再探docker容器的网络

docker网络模式

在平常的测试环境中虚拟机会有几种网卡

• 在部署了docker后会有docker0网卡，这是docker容器的虚拟网关
• loopback：回环网卡，用于测试本地通信
• virtual bridge：安装了虚拟化平台后系统自动安装的虚拟网卡

docker的四种网络模式

• host模式：此模式下容器没有自己的网卡，使用的是宿主机的ip和端口，容器没有独立的名称空间，而是和宿主机共享同一个名称空间，但是其他方面还是和宿主机隔离的，但是出容器的话端口不共用。
• container模式：此模式下创建容器不会创建自己的网卡和ip，而是和一个指定的容器共享ip和端口范围，是和一个已存在的容器共享一个名称空间
• none模式：此模式下所有的容器都是完全隔离的，互不通信
• bridge模式：docker默认是该模式，容器有自己的ip和端口，且容器间通信是通过网桥来实现的

docker网络命令

• 查看网络列表

[root@node1 ~]# docker network ls
NETWORK ID     NAME      DRIVER    SCOPE
b3202f47a0b3   bridge    bridge    local
8d83143bb709   host      host      local
259d5d4e3261   none      null      local
//因为一开始的时候没有容器，所以没有container模式

• 指定分配容器ip地址

[root@node1 ~]# docker run -it --name test --network bridge --ip 172.17.0.10 centos:latest /bin/bash
docker: Error response from daemon: user specified IP address is supported on user defined networks only.
ERRO[0000] error waiting for container: context canceled 	//因为默认是172.17网段，所以不能指定固定的ip，需要自己手动设置一个网段指定ip
[root@node1 ~]# docker network create --subnet=172.18.0.0/16 mynetwork
aa2dd28b831b9e0464baf18cb32c489d346eff546f9a5f460c3ad7531443f99a
[root@node1 ~]# docker run -itd --name test1 --net mynetwork --ip 172.18.0.10 centos:latest /bin/bash
94b61ab3713dd2cc9de48b9a9f5fc2230d5754b0971e8e92d2e18153a0ee6501

• 查看分配情况

[root@node1 ~]# docker ps -a
CONTAINER ID   IMAGE           COMMAND                  CREATED          STATUS          PORTS                                         NAMES
94b61ab3713d   centos:latest   "/bin/bash"              29 seconds ago   Up 28 seconds                                                 test1
[root@node1 ~]# docker inspect 94b61ab3713d
...
                     "94b61ab3713d"
                    ],
                    "NetworkID": "aa2dd28b831b9e0464baf18cb32c489d346eff546f9a5f460c3ad7531443f99a",
                    "EndpointID": "f6f9f2500d72803640894ff6289f14a35e0178acbb2b2d9c124d9cf882e73890",
                    "Gateway": "172.18.0.1",
                    "IPAddress": "172.18.0.10",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:12:00:0a",
                    "DriverOpts": null

• 暴露容器端口

[root@node1 ~]# docker run -itd -p 333:80 nginx /bin/bash
a7076c603beb3c56c24624d9d7f603ceba3222aa129045e43443a29b09575db6
[root@node1 ~]# docker ps -a
CONTAINER ID   IMAGE           COMMAND                  CREATED         STATUS         PORTS                                         NAMES
a7076c603beb   nginx           "/bin/bash"              5 seconds ago   Up 4 seconds   0.0.0.0:333->80/tcp, :::333->80/tcp           agitated_thompson
[root@node1 ~]# docker exec -it a7076c603beb /bin/bash -c 'nginx'		//使用exec运行nginx
2021/09/05 15:27:47 [notice] 7#7: using the "epoll" event method
2021/09/05 15:27:47 [notice] 7#7: nginx/1.21.1
2021/09/05 15:27:47 [notice] 7#7: built by gcc 8.3.0 (Debian 8.3.0-6) 
2021/09/05 15:27:47 [notice] 7#7: OS: Linux 3.10.0-957.el7.x86_64
2021/09/05 15:27:47 [notice] 7#7: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2021/09/05 15:27:47 [notice] 14#14: start worker processes
2021/09/05 15:27:47 [notice] 14#14: start worker process 15
2021/09/05 15:27:47 [notice] 14#14: start worker process 16
2021/09/05 15:27:47 [notice] 14#14: start worker process 17
2021/09/05 15:27:47 [notice] 14#14: start worker process 18

