docker 网络模式
none模式,使用--network none指定
bridge模式(net模式),使用--network bridge指定
container模式,使用--network container:CNAME_CID指定
host模式,使用--network host指定
--net=网络模式
None
此模式中,docker容器拥有自己的network namespace,但是不创建任何网络设备,仅有lo网络,即为封闭式容器。
[root@fengling dockerfile]# docker run -it --net=none alpine /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
bridge模式(net模式)
docker安装后会默认启用172.17.0.1/16的网络,并创建docker0网桥作为网关,使用此网络创建的容器会生成一对以veth开头的虚拟网卡,一半在容器中,一半在docker0桥上,此方式实现了容器与宿主机间的通信。docker0桥是NAT桥,因此容器获得的是私有网络地址,可将容器想象为主机NAT服务背后的主机,如果开发容器或其上的服务为外部网络访问,需要在宿主机上为其定义DNAT规则。
[root@fengling dockerfile]# docker run -it --net=none alpine /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
/ # exit
[root@fengling dockerfile]# docker run -it alpine /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
48: eth0@if49: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP
link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
/ #
container模式(联合网络)
又称联盟式容器,此模式下,新创建的容器会使用指定容器的net、ipc、uts名称空间,基于lo进行互相通信,而mount、user、pid名称空间依旧是隔离的。
[root@fengling dockerfile]# docker run -it --name lianhewangluo1 alpine /bin/sh/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
56: eth0@if57: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
[root@fengling ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
80ee918267b1 alpine "/bin/sh" 28 seconds ago Up 27 seconds lianhewangluo1
[root@fengling ~]# docker run -it --rm --net=container:80ee918267b1 alpine /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
56: eth0@if57: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
Host
共享宿主机的网络名称空间,容器不会虚拟自己的网卡设备及ip地址,而直接使用宿主机的ip地址与外部进行通信,且不需要任何NAT转换。
[root@fengling dockerfile]# docker run -it --net=host alpine /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
# 和宿主机IP相同
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:16:3e:2e:3a:d0 brd ff:ff:ff:ff:ff:ff
inet 172.24.16.171/18 brd 172.24.63.255 scope global dynamic eth0
valid_lft 311191618sec preferred_lft 311191618sec
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether 02:42:63:75:43:8e brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
47: vethd9d3769@if46: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue master docker0 state UP
link/ether 86:d0:a6:57:3e:2e brd ff:ff:ff:ff:ff:ff
/ #
设置net模式的网络
在/etc/docker/daemon.json配置文件中添加
"bip":"10.0.0.1/16"
重启docker服务systemctl restart docker
使用ifconfig查看docker0的地址
docker network create -d bridge --subnet "192.168.0.0/24" --gateway "192.168.0.1" mybr #添加一个叫mybr的桥,子网为192.168.0.0/24
docker network ls #查看当前的网络
NETWORK ID NAME DRIVER SCOPE
ea08a5af48d4 bridge bridge local
206de06c064a host host local
df506bd1407b mybr bridge local
c25bc3fc6dde none null local
docker run -it --network mybr busybox # 创建一个容器并加入此网桥
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:C0:A8:00:02
inet addr:192.168.0.2 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:13 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1102 (1.0 KiB) TX bytes:0 (0.0 B)