一、docker網(wǎng)絡(luò)模式
1、單機(jī)網(wǎng)絡(luò)
-
Null模式
- 把容器放入獨(dú)立的網(wǎng)絡(luò)空間但不做任何配置
- 用戶需要通過(guò)運(yùn)行docker network 命令來(lái)完成網(wǎng)絡(luò)配置
-
Host模式
- 使用主機(jī)網(wǎng)絡(luò)空間掌唾，復(fù)用主機(jī)網(wǎng)絡(luò)
-
Container模式
- 重用其他容器的網(wǎng)絡(luò)
-
Bridge模式
- 使用Linux網(wǎng)橋和iptables提供容器互聯(lián)，Docker再每臺(tái)主機(jī)上創(chuàng)建docker0的網(wǎng)橋，通過(guò)veth pair連接每一個(gè)endpoint
2免钻、跨主機(jī)網(wǎng)絡(luò)
-
Overlay
- 通過(guò)網(wǎng)絡(luò)封包實(shí)現(xiàn)
-
Underlay
- 使用現(xiàn)有底層網(wǎng)絡(luò)，為每個(gè)容器配置可路由的網(wǎng)絡(luò)IP（IP資源的消耗大崔拥，需要網(wǎng)段規(guī)劃）
二极舔、基于Null網(wǎng)絡(luò)模式，實(shí)現(xiàn)單主機(jī)下bridge模式網(wǎng)絡(luò)
基于Null網(wǎng)絡(luò)模式容器链瓦，實(shí)現(xiàn)下圖的網(wǎng)絡(luò)結(jié)構(gòu)（單主機(jī)下模擬bridge模式網(wǎng)絡(luò)）
啟動(dòng)docker
# 執(zhí)行以下命令啟動(dòng)兩個(gè)docker
$ sudo docker run --network none -d nginx
$ sudo docker run --network none -d nginx
# 查看并獲取docker的pid
$ sudo docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
48113f09f569 nginx "/docker-entrypoint.…" About an hour ago Up About an hour serene_sanderson
9907e87fba34 nginx "/docker-entrypoint.…" 2 hours ago Up 2 hours compassionate_nightingale
$ sudo docker inspect 1cb1cb496de4|grep -i pid
"Pid": 1703143,
"PidMode": "",
"PidsLimit": null,
$ sudo docker inspect 52eaab254d07|grep -i pid
"Pid": 1702968,
"PidMode": "",
"PidsLimit": null,
$ pid_docker0=1703143
$ pid_docker1=1702968
配置docker網(wǎng)絡(luò)namespace
# 查看docker的namespace
$ sudo ls -l /proc/$pid_docker0/ns
total 0
lrwxrwxrwx 1 root root 0 Mar 5 13:18 cgroup -> 'cgroup:[4026531835]'
lrwxrwxrwx 1 root root 0 Mar 5 13:18 ipc -> 'ipc:[4026532302]'
lrwxrwxrwx 1 root root 0 Mar 5 13:18 mnt -> 'mnt:[4026532300]'
lrwxrwxrwx 1 root root 0 Mar 5 13:16 net -> 'net:[4026532305]'
lrwxrwxrwx 1 root root 0 Mar 5 13:18 pid -> 'pid:[4026532303]'
lrwxrwxrwx 1 root root 0 Mar 5 13:18 pid_for_children -> 'pid:[4026532303]'
lrwxrwxrwx 1 root root 0 Mar 5 13:18 user -> 'user:[4026531837]'
lrwxrwxrwx 1 root root 0 Mar 5 13:18 uts -> 'uts:[4026532301]'
# 將docker網(wǎng)絡(luò)的namespace關(guān)聯(lián)到宿主機(jī)的網(wǎng)絡(luò)namespace下
$ sudo ln -s /proc/$pid_docker0/ns/net /var/run/netns/$pid_docker0
$ sudo ln -s /proc/$pid_docker1/ns/net /var/run/netns/$pid_docker1
$ ip netns
1702968
1703143
配置虛擬以太網(wǎng)
# 查看當(dāng)前的bridge
$ brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.024256ff4aab no
# 添加虛擬以太網(wǎng)拆魏，供兩個(gè)容器與docker0網(wǎng)橋聯(lián)通
$ sudo ip link add docker0_${pid_docker0} type veth peer name docker_${pid_docker0}
$ sudo ip link add docker0_${pid_docker1} type veth peer name docker_${pid_docker1}
$ ip link
...
