docker容器网络配置

最新推荐文章于 2024-07-29 03:33:58 发布

seven凡

最新推荐文章于 2024-07-29 03:33:58 发布

阅读量261

点赞数

文章标签： docker 网络 linux

本文链接：https://blog.csdn.net/qq_53078033/article/details/126254042

版权

docker容器网络配置

Linux内核实现名称空间的创建

ip netns命令

可以借助ip netns命令来完成对 Network Namespace 的各种操作。ip netns命令来自于iproute安装包，一般系统会默认安装，如果没有的话，请自行安装。

注意：ip netns命令修改网络配置时需要 sudo 权限。

可以通过ip netns命令完成对Network Namespace 的相关操作，可以通过ip netns help查看命令帮助信息：

[root@zzz ~]# ip netns help
Usage:	ip netns list
	ip netns add NAME
	ip netns attach NAME PID
	ip netns set NAME NETNSID
	ip [-all] netns delete [NAME]
	ip netns identify [PID]
	ip netns pids NAME
	ip [-all] netns exec [NAME] cmd ...
	ip netns monitor
	ip netns list-id
NETNSID := auto | POSITIVE-INT

默认情况下，Linux系统中是没有任何 Network Namespace的，所以ip netns list命令不会返回任何信息。

创建Network Namespace

通过命令创建一个名为ns0的命名空间

[root@zzz ~]# ip netns add ns0
[root@zzz ~]# ip netns list
ns0

新创建的 Network Namespace 会出现在/var/run/netns/目录下。如果相同名字的 namespace 已经存在，命令会报Cannot create namespace file “/var/run/netns/ns0”: File exists的错误。

[root@zzz ~]# ls /var/run/netns/
ns0
[root@zzz ~]# ip netns add ns0
Cannot create namespace file "/var/run/netns/ns0": File exists

对于每个 Network Namespace 来说，它会有自己独立的网卡、路由表、ARP 表、iptables 等和网络相关的资源。

操作Network Namespace

ip命令提供了ip netns exec子命令可以在对应的 Network Namespace 中执行命令。

查看新创建 Network Namespace 的网卡信息

[root@zzz ~]# ip netns exec ns0 ip add
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

可以看到，新创建的Network Namespace中会默认创建一个lo回环网卡，此时网卡处于关闭状态。此时，尝试去 ping 该lo回环网卡，会提示Network is unreachable

[root@zzz ~]# ip netns exec ns0 ping 127.0.0.1
connect: Network is unreachable

通过下面的命令启用lo回环网卡：

[root@zzz ~]# ip netns exec ns0 ip link set lo up
[root@zzz ~]# ip netns exec ns0 ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.034 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.038 ms
^C
--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 16ms
rtt min/avg/max/mdev = 0.034/0.036/0.038/0.002 ms
[root@zzz ~]#

转移设备

我们可以在不同的 Network Namespace 之间转移设备（如veth）。由于一个设备只能属于一个 Network Namespace ，所以转移后在这个 Network Namespace 内就看不到这个设备了。

其中，veth设备属于可转移设备，而很多其它设备（如lo、vxlan、ppp、bridge等）是不可以转移的。

veth pair

veth pair 全称是 Virtual Ethernet Pair，是一个成对的端口，所有从这对端口一端进入的数据包都将从另一端出来，反之也是一样。
引入veth pair是为了在不同的 Network Namespace 直接进行通信，利用它可以直接将两个 Network Namespace 连接起来。
在这里插入图片描述

创建veth pair

[root@zzz ~]# ip link add type veth
[root@zzz ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:c7:a8:7b brd ff:ff:ff:ff:ff:ff
    inet 192.168.87.128/24 brd 192.168.87.255 scope global dynamic noprefixroute ens33
       valid_lft 1176sec preferred_lft 1176sec
    inet6 fe80::3f31:1b71:96a5:5c42/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:a4:d4:e9:e0 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
4: veth0@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 9e:95:ec:37:4d:27 brd ff:ff:ff:ff:ff:ff
5: veth1@veth0: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 0e:39:13:f5:55:ff brd ff:ff:ff:ff:ff:ff

可以看到，此时系统中新增了一对veth pair，将veth0和veth1两个虚拟网卡连接了起来，此时这对 veth pair 处于”未启用“状态。

实现Network Namespace间通信

下面我们利用veth pair实现两个不同的 Network Namespace 之间的通信。刚才我们已经创建了一个名为ns0的 Network Namespace，下面再创建一个信息Network Namespace，命名为ns1

[root@zzz ~]# ip netns add ns1
[root@zzz ~]# ip netns exec ns1 ip link set lo up
[root@zzz ~]# ip netns list
ns1
ns0
[root@zzz ~]#

