处于none模式有自己的网卡,有网络模块但是docker不会给其配置IP地址,可以看到是没有ip的,需要手工配置IP地址。
none 网络就是什么都没有的网络。挂在这个网络下的容器除了 lo,没有其他任何网卡。容器创建时,可以通过 –network=none 指定使用 none 网络。
[root@localhost test]# docker run -itd --net=none centos-ssh
3205a3b3ff63a7e568c5096fd20b1355fd758ed3f158011cbb10b96d3656cac8
[root@localhost test]# docker exec -it 3205a3b3ff63 /bin/bash
[root@3205a3b3ff63 ansible]# ifconfig
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
loop txqueuelen 1 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
要通过pipework配置IP,这工具要安装在宿主机上面。这个是有网卡模块的,只不过需要你来配置IP,这个企业用的多。
[root@localhost ~]# git clone https://github.com/jpetazzo/pipework
Cloning into 'pipework'...
remote: Enumerating objects: 8, done.
remote: Counting objects: 100% (8/8), done.
remote: Compressing objects: 100% (6/6), done.
remote: Total 518 (delta 2), reused 5 (delta 2), pack-reused 510
Receiving objects: 100% (518/518), 182.72 KiB | 17.00 KiB/s, done.
Resolving deltas: 100% (272/272), done.
[root@localhost ~]# ls
anaconda-ks.cfg default.conf index.html pipework ROOT test
[root@localhost ~]# cp pipework/pipework /usr/local/bin/
桥接网卡 容器的ID号 ip 掩码 网关
[root@localhost ~]# pipework docker0 3205a3b3ff63 172.17.0.99/24@172.17.0.1
这样不需要dhcp分配,静态指定的
[root@localhost ~]# docker exec -it 3205a3b3ff63 /bin/bash
[root@3205a3b3ff63 ansible]# ifconfig
eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.17.0.99 netmask 255.255.255.0 broadcast 172.17.0.255
ether f6:04:29:d2:3c:4f txqueuelen 1000 (Ethernet)
RX packets 8 bytes 648 (648.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1 bytes 42 (42.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
宿主机去ping一下
[root@3205a3b3ff63 ansible]# ping 172.17.0.99
PING 172.17.0.99 (172.17.0.99) 56(84) bytes of data.
64 bytes from 172.17.0.99: icmp_seq=1 ttl=64 time=0.034 ms
^C
--- 172.17.0.99 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.034/0.034/0.034/0.000 ms
[root@3205a3b3ff63 ansible]# ping 172.17.0.1
PING 172.17.0.1 (172.17.0.1) 56(84) bytes of data.
64 bytes from 172.17.0.1: icmp_seq=1 ttl=64 time=0.060 ms
^C
--- 172.17.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.060/0.060/0.060/0.000 ms
[root@3205a3b3ff63 ansible]# ping www.baidu.com
PING www.a.shifen.com (180.101.49.11) 56(84) bytes of data.
64 bytes from 180.101.49.11 (180.101.49.11): icmp_seq=1 ttl=127 time=16.1 ms
^C
--- www.a.shifen.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 16.169/16.169/16.169/0.000 ms
使用使用pipework工具可以给虚拟机容器指定Ip地址,总结就是none模式有网络模块但没有给其配置ip
对于这样的一个封闭网络有什么用呢?
其实还真有应用场景。封闭意味着隔离,一些对安全性要求高并且不需要联网的应用可以使用 none 网络。比如某个容器的唯一用途是生成随机密码,就可以放到 none 网络中避免密码被窃取。