Docker 容器网络访问原理，SNAT和DNAT

容器访问外部实现

外部访问容器实现

---

容器网络访问原理图

=========

首先我们会有这个 宿主机命名空间 eth0（我们的公网 IP或内网 IP），然后 我们的容器 container 通过 veth 虚拟设备队（他的作用 就相当于管道，这头进 另一头出），来分配的 容器的网络命名空间。

我们查看一下：

[root@izbp1izjo7pl5ccghnbdiuz ~]# ifconfig

br-642af1c223ad: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500

inet 172.18.0.1 netmask 255.255.0.0 broadcast 172.18.255.255

ether 02:42:32:2e:f0:0a txqueuelen 0 (Ethernet)

RX packets 37 bytes 7182 (7.0 KiB)

RX errors 0 dropped 0 overruns 0 frame 0

TX packets 50 bytes 5440 (5.3 KiB)

TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500

inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255

ether 02:42:c4:5e🇩🇪d7 txqueuelen 0 (Ethernet)

RX packets 39854 bytes 2365296 (2.2 MiB)

RX errors 0 dropped 0 overruns 0 frame 0

TX packets 40372 bytes 106483120 (101.5 MiB)

TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500

inet 172.16.57.19 netmask 255.255.240.0 broadcast 172.16.63.255

ether 00:16:3e:0b:5c:f3 txqueuelen 1000 (Ethernet)

RX packets 24245898 bytes 4480538360 (4.1 GiB)

RX errors 0 dropped 0 overruns 0 frame 0

TX packets 24834168 bytes 4928454620 (4.5 GiB)

TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536

inet 127.0.0.1 netmask 255.0.0.0

lo