然后我们将veth0加入到ns0，将veth1加入到ns1

[root@zzz ~]# ip link set veth0 netns ns0
[root@zzz ~]# ip link set veth1 netns ns1

然后我们分别为这对veth pair配置上ip地址，并启用它们

[root@zzz ~]# ip link set veth0 netns ns0
[root@zzz ~]# ip link set veth1 netns ns1
[root@zzz ~]# ip netns exec ns0 ip link set veth0 up
[root@zzz ~]# ip netns exec ns0 ip addr add 192.168.1.1/24 dev veth0
[root@zzz ~]# ip netns exec ns1 ip link set veth1 up
[root@zzz ~]# ip netns exec ns1 ip addr add 192.168.1.2/24 dev veth
1

查看这对veth pair的状态

[root@zzz ~]# ip netns exec ns0 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
4: veth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 9e:95:ec:37:4d:27 brd ff:ff:ff:ff:ff:ff link-netns ns1
    inet 192.168.1.1/24 scope global veth0
       valid_lft forever preferred_lft forever
    inet6 fe80::9c95:ecff:fe37:4d27/64 scope link 
       valid_lft forever preferred_lft forever
[root@zzz ~]# ip netns exec ns1 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
5: veth1@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 0e:39:13:f5:55:ff brd ff:ff:ff:ff:ff:ff link-netns ns0
    inet 192.168.1.2/24 scope global veth1
       valid_lft forever preferred_lft forever
    inet6 fe80::c39:13ff:fef5:55ff/64 scope link 
       valid_lft forever preferred_lft forever
[root@zzz ~]#

访问ns0中的IP地址：

[root@zzz ~]# ip netns exec ns1 ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.041 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.089 ms
^C
--- 192.168.1.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 12ms
rtt min/avg/max/mdev = 0.041/0.065/0.089/0.024 ms

可以看到，veth pair成功实现了两个不同Network Namespace之间的网络交互。

veth设备重命名

首先需要停掉网卡

[root@zzz ~]# ip netns exec ns0 ip link set veth0 down
[root@zzz ~]# ip netns exec ns0 ip link set dev veth0 name etho
[root@zzz ~]# ip netns exec ns1 ip link set veth1 down
[root@zzz ~]# ip netns exec ns1 ip link set dev veth1 name eth1
[root@zzz ~]# ip netns exec ns0 ifconfig -a
etho: flags=4098<BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.1.1  netmask 255.255.255.0  broadcast 0.0.0.0
        ether 9e:95:ec:37:4d:27  txqueuelen 1000  (Ethernet)
        RX packets 16  bytes 1216 (1.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 16  bytes 1216 (1.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 4  bytes 336 (336.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4  bytes 336 (336.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@zzz ~]# ip netns exec ns1 ifconfig -a
eth1: flags=4098<BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.1.2  netmask 255.255.255.0  broadcast 0.0.0.0
        ether 0e:39:13:f5:55:ff  txqueuelen 1000  (Ethernet)
        RX packets 16  bytes 1216 (1.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 16  bytes 1216 (1.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@zzz ~]#

四种网络模式配置

bridge模式配置

[root@zzz ~]# docker run -dit --name web --rm centos
ea475a6d08f9900c1d4b9ebe06767d817200f278490eff466609721172b1dcad
[root@zzz ~]# docker exec -it web /bin/bash
[root@ea475a6d08f9 /]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
6: eth0@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
[root@ea475a6d08f9 /]#

none模式配置

[root@zzz ~]# docker run -d -it --name web --network none --rm centos
64314c78433324fd3cdbe0f4aeb71b4d268e21c675629ea84c2fb7ec76dd98de
[root@zzz ~]# docker ps
CONTAINER ID   IMAGE     COMMAND       CREATED         STATUS         PORTS     NAMES
64314c784333   centos    "/bin/bash"   7 seconds ago   Up 6 seconds             web
[root@zzz ~]# docker exec -it web /bin/bash
[root@64314c784333 /]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
[root@64314c784333 /]#

container模式配置

[root@zzz ~]# docker run -dit --name web1 --rm centos
9c72a2664048db915a3b3e0e47246006b4c34c0fe3db263d219c02afb8f6ed07
[root@zzz ~]# docker run -dit --name web2 --rm centos
a3e27dd0513959865617b1dfb4f2d22318b0556ea94db76a0dea077eecc9a391
[root@zzz ~]# docker ps
CONTAINER ID   IMAGE     COMMAND       CREATED          STATUS          PORTS     NAMES
a3e27dd05139   centos    "/bin/bash"   4 seconds ago    Up 3 seconds              web2
9c72a2664048   centos    "/bin/bash"   15 seconds ago   Up 14 seconds             web1
[root@zzz ~]# docker exec -it web1 /bin/bash
[root@9c72a2664048 /]# ip a 
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
8: eth0@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
[root@9c72a2664048 /]# exit
exit
[root@zzz ~]# docker exec -it web2 /bin/bash
[root@a3e27dd05139 /]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
10: eth0@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
[root@a3e27dd05139 /]#

