Docker之网络详解（一）-CSDN博客

本文链接：https://blog.csdn.net/docerce/article/details/79274650

刚刚安装完成Docker之后，会默认建立好三个网络，分别为bridge, host, none，顾名思义分别就是桥接网络、主机网络和没有网络，使用以下命令可以查看：

docker network ls

默认在运行容器时如果不使用--network来指定要运行的网络，所有容器都是运行于bridge网络之上，也就是说同一台主机的容器默认都是可以互相通过IP地址进行沟通的。

以下举例说明：

首先建立两个容器，

[root@manager1 ~]# docker run -itd --name=container1 busybox
727b52e3d2f638d010c5810b53a4ac4b2229592a5deea37ab3c061fa52a3cc4c
[root@manager1 ~]# docker run -itd --name=container2 busybox
646b09ce6961d687fbd41cb3aa4e83a5c16682d3b6294d6a5f9410c647b1f6a4

通过docker network inspect命令可以查看网络的情况，例如：

docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "119344dd5ab99e6bba301ff863618afab914165dc718bdc609d207e48f535183",
        "Created": "2018-02-06T07:54:15.453845691-05:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "646b09ce6961d687fbd41cb3aa4e83a5c16682d3b6294d6a5f9410c647b1f6a4": {
                "Name": "container2",
                "EndpointID": "acc0e686c4f35740caab600abc9231179085ce81ccd47cff86a71083bca83aec",
                "MacAddress": "02:42:ac:11:00:03",
                "IPv4Address": "172.17.0.3/16",
                "IPv6Address": ""
            },
            "727b52e3d2f638d010c5810b53a4ac4b2229592a5deea37ab3c061fa52a3cc4c": {
                "Name": "container1",
                "EndpointID": "6fbbdb9dcf232761c62886de54de525afc49235e3913af738d58bc92051cb095",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]
可见两个容器的IP地址分别为172.17.0.2和172.17.0.3。

现在使用命令docker container attach进入容器一看究竟：

docker container attach container1

/ # ping 172.17.0.3
PING 172.17.0.3 (172.17.0.3): 56 data bytes
64 bytes from 172.17.0.3: seq=0 ttl=64 time=0.240 ms
64 bytes from 172.17.0.3: seq=1 ttl=64 time=0.174 ms

可见完全是可以Ping通container2的IP地址。

实现同一主机的简单网络隔离

如果不想使用默认的桥接网络，则可以使用以下命令定义自己的桥接网络：

docker network create --driver bridge isolated_nw

接下来，为容器指定运行于我们创建的网络：

docker run --network=isolated_nw -itd --name=container3 busybox

此时用同样的方法进入container3

发现IP与默认的桥接网络是不同的，也无法ping通原先的container1和container2了，到此我们实现了在同一主机的容器之间的网络隔离。

[root@manager1 ~]# docker container attach container3
/ # ip add
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
16: eth0@if17: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
    link/ether 02:42:ac:13:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.19.0.2/16 brd 172.19.255.255 scope global eth0
       valid_lft forever preferred_lft forever
/ # ping 172.17.0.3
PING 172.17.0.3 (172.17.0.3): 56 data bytes
^C
--- 172.17.0.3 ping statistics ---
113 packets transmitted, 0 packets received, 100% packet loss

操纵Docker网络的常用命令

docker network create       建立网络
docker network connect        连接网络
docker network ls                  显示网络
docker network rm                删除网络
docker network disconnect   断开网络
docker network inspect         查看网络

以下续一说明：

建立网络，

docker network create simple-network

docker network inspect simple-network
[
    {
        "Name": "simple-network",
        "Id": "7e599ed4e37ba3ea8f142076f0134aeadd04b44dcfb40b768f27289a3be1c39f",
        "Created": "2018-02-06T08:41:12.295793815-05:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.20.0.0/16",
                    "Gateway": "172.20.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {},
        "Labels": {}
    }
]
建立一个自定义的桥接网络，在不指定其它参数的情况网段会自动选择本机的未分配网段。

改变容器的连接网络，

以下举例说明：

先建立两个默认的容器，

[root@manager1 ~]# docker run -itd --name=container1 busybox
1c95e4c26ceac6bed6fd8497417f79e9bcd470da97339fb47e9d82cb82c29e4a
[root@manager1 ~]# docker run -itd --name=container2 busybox
fd0b00c1a22fb37e898733e1578967fe28057f6ba60921444b5e029cae5cf2e6

然后建立一个新的网络，

docker network create -d bridge --subnet 172.25.0.0/16 isolated_nw

最后将container2连接到新的网络，

docker network connect isolated_nw container2

[root@manager1 ~]# docker container attach container1
/ # ip add
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
21: eth0@if22: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
/ # exit
[root@manager1 ~]# docker container attach container2
/ # ip add
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
23: eth0@if24: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
26: eth1@if27: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
    link/ether 02:42:ac:19:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.25.0.2/16 brd 172.25.255.255 scope global eth1
       valid_lft forever preferred_lft forever
可见container2多了一张网卡，现在它可以连接新网络的其它容器了！