[Kubernetes]Docker的网络模型

1. Docker默认自动创建的网络

当安装完Docker时，Docker默认自动创建了三个网络：bridege, none和host. 使用docker network list命令可以查看。

$ docker network ls
NETWORK ID          NAME                DRIVER
507d17743c82        bridge              bridge              
14984b1fcc40        host                host                
0aba874b7156        none                null  

使用Docker运行容器时，可以用--net来指定容器运行时所在的网络。例如：

$ docker run --net=host -itd --name=container busybox

1.1 Docker的bridge网络

使用ifconfig命令，可以看到多出了一个docker0：

$ ifconfig
docker0   Link encap:Ethernet  HWaddr 02:42:bf:c2:8c:9a  
          inet addr:172.17.0.1  Bcast:0.0.0.0  Mask:255.255.0.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

docker0是Docker在安装时创建的bridge网络。如果运行容器时没有使用--net,则容器默认运行在bridge网络。使用docker network inspect命令查看bridge的详细信息：

$ docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "507d17743c82d550f4c367f42f17f210f08f9b679191a3fb610fed33dfe525e1",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16"
                }
            ]
        },
        "Internal": false,
        "Containers": {},
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

从上面的信息可以看到，Docker引擎在docker0上所创建的bridge子网为172.17.0.0/16，目前该网络内还没有容器在运行。现在使用docker run命令增加两个容器

$ docker run -itd --name=container1 busybox
de95bdb8761f646a3f8423724f944f420e332fa3070bae1ff3fec127411e015e
$ docker run -itd --name=container2 busybox
c5bdfc331017107be4ae1bdfff12e531b3eaa3424852c4404a301b1f1c28f31b

再次用docker network inspect命令查看bridge的详细信息：

$ docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "507d17743c82d550f4c367f42f17f210f08f9b679191a3fb610fed33dfe525e1",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16"
                }
            ]
        },
        "Internal": false,
        "Containers": {
            "c5bdfc331017107be4ae1bdfff12e531b3eaa3424852c4404a301b1f1c28f31b": {
                "Name": "container2",
                "EndpointID": "04160448f248c68d37644da7dc4e4eff56e814a9efd9f4499095ece494cf6926",
                "MacAddress": "02:42:ac:11:00:03",
                "IPv4Address": "172.17.0.3/16",
                "IPv6Address": ""
            },
            "de95bdb8761f646a3f8423724f944f420e332fa3070bae1ff3fec127411e015e": {
                "Name": "container1",
                "EndpointID": "610a49518b5a15c28e3931fc20107c9e380c5c7b267feebd101a59e099977e43",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

可以看到，增加的两个容器运行在了bridge网络，并且被分配了172.17.0.0/16子网下的IP地址：172.17.0.3/16和172.17.0.2/16.容器使用这个IP地址可以相互通信。

使用docker attach命令连上一个容器container1，并查看容器的ifconfig信息：

$ docker attach container1
/ # ifconfig
eth0      Link encap:Ethernet  HWaddr 02:42:AC:11:00:02  
          inet addr:172.17.0.2  Bcast:0.0.0.0  Mask:255.255.0.0
          inet6 addr: fe80::42:acff:fe11:2/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:66 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:9990 (9.7 KiB)  TX bytes:648 (648.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Docker引擎为该容器分配了一个虚拟的网络设备eth0,并为其分配了IP 172.17.0.2/16。 继续留在容器会话，用ping命令来测试容器之间的连通性，并查看容器/etc/hosts文件的内容

/ # ping -w3 172.17.0.3
PING 172.17.0.3 (172.17.0.3): 56 data bytes
64 bytes from 172.17.0.3: seq=0 ttl=64 time=0.147 ms
64 bytes from 172.17.0.3: seq=1 ttl=64 time=0.088 ms
64 bytes from 172.17.0.3: seq=2