Docker网络

最新推荐文章于 2024-08-04 07:00:00 发布

浮华1994

最新推荐文章于 2024-08-04 07:00:00 发布

阅读量290

点赞数

分类专栏： DOCKER 文章标签： docker

本文链接：https://blog.csdn.net/qq_22494169/article/details/116242143

版权

DOCKER 专栏收录该内容

5 篇文章 0 订阅

订阅专栏

本文详细介绍了Docker的网络管理，包括如何批量删除镜像，Docker0网络的理解，以及容器间的网络连通性。通过实例展示了Docker网络的创建、连接和自定义网络的使用，强调了桥接网络和自定义网络在容器通信中的作用，并讨论了跨网络连通的方法。

摘要由CSDN通过智能技术生成

#批量删除镜像
docker rmi $(docker image ls -aq)


# Docker网络

理解Docker 0

学习之前清空Docker镜像  容器中的内容‘

## **小知识**

~~~shell
#准备工作：查看运行中的容器
docker container ls
docker container ls -a
docker container ls -aq
# 单独删除命令
docker container rm 容器id #删除容器 可简写： docker rm 容器id
docker image rm 镜像ID　　　#删除镜像 可简写： docker rmi 镜像ID 

#批量停止运行中的容器
docker container stop $(docker  ps -aq) 或者 docker container stop $(docker container  ls -aq)
#清空容器
docker rm -f $(docker  ps -aq)   或者 docker rm -f $(docker container ls -aq)  
#删除全部镜像
docker rmi $(docker image ls -aq)

测试网络

在这里插入图片描述

Docker 是如何处理容器网络访问的？

#测试运行一个tomcat
docker run -d -P --name tomcat01 tomcat
#查看容器内部网络地址

docker exec -it 容器id ip addr
[root@localhost ~]# docker exec -it d5a6637b8c3a ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
80: eth0@if81: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
# 思考？ linux能不能ping通容器内部！ 可以 容器内部可以ping通外界吗？ 可以！
#ping 容器内部地址
[root@localhost ~]# ping 172.17.0.2 
PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.
64 bytes from 172.17.0.2: icmp_seq=1 ttl=64 time=0.060 ms
64 bytes from 172.17.0.2: icmp_seq=2 ttl=64 time=0.063 ms
^Z
[1]+  已停止               ping 172.17.0.2
[root@localhost ~]# 
#从容器中ping 虚拟机地址
[root@localhost ~]# docker exec -it d5a6637b8c3a ping 192.168.139.189 
PING 192.168.139.189 (192.168.139.189) 56(84) bytes of data.
64 bytes from 192.168.139.189: icmp_seq=1 ttl=64 time=0.045 ms
64 bytes from 192.168.139.189: icmp_seq=2 ttl=64 time=0.065 ms
64 bytes from 192.168.139.189: icmp_seq=3 ttl=64 time=0.079 ms
64 bytes from 192.168.139.189: icmp_seq=4 ttl=64 time=0.050 ms
^Z^C
--- 192.168.139.189 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3ms
rtt min/avg/max/mdev = 0.045/0.059/0.079/0.016 ms
[root@localhost ~]#

原理

1、我们每启动一个Docker容器，docker就会给docker容器分配一个IP，我们只要安装了docker,就会有一个docker0桥接模式，使用的技术是veth-pair技术！

再次测试 ip a

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-zNvORERw-1619611784380)(images/image-20210427123626045.png)]

2 、再启动一个容器测试，发现又多了一对网络

在这里插入图片描述

# 我们发现这个容器带来网卡，都是一对对的
# veth-pair 就是一对的虚拟设备接口，他们都是成对出现的，一端连着协议，一端彼此相连
# 正因为有这个特性 veth-pair 充当一个桥梁，连接各种虚拟网络设备的
# OpenStac,Docker容器之间的连接，OVS的连接，都是使用evth-pair技术

3、我们来测试一下tomcat01 和tomcat02 是否互通

[root@localhost ~]# docker exec -it tomcat01 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
80: eth0@if81: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
       
[root@localhost ~]# docker exec -it tomcat02 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
82: eth0@if83: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
       #==========================都是可以ping通的==========================
[root@localhost ~]# docker exec -it tomcat01 ping 172.17.0.3
PING 172.17.0.3 (172.17.0.3) 56(84) bytes of data.
64 bytes from 172.17.0.3: icmp_seq=1 ttl=64 time=0.043 ms
^C
--- 172.17.0.3 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.043/0.043/0.043/0.000 ms

[root@localhost ~]# docker exec -it tomcat02 ping 172.17.0.2
PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.
64 bytes from 172.17.0.2: icmp_seq=1 ttl=64 time=0.048 ms
64 bytes from 172.17.0.2: icmp_seq=2 ttl=64 time=0.046 ms
^C
--- 172.17.0.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.046/0.047/0.048/0.001 ms

在这里插入图片描述

结论：tomcat01和tomcat02公用一个路由器，docker0。

所有的容器不指定网络的情况下，都是docker0路由的，docker会给我们的容器分配一个默认的可用ip。

小结

Docker使用的是Linux的桥接，宿主机是一个Docker容器的网桥 docker0

在这里插入图片描述

Docker中所有网络接口都是虚拟的，虚拟的转发效率高（内网传递文件）

只要容器删除，对应的网桥一对就没了！

网络连通

思考一个场景：我们编写了一个微服务，database url=ip: 项目不重启，数据ip换了，我们希望可以处理这个问题，可以通过名字来进行访问容器？

–-link

[root@localhost ~]# docker exec -it tomcat02 ping tomca01   # ping不通
ping: tomca01: Temporary failure in name resolution

[root@localhost ~]# docker run -d -P --name tomcat03 --link tomcat01  tomcat
