1)host模式
没有命名空间隔离,相当于docker容器与宿主机公用一个网络,使用宿主机的网卡、IP和端口信息,无需使用端口映射,此时容器不再拥有隔离的、独立的网络栈。不拥有所有端口资源。
2)container模式
指定新容器和已存在容器共享一个网络命名空间,这种模式拥有网络隔离,可以在一定程度上节省网络资源,容器内部依然不会拥有所有端口。
3)none模式
容器拥有自己的网络命名空间,但不为容器做任何网络配置,如没有其他的网络配置,该容器将完全独立于网络,用户可以根据需要为容器添加网卡。此模式拥有所有端口。(none网络模式配置网络)
4)bridge模式 docker默认的网络模式,受docker管理的linux桥接网络。默认同一个桥的容器可以互相通讯。
配置none模式网络
ip | 主机名 |
---|---|
192.168.200.10 | server |
[root@server ~]# ip a //查看宿主机ip
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eno16777736: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:f6:27:64 brd ff:ff:ff:ff:ff:ff
inet 192.168.200.10/24 brd 192.168.200.255 scope global eno16777736
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fef6:2764/64 scope link
valid_lft forever preferred_lft forever
54: bridge0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether 12:54:79:02:cd:77 brd ff:ff:ff:ff:ff:ff
inet 192.168.5.1/24 scope global bridge0
valid_lft forever preferred_lft forever
inet6 fe80::88dd:8eff:fe7c:8b56/64 scope link
valid_lft forever preferred_lft forever
55: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether 02:42:7b:ea:31:d5 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:7bff:feea:31d5/64 scope link
valid_lft forever preferred_lft forever
...
[root@server ~]# docker run -dit --network none --name test busybox //创建容器
b2cc0dea0867f244530518648cc94148c3674932088a6b48ed850fd9f4736b57
[root@server ~]# docker ps //查看
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
b2cc0dea0867 busybox "sh" 2 seconds ago Up 2 seconds test
[root@server ~]# docker exec -it test /bin/sh //进入该容器
/ # ip a //查看ip,发现只有lo
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
/ # exit //退出容器
[root@server ~]# ip link add veth0 type veth peer name veth1 //将veth设置为一端接入OVS网桥br-int
[root@server ~]# brctl addif docker0 veth0 //将veth0加入网桥
[root@server ~]# brctl show //查看
...
docker0 8000.02427bea31d5 no veth0
[root@server ~]# ip link set veth0 up //启动宿主机一端的端口
[root@server ~]# docker inspect test | grep -i pid //查看容器pid,可以将后面的命名空间取名为pid
"Pid": 59667,
"PidMode": "",
"PidsLimit": 0,
[root@server ~]# mkdir /var/run/netns/ //创建命名空间
[root@server ~]# ln -s /proc/59667/ns/net /var/run/netns/59667 //制作软链接,将容器进程中的网络链接到命名空间中
[root@server ~]# ip netns //查看有什么命名空间
59667 (id: 6)
56773
[root@server ~]# ip link set veth1 netns 59667 //将veth1端口连接到命名空间中,veth1端口为容器内端口
[root@server ~]# ip netns exec 59667 ip link set dev veth1 name eth0 //将veth1端口重命名为eth0
[root@server ~]# ip netns exec 59667 ip link set eth0 up //启动veth1端口
[root@server ~]# ip netns exec 59667 ip addr add 172.17.0.100/24 dev eth0 //对veth1端口添加ip
[root@server ~]# ip netns exec 59667 ip route add default via 172.17.0.1 //添加默认网关
---------------验证
[root@server ~]# docker exec -it test /bin/sh //进入容器
/ # ip a //查看ip
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
126: eth0@if127: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 5a:51:cd:b5:36:ab brd ff:ff:ff:ff:ff:ff
inet 172.17.0.100/24 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::5851:cdff:feb5:36ab/64 scope link
valid_lft forever preferred_lft forever
/ # ping 192.168.200.10 -c2 //ping宿主机成功
PING 192.168.200.10 (192.168.200.10): 56 data bytes
64 bytes from 192.168.200.10: seq=0 ttl=64 time=0.072 ms
64 bytes from 192.168.200.10: seq=1 ttl=64 time=0.050 ms
--- 192.168.200.10 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.050/0.061/0.072 ms
/ # exit //退出容器
[root@server ~]# ping 172.17.0.100 -c2 //ping容器成功
PING 172.17.0.100 (172.17.0.100) 56(84) bytes of data.
64 bytes from 172.17.0.100: icmp_seq=1 ttl=64 time=0.041 ms
64 bytes from 172.17.0.100: icmp_seq=2 ttl=64 time=0.035 ms
--- 172.17.0.100 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.035/0.038/0.041/0.003 ms