docker网络模式与none模式配置网络

docker基础命令

1）host模式
没有命名空间隔离，相当于docker容器与宿主机公用一个网络，使用宿主机的网卡、IP和端口信息，无需使用端口映射，此时容器不再拥有隔离的、独立的网络栈。不拥有所有端口资源。

2）container模式
指定新容器和已存在容器共享一个网络命名空间，这种模式拥有网络隔离，可以在一定程度上节省网络资源，容器内部依然不会拥有所有端口。

3）none模式
容器拥有自己的网络命名空间，但不为容器做任何网络配置，如没有其他的网络配置，该容器将完全独立于网络，用户可以根据需要为容器添加网卡。此模式拥有所有端口。（none网络模式配置网络）

4）bridge模式 docker默认的网络模式，受docker管理的linux桥接网络。默认同一个桥的容器可以互相通讯。

配置none模式网络

ip	主机名
192.168.200.10	server

[root@server ~]# ip a            //查看宿主机ip
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eno16777736: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:f6:27:64 brd ff:ff:ff:ff:ff:ff
    inet 192.168.200.10/24 brd 192.168.200.255 scope global eno16777736
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fef6:2764/64 scope link
       valid_lft forever preferred_lft forever
54: bridge0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 12:54:79:02:cd:77 brd ff:ff:ff:ff:ff:ff
    inet 192.168.5.1/24 scope global bridge0
       valid_lft forever preferred_lft forever
    inet6 fe80::88dd:8eff:fe7c:8b56/64 scope link
       valid_lft forever preferred_lft forever
55: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 02:42:7b:ea:31:d5 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:7bff:feea:31d5/64 scope link
       valid_lft forever preferred_lft forever
...

[root@server ~]# docker run -dit --network none --name test busybox            //创建容器
b2cc0dea0867f244530518648cc94148c3674932088a6b48ed850fd9f4736b57
[root@server ~]# docker ps                                                    //查看
CONTAINER ID        IMAGE                   COMMAND                  CREATED             STATUS              PORTS                              NAMES
b2cc0dea0867        busybox                 "sh"                     2 seconds ago       Up 2 seconds                                           test

[root@server ~]# docker exec -it test /bin/sh            //进入该容器
/ # ip a                                                 //查看ip，发现只有lo
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
/ # exit                                            //退出容器
[root@server ~]# ip link add veth0 type veth peer name veth1    //将veth设置为一端接入OVS网桥br-int
[root@server ~]# brctl addif docker0 veth0            //将veth0加入网桥
[root@server ~]# brctl show                            //查看
...
docker0         8000.02427bea31d5       no              veth0
[root@server ~]# ip link set veth0 up                    //启动宿主机一端的端口
[root@server ~]# docker inspect test | grep -i pid            //查看容器pid，可以将后面的命名空间取名为pid
            "Pid": 59667,
            "PidMode": "",
            "PidsLimit": 0,

[root@server ~]# mkdir /var/run/netns/                    //创建命名空间
[root@server ~]# ln -s /proc/59667/ns/net /var/run/netns/59667        //制作软链接，将容器进程中的网络链接到命名空间中
[root@server ~]# ip netns                                            //查看有什么命名空间
59667 (id: 6)
56773
[root@server ~]# ip link set veth1 netns 59667                    //将veth1端口连接到命名空间中，veth1端口为容器内端口
[root@server ~]# ip netns exec 59667 ip link set dev veth1 name eth0        //将veth1端口重命名为eth0
[root@server ~]# ip netns exec 59667 ip link set eth0 up                    //启动veth1端口
[root@server ~]# ip netns exec 59667 ip addr add 172.17.0.100/24 dev eth0    //对veth1端口添加ip
[root@server ~]# ip netns exec 59667 ip route add default via 172.17.0.1        //添加默认网关

---------------验证
[root@server ~]# docker exec -it test /bin/sh        //进入容器
/ # ip a                                            //查看ip
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
126: eth0@if127: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 5a:51:cd:b5:36:ab brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.100/24 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::5851:cdff:feb5:36ab/64 scope link
       valid_lft forever preferred_lft forever
/ # ping 192.168.200.10 -c2                        //ping宿主机成功
PING 192.168.200.10 (192.168.200.10): 56 data bytes
64 bytes from 192.168.200.10: seq=0 ttl=64 time=0.072 ms
64 bytes from 192.168.200.10: seq=1 ttl=64 time=0.050 ms


--- 192.168.200.10 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.050/0.061/0.072 ms
/ # exit                                        //退出容器
[root@server ~]# ping 172.17.0.100 -c2            //ping容器成功
PING 172.17.0.100 (172.17.0.100) 56(84) bytes of data.
64 bytes from 172.17.0.100: icmp_seq=1 ttl=64 time=0.041 ms
64 bytes from 172.17.0.100: icmp_seq=2 ttl=64 time=0.035 ms


--- 172.17.0.100 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.035/0.038/0.041/0.003 ms