docker遇到到的问题-1（手动狗头保命）

最新推荐文章于 2024-08-25 15:34:22 发布

accumulater

最新推荐文章于 2024-08-25 15:34:22 发布

阅读量360

点赞数

分类专栏： IT技巧服务器架构文章标签： docker 网络

本文链接：https://blog.csdn.net/luis_jie/article/details/117018879

版权

IT技巧同时被 2 个专栏收录

2 篇文章 0 订阅

订阅专栏

服务器架构

2 篇文章 0 订阅

订阅专栏

docker遇到到的问题-1

- 容器ping不通www.baidu.com

容器ping不通www.baidu.com

基本情况：
容器使用的默认网桥docker0
容器内安装的centos7:2009操作系统
解决思路：

排除容器内系统网络配置问题

ping 172.17.0.1
[root@035861c11658 /]# ping 172.17.0.1
PING 172.17.0.1 (172.17.0.1) 56(84) bytes of data.
64 bytes from 172.17.0.1: icmp_seq=1 ttl=64 time=0.087 ms
64 bytes from 172.17.0.1: icmp_seq=2 ttl=64 time=0.047 ms
##能ping通网关说明本机网络配置应该正常

docker网络连接排查也没有问题

网关

#列出当前网络
[root@localhost zj]# docker network ls		
NETWORK ID     NAME      DRIVER    SCOPE
abce66f51aab   bridge    bridge    local
3b21da9c0b9e   host      host      local
e15a9c3bfd61   none      null      local

#容器是否确实已启动：
[root@localhost zj]# docker container ls
CONTAINER ID   IMAGE                 COMMAND        CREATED        STATUS             PORTS                                       NAMES
035861c11658   centos:7.9.2009       "/bin/bash"    17 hours ago   Up About an hour                                               test1
58ca0c160240   portainer/portainer   "/portainer"   3 weeks ago    Up About an hour   0.0.0.0:9000->9000/tcp, :::9000->9000/tcp   prtainer-test

#检查bridge网络以查看连接了哪些容器。
[root@localhost zj]# docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "abce66f51aab4fb65f22a73a74e5a9585e1cafea54a0a00ea03c7308119a630e",
        "Created": "2021-05-19T09:40:54.867201558+08:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",#默认网桥网段
                    "Gateway": "172.17.0.1"#docker0网关地址
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {#docker0网桥正在连接容器的网络信息
            "035861c116580929e33f99fa221a76f93f583263c2269b0f519c58973438f63b": {
                "Name": "test1",
                "EndpointID": "58d7c0bbb4388d4c6f440e585184a333395d273803ef4fb1e3fd66415c7c2939",
                "MacAddress": "02:42:ac:11:00:03",
                "IPv4Address": "172.17.0.3/16",
                "IPv6Address": ""
            },
            "58ca0c160240a4caa0c3804271ecbb857251ab3dd41118a90c196fab9da6ffb4": {
                "Name": "prtainer-test",
                "EndpointID": "f6df211b477244f0a44055af22ffd519174229ee5e6ab43d4101d590942d77ee",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {#docker0网段配置信息
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

通过ip link和ip a可以看到本地有个docker0 link

[root@localhost zj]# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether f0:2f:a7:94:dd:c3 brd ff:ff:ff:ff:ff:ff
3: enp2s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether f0:2f:a7:94:dd:c4 brd ff:ff:ff:ff:ff:ff
4: enp2s0f2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether f0:2f:a7:94:dd:c5 brd ff:ff:ff:ff:ff:ff
5: enp2s0f3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether f0:2f:a7:94:dd:c6 brd ff:ff:ff:ff:ff:ff
6: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000
    link/ether 52:54:00:86:69:53 brd ff:ff:ff:ff:ff:ff
7: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN mode DEFAULT group default qlen 1000
    link/ether 52:54:00:86:69:53 brd ff:ff:ff:ff:ff:ff
8: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default

[root@localhost zj]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether f0:2f:a7:94:dd:c3 brd ff:ff:ff:ff:ff:ff
    inet 10.100.103.33/24 brd 10.100.103.255 scope global noprefixroute enp2s0f0
       valid_lft forever preferred_lft forever
    inet6 fe80::881b:d316:27c1:2082/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: enp2s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether f0:2f:a7:94:dd:c4 brd ff:ff:ff:ff:ff:ff
4: enp2s0f2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether f0:2f:a7:94:dd:c5 brd ff:ff:ff:ff:ff:ff
5: enp2s0f3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether f0:2f:a7:94:dd:c6 brd ff:ff:ff:ff:ff:ff
6: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:86:69:53 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
7: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:86:69:53 brd ff:ff:ff:ff:ff:ff
8: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:95:7e:f3:7b brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:95ff:fe7e:f37b/64 scope link 
       valid_lft forever preferred_lft forever
97: br-8c350fc074a7: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default 
    link/ether 02:42:6e:4a:e5:f0 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.1/16 brd 172.18.255.255 scope global br-8c350fc074a7
       valid_lft forever preferred_lft forever
101: vethe52d186@if100: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether 52:e5:e1:2e:55:3d brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::50e5:e1ff:fe2e:553d/64 scope link 
       valid_lft forever preferred_lft forever
103: veth6d4c240@if102: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether 76:5a:82:a8:4c:5a brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::745a:82ff:fea8:4c5a/64 scope link 
       valid_lft forever preferred_lft forever