17: docker_1703143@docker0_1703143: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 6a:e4:b4:d3:bf:d5 brd ff:ff:ff:ff:ff:ff
18: docker0_1703143@docker_1703143: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 3e:d7:3f:9a:18:2f brd ff:ff:ff:ff:ff:ff
19: docker_1702968@docker0_1702968: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether c6:c1:e9:a5:b5:0a brd ff:ff:ff:ff:ff:ff
20: docker0_1702968@docker_1702968: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 7a:7f:4c:3c:a2:6e brd ff:ff:ff:ff:ff:ff
# 將veth的一端連接到docker0網(wǎng)橋上
$ sudo brctl addif docker0 docker0_${pid_docker0}
$ sudo brctl addif docker0 docker0_${pid_docker1}
# 啟動(dòng)veth連接docker0網(wǎng)橋端設(shè)備
$ sudo ip link set docker0_${pid_docker0} up
$ sudo ip link set docker0_${pid_docker1} up
# 將veth的另一端namespace設(shè)置為對(duì)應(yīng)docker的namespace盯桦，使docker連接veth
$ sudo ip link set docker_${pid_docker0} netns ${pid_docker0}
$ sudo ip link set docker_${pid_docker1} netns ${pid_docker1}
# 查看docker內(nèi)部網(wǎng)絡(luò)設(shè)備信息
$ sudo ip netns exec ${pid_docker0} ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
17: docker_1703143@if18: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 6a:e4:b4:d3:bf:d5 brd ff:ff:ff:ff:ff:ff link-netnsid 0
$ sudo ip netns exec ${pid_docker1} ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
19: docker_1702968@if20: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether c6:c1:e9:a5:b5:0a brd ff:ff:ff:ff:ff:ff link-netnsid 0
配置docker內(nèi)部IP及路由
# 修改docker內(nèi)對(duì)應(yīng)網(wǎng)卡名稱
$ sudo ip netns exec ${pid_docker0} ip link set dev docker_${pid_docker0} name eth0
$ sudo ip netns exec ${pid_docker1} ip link set dev docker_${pid_docker1} name eth0
# 啟用docker內(nèi)網(wǎng)卡
$ sudo ip netns exec ${pid_docker0} ip link set eth0 up
$ sudo ip netns exec ${pid_docker1} ip link set eth0 up
$ sudo ip netns exec ${pid_docker0} ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
17: eth0@if18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 6a:e4:b4:d3:bf:d5 brd ff:ff:ff:ff:ff:ff link-netnsid 0
$ sudo ip netns exec ${pid_docker1} ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
19: eth0@if20: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether c6:c1:e9:a5:b5:0a brd ff:ff:ff:ff:ff:ff link-netnsid 0
# 配置docker的ip及路由
$ ip0=172.17.0.2
$ ip1=172.17.0.3
$ mac0=16
$ mac1=17
$ gateway=172.17.0.1
$ sudo ip netns exec ${pid_docker0} ip addr add ${ip0}/${mac0} dev eth0
$ sudo ip netns exec ${pid_docker1} ip addr add ${ip1}/${mac1} dev eth0
$ sudo ip netns exec ${pid_docker0} ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
17: eth0@if18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 6a:e4:b4:d3:bf:d5 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 172.17.0.2/16 scope global eth0
valid_lft forever preferred_lft forever
$ sudo ip netns exec ${pid_docker1} ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
19: eth0@if20: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether c6:c1:e9:a5:b5:0a brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 172.17.0.3/17 scope global eth0
valid_lft forever preferred_lft forever
$ sudo ip netns exec ${pid_docker0} ip route add default via ${gateway}
$ sudo ip netns exec ${pid_docker1} ip route add default via ${gateway}
$ sudo ip netns exec ${pid_docker0} ip route
default via 172.17.0.1 dev eth0
172.17.0.0/16 dev eth0 proto kernel scope link src 172.17.0.2
$ sudo ip netns exec ${pid_docker1} ip route
default via 172.17.0.1 dev eth0
172.17.0.0/17 dev eth0 proto kernel scope link src 172.17.0.3
測(cè)試docker網(wǎng)絡(luò)連通性
$ curl 172.17.0.2
<!DOCTYPE html>
...
</html>
$ curl 172.17.0.3
<!DOCTYPE html>
...
</html>
