a9af22b7a1d8a3288e7d4905c2235ad6321ac01d07dc289e7c7c66b7ebaaff33", "MacAddress": "02:42:ac:12:00:02", "IPv4Address": "172.18.0.2/16", "IPv6Address": "" } }, "Options": {}, "Labels": {} } ]