# tomcat03 ping tomcat01是可以通的
[root@localhost ~]# docker exec -it tomcat03 ping tomcat01
PING tomcat01 (172.17.0.2) 56(84) bytes of data.
64 bytes from tomcat01 (172.17.0.2): icmp_seq=1 ttl=64 time=0.090 ms
64 bytes from tomcat01 (172.17.0.2): icmp_seq=2 ttl=64 time=0.053 ms
^C
--- tomcat01 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.053/0.071/0.090/0.020 ms
# tomcat01 ping tomcat03 是不同的
[root@localhost ~]# docker exec -it tomcat01 ping tomcat03
ping: tomcat03: Temporary failure in name resolution

[root@localhost ~]# docker  inspect tomcat03

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-5LYEkFAT-1619611784382)(images/image-20210427133730940.png)]

查看tomcat03里面的/etc/hosts发现有tomcat01的配置

[root@localhost ~]# docker exec -it tomcat03 cat /etc/hosts
127.0.0.1       localhost
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2      tomcat01 d5a6637b8c3a
172.17.0.4      7e954562c099
[root@localhost ~]#

link 本质就是在hosts配置中添加映射

现在使用Docker已经不建议使用–link了！

网络连通，不适用docker0！

docker0问题：不支持容器名连接访问！

自定义网络

docker network
connect     -- Connect a container to a network
create      -- Creates a new network with a name specified by the
disconnect  -- Disconnects a container from a network
inspect     -- Displays detailed information on a network
ls          -- Lists all the networks created by the user
prune       -- Remove all unused networks
rm          -- Deletes one or more networks

查看所有的docker网络

[root@localhost ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
de24dfbb76ac        bridge              bridge              local
fa072ca2405d        host                host                local
1242026f0803        none                null                local

网络模式

bridge ：桥接 docker（默认，自己创建也是用bridge模式）

none ：不配置网络，一般不用

host ：和所主机共享网络

container ：容器网络连通（用得少！局限很大）

测试

# 我们直接启动的命令 --net bridge,而这个就是我们得docker0
# bridge就是docker0
$ docker run -d -P --name tomcat01 tomcat
等价于 => docker run -d -P --name tomcat01 --net bridge tomcat

# docker0，特点：默认，域名不能访问。 --link可以打通连接，但是很麻烦！
# 我们可以 自定义一个网络
docker network create --driver bridge --subnet 192.168.0.0/16 --gateway 192.168.0.1 mynetwork

[root@localhost ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
de24dfbb76ac        bridge              bridge              local
fa072ca2405d        host                host                local
7e3623daab15        mynetwork           bridge              local
1242026f0803        none                null                local

查看网络信息

[root@localhost ~]# docker network inspect mynetwork
[
    {
        "Name": "mynetwork",
        "Id": "7e3623daab15665c7071e4317b9fbb5fe348e2f0cc9e66b6c0f7b348c768bf0d",
        "Created": "2021-04-27T13:44:18.384080059+08:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "192.168.0.0/16",
                    "Gateway": "192.168.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {},
        "Labels": {}
    }
]

启动两个tomcat,再次查看网络情况

[root@localhost ~]# docker run -d -P --name tomcat-net-01 --net mynetwork   tomcat
WARNING: IPv4 forwarding is disabled. Networking will not work.
015dd418674e310a8a8c929dd277331c3397a5c104c7cf1f8c064413b581a845
[root@localhost ~]# docker run -d -P --name tomcat-net-02 --net mynetwork   tomcat
WARNING: IPv4 forwarding is disabled. Networking will not work.
2fd0e70e5e352913a2f9e36dc651c8b2f4a17629c5e3e7c87279146f52828330

[root@localhost ~]# docker network inspect mynetwork
[
    {
        "Name": "mynetwork",
        "Id": "7e3623daab15665c7071e4317b9fbb5fe348e2f0cc9e66b6c0f7b348c768bf0d",
        "Created": "2021-04-27T13:44:18.384080059+08:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "192.168.0.0/16",
                    "Gateway": "192.168.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "015dd418674e310a8a8c929dd277331c3397a5c104c7cf1f8c064413b581a845": {
                "Name": "tomcat-net-01",
                "EndpointID": "a3e74b02b48e799a055a8e93ab750e933bf548a349701066fb1d8a7a974914cb",
                "MacAddress": "02:42:c0:a8:00:02",
                "IPv4Address": "192.168.0.2/16",
                "IPv6Address": ""
            },
            "2fd0e70e5e352913a2f9e36dc651c8b2f4a17629c5e3e7c87279146f52828330": {
