这篇主要是学习了docker网络相关的知识,主要参考以下三篇文章:容器默认网络bridge,使用 Docker 容器网,Docker网络详解及pipework源码解读与实践,最后一篇原理更清楚一些。要构建具有安全的一致行为的 Web 应用程序,可以使用 Docker 网络特性,网络为容器实现了完全隔离,所以,控制您的应用程序所在的网络很重要。
安装 Docker 时,它会自动创建 3 个网络。可以使用 docker network ls命令列出这些网络。$ docker network ls
NETWORK ID NAME DRIVER
7fca4eb8c647 bridge bridge
9f904ee27bf5 none null
cf03ee007fb4 host host
- bridge 网络表示所有 Docker 安装中都存在的 docker0 网络。除非使用 docker run --net=<NETWORK>选项另行指定,否则 Docker 守护进程默认情况下会将容器连接到此网络。在主机上使用 ifconfig命令,可以看到此网桥是主机的网络堆栈的一部分。
- none 网络在一个特定于容器的网络堆栈上添加了一个容器。该容器缺少网络接口。
- host 网络在主机网络堆栈上添加一个容器。您可以发现,容器中的网络配置与主机相同。
在bridge模式下,连在同一网桥上的容器可以相互通信,容器也可以与外部通信,通过inspect命令查看各个网络中的容器,下边是查看网络bridge中的容器
[root@iZwz9cps5bpzjurg8m4ax0Z ~]# docker network inspect bridge
[
{
"Name": "bridge",
"Id": "ac1d92e5a5686ec83a9f5c1081214515729248af992dd063107dcbe37aaaac49",
"Scope": "local",
"Driver": "bridge",
"IPAM": {
"Driver": "default",
"Config": [
{
"Subnet": "172.17.42.1/16",
"Gateway": "172.17.42.1"
}
]
},
"Containers": {
"33225198ecc3be768993ba548394f94c062c7ab2b5acf47362b812b409a9d059": {
"EndpointID": "2266dae6f2c5821b72914df9a2779cc48e0dde530321d1b54fd88d452e33ea04",
"MacAddress": "02:42:ac:11:00:04",
"IPv4Address": "172.17.0.4/16",
"IPv6Address": ""
},
"812b841b54229210f8c261ee6c976327caf1e6d823936557b8e68ccdac43bb34": {
"EndpointID": "8c1f8fe852443f631d3737a0747605ee76bc2ef55562429026512ff5fa6bb21c",
"MacAddress": "02:42:ac:11:00:05",
"IPv4Address": "172.17.0.5/16",
"IPv6Address": ""
},
"c0a44b2116c88c6c0e708814d4cfcd323fb20867f71180fcfbf59a934e4a7add": {
"EndpointID": "b269af7709921df6ad07863d5a9d638c73f3eb92b07e469cf454b2b3cadc5430",
"MacAddress": "02:42:ac:11:00:03",
"IPv4Address": "172.17.0.3/16",
"IPv6Address": ""
},
"d01019ff4818378f5d8cebd87ed606c3f02443fa05fdbc74e1cd04bbc2531cdd": {
"EndpointID": "f74b74f2d66162fb5e7772e808b7e28035a22ded00571966fa4ecb9d85363c95",
"MacAddress": "02:42:ac:11:00:01",
"IPv4Address": "172.17.0.1/16",
"IPv6Address": ""
},
"eb7b3e268ff248d41b0d421852d1491c862279eacc971664bc28ddd3eac396c9": {
"EndpointID": "779a2530227b7f3e30539fd6f807d0c4824ce8660a4b2e99cc5155e84ed5416d",
"MacAddress": "02:42:ac:11:00:02",
"IPv4Address": "172.17.0.2/16",
"IPv6Address": ""
}
},
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
}
}
]
在containers中看到的是5个,表示目前有5个容器加入到这个网络中
[root@iZwz9cps5bpzjurg8m4ax0Z ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
812b841b5422 daocloud.io/mysql "docker-entrypoint.sh" 8 days ago Up 8 days 0.0.0.0:3308->3306/tcp mysql-slave
33225198ecc3 daocloud.io/mysql "docker-entrypoint.sh" 8 days ago Up 8 days 0.0.0.0:3307->3306/tcp mysql-master
c0a44b2116c8 txxs/springbootdocker:1.0 "java -jar /app.jar" 2 weeks ago Up 8 days 0.0.0.0:8083->8080/tcp insane_noyce
eb7b3e268ff2 txxs/springbootdocker:1.0 "java -jar /app.jar" 2 weeks ago Up 8 days 0.0.0.0:8082->8080/tcp stoic_mayer
d01019ff4818 txxs/springbootdocker:1.0 "java -jar /app.jar" 2 weeks ago Up 8 days 0.0.0.0:8081->8080/tcp stoic_morse
可以通过container的ID,找到其在bridge中的映射的配置,比如d01019ff4818这个ID对应的网络配置就是:
"d01019ff4818378f5d8cebd87ed606c3f02443fa05fdbc74e1cd04bbc2531cdd": {
"EndpointID": "f74b74f2d66162fb5e7772e808b7e28035a22ded00571966fa4ecb9d85363c95",
"MacAddress": "02:42:ac:11:00:01",
"IPv4Address": "172.17.0.1/16",
"IPv6Address": ""
},
docker run启动容器的时候会默认使用bridge这个网络,进入mysql-slave这个容器中可以查看对应的对应的IP
docker exec -it mysql-slave /bin/bash
root@812b841b5422:/# more /etc/hosts