我们可以看到两个容器的IP地址都不相同
此时停掉web2，给web2配置container模式

[root@zzz ~]# docker stop web2
web2
[root@zzz ~]# docker run -it --name web2 --rm --network container:web1 centos
[root@9c72a2664048 /]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
8: eth0@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
[root@9c72a2664048 /]#

此时我们发现web1和web2的IP地址相同

host模式配置

启动容器时直接指明模式为host

[root@zzz ~]# docker run -dit --name web2 --rm --network host centos
c69537557ae621192c9f2d795bc8a0b7c8166286b42e4a6f950ff6cfaf8cd10b
[root@zzz ~]# docker exec -it web2 /bin/bash
[root@zzz /]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:c7:a8:7b brd ff:ff:ff:ff:ff:ff
    inet 192.168.87.128/24 brd 192.168.87.255 scope global dynamic noprefixroute ens33
       valid_lft 1106sec preferred_lft 1106sec
    inet6 fe80::3f31:1b71:96a5:5c42/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:a4:d4:e9:e0 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:a4ff:fed4:e9e0/64 scope link 
       valid_lft forever preferred_lft forever
9: veth2230682@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether d2:45:60:35:a0:05 brd ff:ff:ff:ff:ff:ff link-netnsid 2
    inet6 fe80::d045:60ff:fe35:a005/64 scope link 
       valid_lft forever preferred_lft forever

容器的常规操作

查看容器主机名

[root@zzz ~]# docker run -dit --name web1 centos
5cf88be43110efae06c05712fda93405602faa7324fdd681e7b966a241929ebc
[root@zzz ~]# docker ps
CONTAINER ID   IMAGE     COMMAND       CREATED         STATUS         PORTS     NAMES
5cf88be43110   centos    "/bin/bash"   7 seconds ago   Up 6 seconds             web1
[root@zzz ~]# docker exec -it web1 /bin/bash
[root@5cf88be43110 /]# hostname
5cf88be43110

在容器启动时注入主机名

[root@zzz ~]# docker run -dit --name web --hostname web centos
a6d6cae89283cc32be3722d25ffa1159c595fbdbb7fa15fb6e6e0b9fb249c32b
[root@zzz ~]# docker ps 
CONTAINER ID   IMAGE     COMMAND       CREATED         STATUS         PORTS     NAMES
a6d6cae89283   centos    "/bin/bash"   4 seconds ago   Up 3 seconds             web
[root@zzz ~]# docker exec -it web /bin/bash
[root@web /]# hostname 
web

查看映射

[root@web /]# cat /etc/hosts
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::0	ip6-localnet
ff00::0	ip6-mcastprefix
ff02::1	ip6-allnodes
ff02::2	ip6-allrouters
172.17.0.2	web   # 注入主机名时会自动创建主机名到IP的映射关系
[root@web /]#

查看dns配置文件

[root@web /]# cat /etc/resolv.conf 
# Generated by NetworkManager
search localdomain
nameserver 192.168.87.2    # DNS也会自动配置为宿主机的DNS

访问外网

[root@web /]# ping www.baidu.com
PING www.a.shifen.com (182.61.200.7) 56(84) bytes of data.
64 bytes from localhost (182.61.200.7): icmp_seq=1 ttl=127 time=24.6 ms
64 bytes from localhost (182.61.200.7): icmp_seq=2 ttl=127 time=24.8 ms
^C
--- www.a.shifen.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1003ms
rtt min/avg/max/mdev = 24.621/24.706/24.791/0.085 ms

手动指定容器要是用的DNS

[root@zzz ~]# docker run -dit --name web --hostname web --dns 155.155.155.155 centos
f07d24b545d2da890770a3c88eed10aa93b42f5721ab9540cb4d56a2c3034b6f
[root@zzz ~]# docker ps
CONTAINER ID   IMAGE     COMMAND       CREATED         STATUS         PORTS     NAMES
f07d24b545d2   centos    "/bin/bash"   6 seconds ago   Up 4 seconds             web
[root@zzz ~]# docker exec -it web /bin/bash
[root@web /]# cat /etc/resolv.conf 
search localdomain
nameserver 155.155.155.155
[root@web /]#