#yum -y install iproute
[root@localhost zj]# docker exec test1 ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
102: eth0@if103: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default 
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0

[root@localhost zj]# docker exec test1 ip route show
default via 172.17.0.1 dev eth0 
172.17.0.0/16 dev eth0 proto kernel scope link src 172.17.0.3 
#网络没有问题

百度上说可能没有配置路由转发没有将172.17.0.0网段转发到正常能够连接到外网的ip网段上。docker通过docker0网段需要通过NAT转发。
查看一下docker host iptables的规则

[root@localhost zj]# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N DOCKER
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.18.0.0/16 ! -o br-8c350fc074a7 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 9000 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 9000 -j DNAT --to-destination 172.17.0.2:9000

可以看到iptables对docker0这个bridge做了策略：当网桥docker0收到外出的包，把他交给MASQUERADE处理。而MASQUERADE的处理方式是将包的源地址替换成host地址发送出去，即做了一次网络地址转换（NAT）

通过tcpdump查看地址如何转换。先查看docker host的路由表：

[root@localhost zj]# ip r
default via 10.100.103.1 dev enp2s0f0 proto static metric 100 #默认通过enp2s0f0网卡发出
10.100.103.0/24 dev enp2s0f0 proto kernel scope link src 10.100.103.33 metric 100 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1

容器内虚拟机pingwww.baidu.com

[root@035861c11658 /]# ping  www.baidu.com
PING www.a.shifen.com (39.156.66.18) 56(84) bytes of data.
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=1 ttl=51 time=15.0 ms
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=2 ttl=51 time=14.9 ms
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=3 ttl=51 time=14.9 ms
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=4 ttl=51 time=14.8 ms
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=5 ttl=51 time=14.9 ms
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=6 ttl=51 time=14.8 ms
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=7 ttl=51 time=14.8 ms

镜像发送ICMP请求，docker0收到镜像请求后交给MASQURADE进行处理


[root@localhost zj]# tcpdump -i docker0 -n icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on docker0, link-type EN10MB (Ethernet), capture size 262144 bytes
11:23:45.058505 IP 172.17.0.3 > 39.156.66.18: ICMP echo request, id 173, seq 1, length 64
11:23:45.073530 IP 39.156.66.18 > 172.17.0.3: ICMP echo reply, id 173, seq 1, length 64
11:23:46.059508 IP 172.17.0.3 > 39.156.66.18: ICMP echo request, id 173, seq 2, length 64
11:23:46.074424 IP 39.156.66.18 > 172.17.0.3: ICMP echo reply, id 173, seq 2, length 64
11:23:47.061475 IP 172.17.0.3 > 39.156.66.18: ICMP echo request, id 173, seq 3, length 64
11:23:47.076384 IP 39.156.66.18 > 172.17.0.3: ICMP echo reply, id 173, seq 3, length 64
11:23:48.063439 IP 172.17.0.3 > 39.156.66.18: ICMP echo request, id 173, seq 4, length 64
11:23:48.078316 IP 39.156.66.18 > 172.17.0.3: ICMP echo reply, id 173, seq 4, length 64
11:23:49.065366 IP 172.17.0.3 > 39.156.66.18: ICMP echo request, id 173, seq 5, length 64
11:23:49.080305 IP 39.156.66.18 > 172.17.0.3: ICMP echo reply, id 173, seq 5, length 64
11:23:50.067358 IP 172.17.0.3 > 39.156.66.18: ICMP echo request, id 173, seq 6, length 64
11:23:50.082217 IP 39.156.66.18 > 172.17.0.3: ICMP echo reply, id 173, seq 6, length 64
11:23:51.069273 IP 172.17.0.3 > 39.156.66.18: ICMP echo request, id 173, seq 7, length 64
11:23:51.084146 IP 39.156.66.18 > 172.17.0.3: ICMP echo reply, id 173, seq 7, length 64

处理过程：1.容器发送ping包：172.17.0.3>www.baidu.com

              2.docker0收到包后，发现是发送到外网的。交给NAT处理

             3.NAT将源地址转换成enp2s0f0的IP：10.100.103.33>www.baidu.com

             4.ping包从enp2s0f0发出去。到达www.baidu.com

经过一番骚操作，还是没有ping通网络(上述演示是连接外网后的正常显示)。重启一下docker服务试试。emm…能ping通了。

systemctl 方式
守护进程重启
sudo systemctl daemon-reload
重启docker服务
sudo systemctl restart docker
关闭docker
sudo systemctl stop docker

service 方式
重启docker服务
sudo service docker restart
关闭docker
sudo service docker stop