                "Name": "tomcat-net-02",
                "EndpointID": "3da6bb28d2819c835e5980e97751a878c13e0b70e86bccdea42eefbce901e390",
                "MacAddress": "02:42:c0:a8:00:03",
                "IPv4Address": "192.168.0.3/16",
                "IPv6Address": ""
            }
        },
        "Options": {},
        "Labels": {}
    }
]

在自定义的网络下，服务可以互相ping通

[root@localhost ~]# docker exec -it tomcat-net-01 ping tomcat-net-02
PING tomcat-net-02 (192.168.0.3) 56(84) bytes of data.
64 bytes from tomcat-net-02.mynetwork (192.168.0.3): icmp_seq=1 ttl=64 time=0.359 ms
64 bytes from tomcat-net-02.mynetwork (192.168.0.3): icmp_seq=2 ttl=64 time=0.047 ms
^C
--- tomcat-net-02 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 2ms
rtt min/avg/max/mdev = 0.047/0.203/0.359/0.156 ms
[root@localhost ~]# docker exec -it tomcat-net-02 ping tomcat-net-01
PING tomcat-net-01 (192.168.0.2) 56(84) bytes of data.
64 bytes from tomcat-net-01.mynetwork (192.168.0.2): icmp_seq=1 ttl=64 time=0.031 ms
^C
--- tomcat-net-01 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.031/0.031/0.031/0.000 ms
[root@localhost ~]#

我们自定义的网络docker当我们维护好了对应的关系，推荐我们平时这样使用网络！

好处：

redis -不同的集群使用不同的网络，保证集群是安全和健康的

mysql-不同的集群使用不同的网络，保证集群是安全和健康的

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-RrtN20jM-1619611784382)(images/image-20210427134856059.png)]

网络连通


[root@localhost ~]# docker network

Usage:  docker network COMMAND

Manage networks

Commands:
  connect     Connect a container to a network  ##连通网络
  create      Create a network
  disconnect  Disconnect a container from a network
  inspect     Display detailed information on one or more networks
  ls          List networks
  prune       Remove all unused networks
  rm          Remove one or more networks

Run 'docker network COMMAND --help' for more information on a command.

[root@localhost ~]# docker network connect --help

Usage:  docker network connect [OPTIONS] NETWORK CONTAINER

Connect a container to a network

Options:
      --alias strings           Add network-scoped alias for the container
      --driver-opt strings      driver options for the network
      --ip string               IPv4 address (e.g., 172.30.100.104)
      --ip6 string              IPv6 address (e.g., 2001:db8::33)
      --link list               Add link to another container
      --link-local-ip strings   Add a link-local address for the container

测试两个不同的网络连通启动两个tomcat 使用默认网络，

[root@localhost ~]# docker exec -it tomcat01 ping tomcat-net-01
ping: tomcat-net-01: Temporary failure in name resolution
[root@localhost ~]# docker exec -it tomcat02 ping tomcat-net-01
ping: tomcat-net-01: Temporary failure in name resolution

# 要将tomcat01 连通 tomcat—net-01 ，连通就是将 tomcat01加到 mynet网络
# 一个容器两个ip（tomcat01）
[root@localhost ~]# docker network connect tomcat01 mynetwork
Error response from daemon: No such container: mynetwork

[root@localhost ~]# docker network connect  mynetwork tomcat01

[root@localhost ~]# docker exec -it tomcat01 ping tomcat-net-01
PING tomcat-net-01 (192.168.0.2) 56(84) bytes of data.
64 bytes from tomcat-net-01.mynetwork (192.168.0.2): icmp_seq=1 ttl=64 time=0.074 ms
64 bytes from tomcat-net-01.mynetwork (192.168.0.2): icmp_seq=2 ttl=64 time=0.060 ms
64 bytes from tomcat-net-01.mynetwork (192.168.0.2): icmp_seq=3 ttl=64 time=0.045 ms


[root@localhost ~]# docker exec -it tomcat-net-01 ping tomcat01
PING tomcat01 (192.168.0.4) 56(84) bytes of data.
64 bytes from tomcat01.mynetwork (192.168.0.4): icmp_seq=1 ttl=64 time=0.033 ms
64 bytes from tomcat01.mynetwork (192.168.0.4): icmp_seq=2 ttl=64 time=0.035 ms
64 bytes from tomcat01.mynetwork (192.168.0.4): icmp_seq=3 ttl=64 time=0.087 ms

# 01连通 ，加入后此时，已经可以tomcat01 和 tomcat-01-net ping通了
# 02是依旧不通的

结论：假设要跨网络操作别人，就需要使用docker network connect 连通！

浮华1994

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
Docker网络

#批量删除镜像docker rmi $(docker image ls -aq)# Docker网络理解Docker 0学习之前清空Docker镜像容器中的内容‘## **小知识**~~~shell#准备工作：查看运行中的容器docker container lsdocker container ls -adocker container ls -aq# 单独删除命令docker container rm 容器id #删除容器可简写： docker rm 容器idd
复制链接

扫一扫

专栏目录