Docker 网络 none模式

处于none模式有自己的网卡，有网络模块但是docker不会给其配置IP地址，可以看到是没有ip的，需要手工配置IP地址。

none 网络就是什么都没有的网络。挂在这个网络下的容器除了 lo，没有其他任何网卡。容器创建时，可以通过 –network=none 指定使用 none 网络。

[root@localhost test]# docker run -itd --net=none centos-ssh
3205a3b3ff63a7e568c5096fd20b1355fd758ed3f158011cbb10b96d3656cac8

[root@localhost test]# docker exec -it 3205a3b3ff63  /bin/bash
[root@3205a3b3ff63 ansible]# ifconfig
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

要通过pipework配置IP，这工具要安装在宿主机上面。这个是有网卡模块的，只不过需要你来配置IP，这个企业用的多。

[root@localhost ~]# git clone https://github.com/jpetazzo/pipework
Cloning into 'pipework'...
remote: Enumerating objects: 8, done.
remote: Counting objects: 100% (8/8), done.
remote: Compressing objects: 100% (6/6), done.
remote: Total 518 (delta 2), reused 5 (delta 2), pack-reused 510
Receiving objects: 100% (518/518), 182.72 KiB | 17.00 KiB/s, done.
Resolving deltas: 100% (272/272), done.
[root@localhost ~]# ls
anaconda-ks.cfg  default.conf  index.html  pipework  ROOT  test
[root@localhost ~]# cp pipework/pipework /usr/local/bin/

                             桥接网卡  容器的ID号        ip     掩码 网关
[root@localhost ~]# pipework docker0 3205a3b3ff63 172.17.0.99/24@172.17.0.1 
这样不需要dhcp分配，静态指定的
[root@localhost ~]# docker exec -it 3205a3b3ff63 /bin/bash
[root@3205a3b3ff63 ansible]# ifconfig
eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.99  netmask 255.255.255.0  broadcast 172.17.0.255
        ether f6:04:29:d2:3c:4f  txqueuelen 1000  (Ethernet)
        RX packets 8  bytes 648 (648.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1  bytes 42 (42.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

宿主机去ping一下 

[root@3205a3b3ff63 ansible]# ping 172.17.0.99
PING 172.17.0.99 (172.17.0.99) 56(84) bytes of data.
64 bytes from 172.17.0.99: icmp_seq=1 ttl=64 time=0.034 ms
^C
--- 172.17.0.99 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.034/0.034/0.034/0.000 ms
[root@3205a3b3ff63 ansible]# ping 172.17.0.1 
PING 172.17.0.1 (172.17.0.1) 56(84) bytes of data.
64 bytes from 172.17.0.1: icmp_seq=1 ttl=64 time=0.060 ms
^C
--- 172.17.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.060/0.060/0.060/0.000 ms
[root@3205a3b3ff63 ansible]# ping www.baidu.com
PING www.a.shifen.com (180.101.49.11) 56(84) bytes of data.
64 bytes from 180.101.49.11 (180.101.49.11): icmp_seq=1 ttl=127 time=16.1 ms
^C
--- www.a.shifen.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 16.169/16.169/16.169/0.000 ms


使用使用pipework工具可以给虚拟机容器指定Ip地址，总结就是none模式有网络模块但没有给其配置ip

对于这样的一个封闭网络有什么用呢？
其实还真有应用场景。封闭意味着隔离，一些对安全性要求高并且不需要联网的应用可以使用 none 网络。比如某个容器的唯一用途是生成随机密码，就可以放到 none 网络中避免密码被窃取。