172.17.0.5 812b841b5422
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
对应于bridge网络中的这个容器
"812b841b54229210f8c261ee6c976327caf1e6d823936557b8e68ccdac43bb34": {
"EndpointID": "8c1f8fe852443f631d3737a0747605ee76bc2ef55562429026512ff5fa6bb21c",
"MacAddress": "02:42:ac:11:00:05",
"IPv4Address": "172.17.0.5/16",
"IPv6Address": ""
},
进入到mysql-master这个容器后可以ping 172.17.0.5可以获取相关的数据,原因就是在同一个bridge网络内,在同一个网络下的容器是可以相互ping通的
[root@iZwz9cps5bpzjurg8m4ax0Z ~]# docker exec -it mysql-master /bin/bash
root@33225198ecc3:/# more /etc/hosts
172.17.0.4 33225198ecc3
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
root@33225198ecc3:/# ping 172.17.0.5
PING 172.17.0.5 (172.17.0.5): 56 data bytes
64 bytes from 172.17.0.5: icmp_seq=0 ttl=64 time=0.204 ms
64 bytes from 172.17.0.5: icmp_seq=1 ttl=64 time=0.070 ms
64 bytes from 172.17.0.5: icmp_seq=2 ttl=64 time=0.066 ms
了解完默认的bridge网络后,可以创建一个自己的网络,使用create命令,默认的驱动方式也是bridge,除此之外还可以创建overlay类型的网络。bridge网络适用于单台宿主机运行的单Docker引擎环境,而overlay网络允许我们跨多台宿主机进行通讯。使用默认的创建结果如下:
docker network create springboot-app-net
[root@iZwz9cps5bpzjurg8m4ax0Z springboot-docker-test]# docker network inspect springboot-app-net
[
{
"Name": "springboot-app-net",
"Id": "cf4ca23bcb27914148c822d6f675469a5e8bd87dbf6066890e6aba1593eec9f5",
"Scope": "local",
"Driver": "bridge",
"IPAM": {
"Driver": "default",
"Config": [
{}
]
},
"Containers": {},
"Options": {}
}
]
docker Version: 1.9.1的情况下使用docker run --net=<NETWORK>将新创建的容器加入到自定义的网络中,运行结果如下
docker run --net=springboot-app-net -d -p 8084:8080 -it --name syway txxs/springbootdocker:1.0
[root@iZwz9cps5bpzjurg8m4ax0Z springboot-docker-test]# docker network inspect springboot-app-net
[
{
"Name": "springboot-app-net",
"Id": "cf4ca23bcb27914148c822d6f675469a5e8bd87dbf6066890e6aba1593eec9f5",
"Scope": "local",
"Driver": "bridge",
"IPAM": {
"Driver": "default",
"Config": [
{}
]
},
"Containers": {
"9313ea5d190e6675cfa36a0327e81f480e8d0d8e530e21037d2948b7772b8c6f": {
"EndpointID": "d1054b8bb430e68a504df200f6d81efb3b7cd62e45534f272659cc40c1bb936c",
"MacAddress": "02:42:ac:13:00:02",
"IPv4Address": "172.19.0.2/16",
"IPv6Address": ""
}
},
"Options": {}
}
]
将在bridge网络中的stoic_mayer重新调整网络加入到springboot-app-net中,在原有的网络bridge中的映射关系没有发生改变
docker network connect springboot-app-net stoic_mayer
root@iZwz9cps5bpzjurg8m4ax0Z /]# docker network inspect springboot-app-net
[
{
"Name": "springboot-app-net",
"Id": "cf4ca23bcb27914148c822d6f675469a5e8bd87dbf6066890e6aba1593eec9f5",
"Scope": "local",
"Driver": "bridge",
"IPAM": {
"Driver": "default",
"Config": [
{}
]
},
"Containers": {
"9313ea5d190e6675cfa36a0327e81f480e8d0d8e530e21037d2948b7772b8c6f": {
"EndpointID": "d1054b8bb430e68a504df200f6d81efb3b7cd62e45534f272659cc40c1bb936c",
"MacAddress": "02:42:ac:13:00:02",
"IPv4Address": "172.19.0.2/16",
"IPv6Address": ""
},
"eb7b3e268ff248d41b0d421852d1491c862279eacc971664bc28ddd3eac396c9": {
"EndpointID": "6a6d9bb12e66a9994e4ffd79f50d1a3fbfdf44ff8a355d7fb2eac28a074fc38d",
"MacAddress": "02:42:ac:13:00:03",
"IPv4Address": "172.19.0.3/16",
"IPv6Address": ""
}
},
"Options": {}
}
]
容器仅能在网络内通信,不能跨网络进行通信。一个连接到两个网络的容器可与每个网络中的成员容器进行通信。当一个容器连接到多个网络时,外部连接通过第一个(按词典顺序)非内部网络提供。还可以使用--link命令将两个容器连接起来,通过--link选项创建的容器可以对链接的容器名(container-name)作为hostname进行直接访问
当解除网络关系的时候使用命令:
docker network disconnet springboot-app-net stoic_mayer
删除网络:
docker network rm springboot-app-net
docker网络这部分不懂的还有很多,需要花时间继续学习,如果有不正确的请多指正!