docker网络详解

docker网络详解

1.docker网络类别

root:~# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
b3c345a17e86        bridge              bridge              local
3deaa31920b0        host                host                local
31ef7847f18d        none                null                local

2. bridge模式（默认模式）

docker在宿主机上建里docker0网桥，docker启动容器时，会使用veth-pair技术，新建一对网卡，分别挂载在宿主机docker0上和容器内，从docker0子网中分配一个IP给容器使用，并设置docker0的IP地址为容器的默认网关,使容器和宿主机联通

1. 使用docker run启动一个容器，进入容器，执行

root@16de445b0cd3:/# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
21631: eth0@if21632: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:1f:ff:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.31.255.3/24 brd 172.31.255.255 scope global eth0
       valid_lft forever preferred_lft forever
 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
21596: eth0@if21597: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:1f:ff:04 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.31.255.4/24 brd 172.31.255.255 scope global eth0
       valid_lft forever preferred_lft forever

可以看见两块网卡，本地回环网络lo和eth0网卡，eth0 网卡即是veth-pair的创建的网卡对的容器内的网卡，对应的网卡应为21597
2. 查看宿主机上的对应网卡

root:~# ip a| grep 21597
21597: veth45ac220@if21596: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default

3. 观察到容器内的ip地址为172.31.255.4，这个是同docker0同一网段的网络，查看docker0，从宿主即ping容器ip测试连通，使用traceroute验证（veth-piar）

root:~# ip a| grep docker0
15: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    inet 172.31.255.1/24 brd 172.31.255.255 scope global docker0
21543: vethdbd4a6b@if21542: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
21597: veth45ac220@if21596: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
root:~#
root:~#
root:~# ping 172.31.255.4
PING 172.31.255.4 (172.31.255.4) 56(84) bytes of data.
64 bytes from 172.31.255.4: icmp_seq=1 ttl=64 time=0.293 ms
64 bytes from 172.31.255.4: icmp_seq=2 ttl=64 time=0.057 ms
root:~#
root:~#
root:~# traceroute -n 172.31.255.4
traceroute to 172.31.255.4 (172.31.255.4), 30 hops max, 60 byte packets
 1  172.31.255.4  0.250 ms  0.044 ms  0.038 ms

4. 再启动一个容器，测试容器间的连通

6. root@16de445b0cd3:/# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
21631: eth0@if21632: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:1f:ff:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.31.255.3/24 brd 172.31.255.255 scope global eth0
       valid_lft forever preferred_lft forever
root@16de445b0cd3:/#
root@16de445b0cd3:/#
root@16de445b0cd3:/# ping 172.31.255.4
PING 172.31.255.4 (172.31.255.4): 56 data bytes
64 bytes from 172.31.255.4: icmp_seq=0 ttl=64 time=0.245 ms
64 bytes from 172.31.255.4: icmp_seq=1 ttl=64 time=0.114 ms

root@16de445b0cd3:/# traceroute -n 172.31.255.4
traceroute to 172.31.255.4 (172.31.255.4), 30 hops max, 46 byte packets
 1  172.31.255.4  0.008 ms  0.005 ms  0.004 ms

3. None模式

Docker容器拥有自己的Network Namespace，但是，并不为Docker容器进行任何网络配置

root@a238c815b47c:/# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
   link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
   inet 127.0.0.1/8 scope host lo
      valid_lft forever preferred_lft forever

4. container

共享已存在的的容器的网络，通过lo连通共享的容器

5. Host

使用宿主机网络，容器将不会获得一个独立的Network Namespace，而是和宿主机共用一个Network Namespace，容器将不会虚拟出自己的网卡，配置自己的IP等，而是使用宿主机的IP和端口。