• 还可以跟P来随机分配端口

[root@node1 ~]# docker run -itd -P  tomcat:v6 /bin/bash
03dc2914b8353bd07ce36e3c92554962c9635288bf39e372b80ee522f717afa6   
[root@node1 ~]# docker ps -a
CONTAINER ID   IMAGE           COMMAND                  CREATED          STATUS                      PORTS                                         NAMES
eb9742e6819a   tomcat:v6       "/bin/bash"              3 seconds ago    Up 3 seconds                0.0.0.0:49165->8080/tcp, :::49165->8080/tcp   heuristic_kilby

• 进入容器没有systemctl命令，可以用下面的命令

[root@node1 ~]# docker run -itd --name test2 --privileged=true centos /sbin/init
542af81fd41a646ad5a61d478e2055de8ac5124b453df1553bd7b2a600f5d38a
[root@node1 ~]# docker ps -a
CONTAINER ID   IMAGE           COMMAND                  CREATED              STATUS                     PORTS                                         NAMES
542af81fd41a   centos          "/sbin/init"             7 seconds ago        Up 6 seconds                                                             test2

docker数据卷

• 在宿主机目录上挂载容器中的目录

[root@node1 ~]# docker run -v /var/www:/test1 --name web1 -it centos /bin/bash
[root@e25ca0a2f82c /]# cd /test1/
[root@e25ca0a2f82c test1]# ls
[root@e25ca0a2f82c test1]# touch 1.txt
[root@e25ca0a2f82c test1]# exit
exit
[root@node1 ~]# ls /var/www/
1.txt

数据卷容器

[root@node1 ~]# docker run --name web10 -v /test1 -v /test2 -it centos /bin/bash
[root@7bb8e5d31128 /]# cd /test1
[root@7bb8e5d31128 test1]# cd ../test2
[root@7bb8e5d31128 test2]# 

• 新容器挂载数据卷容器web10

[root@node1 ~]# docker run -it --volumes-from web10 --name data1 centos /bin/bash

容器互联

• 创建并运行容器web1，端口号随机分配

[root@node1 ~]# docker run -itd -P --name web1 centos /bin/bash
e01db806c28aa6bca720b6aeb2d03b9771b503210c56e046d81a1df6a4e06cfd

• 创建并运行web2，链接到web1和其通信

[root@node1 ~]# docker run -itd -P --name web2 --link web1:web1 centos /bin/bash
525368396a9b7ded5e5bf35f979ef7b0ba90cd89f83dd4f7d50eceb077ffc9ef
[root@node1 ~]# docker inspect e01db806c28a
...
       "MacAddress": "02:42:ac:11:00:0a",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "b3202f47a0b31b38da774be15ce3251638113996ae46e091f8bc7032b1be97c9",
                    "EndpointID": "ced98f56dc75cb61016e7a1c553d20b7c1777db0e1cdb3634db83c96057377b5",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.10",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:0a",
                    "DriverOpts": null

[root@node1 ~]# docker exec -it  web2 /bin/bash		//进入web2容器然后pingweb1的地址
[root@525368396a9b /]# ping 172.17.0.10
PING 172.17.0.10 (172.17.0.10) 56(84) bytes of data.
64 bytes from 172.17.0.10: icmp_seq=1 ttl=64 time=0.105 ms
64 bytes from 172.17.0.10: icmp_seq=2 ttl=64 time=0.090 ms
^C