docker网络系统文章用于讲解docker几种网络模型和通信方式。
实验环境为下面的组网,2台VM连接在一台交换机上,在一个2层网络中。分别在2台VM上启动容器,通过不同网络模型使容器间互通。
macvlan是一种网卡虚拟化技术,在现有网卡上虚拟出一块子网卡,子网卡有自己 的MAC地址,共享底层物理网卡
更详细的macvlan介绍,可以参考这篇文章:https://www.jianshu.com/p/2b8b6c738bf6
- 分别在VM1,VM2上创建macvlan网络,都属于172.16.86.0/24子网,并分配2个不同的ip网段.
VM1:
docker network create -d macvlan \
> --subnet=172.16.86.0/24 \
> --gateway=172.16.86.1 \
> --ip-range=172.16.86.128/25 -o parent=ens38 macvlan_net1
VM2:
docker network create -d macvlan --subnet=172.16.86.0/24 --gateway=172.16.86.1 --ip-range=172.16.86.0/25 -o parent=ens38 macvlan_net2
在VM1,VM2上分别启动1个容器,并加入刚才创建的macvlan网络
VM1:
docker run -td --name c1 --network macvlan_net1 --privileged busybox /bin/sh
docker exec -it c1 ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
6: eth0@if3: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:10:56:80 brd ff:ff:ff:ff:ff:ff
inet 172.16.86.128/24 brd 172.16.86.255 scope global eth0
valid_lft forever preferred_lft forever
VM2:
docker run -td --name c2 --network macvlan_net2 --privileged busybox /bin/sh
docker exec -it c2 ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
6: eth0@if3: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:10:56:02 brd ff:ff:ff:ff:ff:ff
inet 172.16.86.2/24 brd 172.16.86.255 scope global eth0
valid_lft forever preferred_lft forever
分别在2个容器中ping对方,可以ping通:
VM1:
docker exec -it c1 ping 172.16.86.2
PING 172.16.86.2 (172.16.86.2): 56 data bytes
64 bytes from 172.16.86.2: seq=0 ttl=64 time=1.078 ms
64 bytes from 172.16.86.2: seq=1 ttl=64 time=1.334 ms
64 bytes from 172.16.86.2: seq=2 ttl=64 time=0.518 ms
VM2:
# docker exec -it c2 ping 172.16.86.128
PING 172.16.86.128 (172.16.86.128): 56 data bytes
64 bytes from 172.16.86.128: seq=0 ttl=64 time=0.462 ms
64 bytes from 172.16.86.128: seq=1 ttl=64 time=1.778 ms
64 bytes from 172.16.86.128: seq=2 ttl=64 time=0.490 ms
64 bytes from 172.16.86.128: seq=3 ttl=64 time=1.366 ms
macvlan会独占物理网卡,如果我们想创建多个macvlan网络,可以使用子接口。
VM1:
docker network create -d macvlan --subnet=172.17.86.0/24 --gateway=172.17.86.1 --ip-range=172.17.86.128/25 -o parent=ens38.10 macvlan10
VM2:
docker network create -d macvlan --subnet=172.17.86.0/24 --gateway=172.17.86.1 --ip-range=172.17.86.0/25 -o parent=ens38.10 macvlan10
可以看到自动创建了ens38.10子网卡
7: ens38.10@ens38: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 00:0c:29:0f:d1:e1 brd ff:ff:ff:ff:ff:ff
inet6 fe80::20c:29ff:fe0f:d1e1/64 scope link
valid_lft forever preferred_lft forever
分别创建2个容器连接各自的macvlan10
VM1:
docker run -td --name c10 --network macvlan10 --privileged busybox /bin/sh
0843e2e9cb6541f7c3996c4d6b2f5322084a18bd39c8402585fd4e0f0eb7cc10
root@k8s-slave1:~# docker exec -it c10 ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
8: eth0@if7: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:11:56:80 brd ff:ff:ff:ff:ff:ff
inet 172.17.86.128/24 brd 172.17.86.255 scope global eth0
valid_lft forever preferred_lft forever
VM2:
docker run -td --name c10 --network macvlan10 --privileged busybox /bin/sh
ea8d0b5c500bd8f64821b15b664ec1e3cb5c15330a399265c7e877a884c6673d
docroot@ubuntu:~# docker exec -it c10 ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
9: eth0@if7: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:11:56:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.86.2/24 brd 172.17.86.255 scope global eth0
valid_lft forever preferred_lft forever
互相ping:
VM1:
# docker exec -it c10 ping 172.17.86.2
PING 172.17.86.2 (172.17.86.2): 56 data bytes
64 bytes from 172.17.86.2: seq=0 ttl=64 time=0.714 ms
64 bytes from 172.17.86.2: seq=1 ttl=64 time=0.615 ms
VM2:
docker exec -it c10 ping 172.17.86.128
PING 172.17.86.128 (172.17.86.128): 56 data bytes
64 bytes from 172.17.86.128: seq=0 ttl=64 time=1.144 ms
64 bytes from 172.17.86.128: seq=1 ttl=64 time=0.533 ms