docker网络模型

最新推荐文章于 2024-08-31 08:40:05 发布

py风之老凌

最新推荐文章于 2024-08-31 08:40:05 发布

阅读量152

点赞数

分类专栏： docker

本文链接：https://blog.csdn.net/fengzhilaoling/article/details/109693352

版权

docker 专栏收录该内容

12 篇文章 0 订阅

订阅专栏

docker 网络模式

none模式，使用--network none指定
bridge模式(net模式)，使用--network bridge指定
container模式，使用--network container:CNAME_CID指定
host模式，使用--network host指定

--net=网络模式

None

此模式中，docker容器拥有自己的network namespace，但是不创建任何网络设备，仅有lo网络，即为封闭式容器。

[root@fengling dockerfile]# docker run -it --net=none alpine /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever

bridge模式(net模式)

docker安装后会默认启用172.17.0.1/16的网络，并创建docker0网桥作为网关，使用此网络创建的容器会生成一对以veth开头的虚拟网卡，一半在容器中，一半在docker0桥上，此方式实现了容器与宿主机间的通信。docker0桥是NAT桥，因此容器获得的是私有网络地址，可将容器想象为主机NAT服务背后的主机，如果开发容器或其上的服务为外部网络访问，需要在宿主机上为其定义DNAT规则。

[root@fengling dockerfile]# docker run -it --net=none alpine /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
/ # exit
[root@fengling dockerfile]# docker run -it  alpine /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
48: eth0@if49: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
/ #

container模式（联合网络）

又称联盟式容器，此模式下，新创建的容器会使用指定容器的net、ipc、uts名称空间，基于lo进行互相通信，而mount、user、pid名称空间依旧是隔离的。

[root@fengling dockerfile]# docker run -it --name lianhewangluo1 alpine /bin/sh/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
56: eth0@if57: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

[root@fengling ~]# docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
80ee918267b1        alpine              "/bin/sh"           28 seconds ago      Up 27 seconds                           lianhewangluo1


[root@fengling ~]# docker run -it --rm --net=container:80ee918267b1 alpine /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
56: eth0@if57: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

Host

共享宿主机的网络名称空间，容器不会虚拟自己的网卡设备及ip地址,而直接使用宿主机的ip地址与外部进行通信，且不需要任何NAT转换。

[root@fengling dockerfile]# docker run -it  --net=host alpine /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
       # 和宿主机IP相同
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:2e:3a:d0 brd ff:ff:ff:ff:ff:ff
    inet 172.24.16.171/18 brd 172.24.63.255 scope global dynamic eth0
       valid_lft 311191618sec preferred_lft 311191618sec
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:63:75:43:8e brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
47: vethd9d3769@if46: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue master docker0 state UP 
    link/ether 86:d0:a6:57:3e:2e brd ff:ff:ff:ff:ff:ff
/ #

设置net模式的网络

在/etc/docker/daemon.json配置文件中添加
"bip":"10.0.0.1/16"
重启docker服务systemctl restart docker
使用ifconfig查看docker0的地址

docker network create -d bridge --subnet "192.168.0.0/24" --gateway "192.168.0.1" mybr  #添加一个叫mybr的桥，子网为192.168.0.0/24
docker network ls  #查看当前的网络
NETWORK ID          NAME                DRIVER              SCOPE
ea08a5af48d4        bridge              bridge              local
206de06c064a        host                host                local
df506bd1407b        mybr                bridge              local
c25bc3fc6dde        none                null                local

docker run -it --network mybr busybox # 创建一个容器并加入此网桥
/ # ifconfig
eth0      Link encap:Ethernet  HWaddr 02:42:C0:A8:00:02  
          inet addr:192.168.0.2  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:13 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1102 (1.0 KiB)  TX bytes:0 (0.0 B)