手动往/etc/hosts文件中注入主机名到IP地址的映射

[root@zzz ~]# docker run -dit --name web --hostname web --add-host www.z.com:2.2.2.2 --rm centos
a19600c5467626e088fda0b7fd08240693d5dfe94d3f0769701e01b207f6fe67
[root@zzz ~]# docker ps
CONTAINER ID   IMAGE     COMMAND       CREATED         STATUS         PORTS     NAMES
a19600c54676   centos    "/bin/bash"   4 seconds ago   Up 2 seconds             web
[root@zzz ~]# docker exec -it web /bin/bash
[root@web /]# cat /etc/hosts
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::0	ip6-localnet
ff00::0	ip6-mcastprefix
ff02::1	ip6-allnodes
ff02::2	ip6-allrouters
2.2.2.2	www.z.com
172.17.0.2	web

开放容器端口

执行docker run的时候有个-p选项，可以将容器中的应用端口映射到宿主机中，从而实现让外部主机可以通过访问宿主机的某端口来访问容器内应用的目的。

-p选项能够使用多次，其所能够暴露的端口必须是容器确实在监听的端口。

-p选项的使用格式：

-p <·containerPort>
将指定的容器端口映射至主机所有地址的一个动态端口
-p <hostPort·>:<·containerPort>
将容器端口<·containerPort>映射至指定的主机端口<·hostPort>
-p <·ip>::<·containerPort>
将指定的容器端口<·containerPort>映射至主机指定<·ip>的动态端口
-p <·ip>:<·hostPort>:<·containerPort>
将指定的容器端口<·containerPort>映射至主机指定<·ip>的端口<·hostPort>

动态端口指的是随机端口，具体的映射结果可使用docker port命令查看。

[root@zzz ~]# docker run --name web1 --rm -p 80 httpd

以上命令执行后会一直占用着前端，我们新开一个终端连接来看一下容器的80端口被映射到了宿主机的什么端口上

[root@zzz ~]# docker port web1
80/tcp -> 0.0.0.0:49155
80/tcp -> :::49155

由此可见，容器的80端口被暴露到了宿主机的32769端口上，此时我们在宿主机上访问一下这个端口看是否能访问到容器内的站点

[root@zzz ~]# curl http://127.0.0.1:49155
<html><body><h1>It works!</h1></body></html>

iptables防火墙规则将随容器的创建自动生成，随容器的删除自动删除规则。

[root@zzz ~]# docker run --name web --rm -p 192.168.87.129::80 httpd
docker: Error response from daemon: driver failed programming external connectivity on endpoint web (c42913c6ec6e67291aa1cc0b06cf6f3c3c084699e09eb1abab4c01d5450d4ba3): Error starting userland proxy: listen tcp4 192.168.87.129:49172: bind: cannot assign requested address.
[root@zzz ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 19 packets, 1633 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 1 packets, 309 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      !docker0  172.17.0.0/16        0.0.0.0/0           
    0     0 MASQUERADE  tcp  --  *      *       172.17.0.2           172.17.0.2           tcp dpt:80

Chain OUTPUT (policy ACCEPT 1 packets, 309 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DOCKER     all  --  *      *       0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  docker0 *       0.0.0.0/0            0.0.0.0/0           
    0     0 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:49156 to:172.17.0.2:80

自定义docker0桥的网络属性信息

自定义docker0桥的网络属性信息需要修改/etc/docker/daemon.json配置文件

[root@zzz ~]# vim /etc/docker/daemon.json
[root@zzz ~]# cat /etc/docker/daemon.json 
{
  "registry-mirrors": ["https://bydymp6j.mirror.aliyuncs.com"],
  "bip":"192.168.66.6/24"
}
[root@zzz ~]# systemctl restart docker

[root@zzz ~]# ip a 
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:c7:a8:7b brd ff:ff:ff:ff:ff:ff
    inet 192.168.87.128/24 brd 192.168.87.255 scope global dynamic noprefixroute ens33
       valid_lft 1319sec preferred_lft 1319sec
    inet6 fe80::3f31:1b71:96a5:5c42/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:a4:d4:e9:e0 brd ff:ff:ff:ff:ff:ff
    inet 192.168.66.6/24 brd 192.168.66.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:a4ff:fed4:e9e0/64 scope link 
       valid_lft forever preferred_lft forever

核心选项为bip，即bridge ip之意，用于指定docker0桥自身的IP地址；其它选项可通过此地址计算得出

docker远程连接

dockerd守护进程的C/S，其默认仅监听Unix Socket格式的地址(/var/run/docker.sock)，如果要使用TCP套接字，则需要修改/etc/docker/daemon.json配置文件，添加如下内容，然后重启docker服务：

[root@zzz ~]# vim /lib/systemd//system/docker.service

ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock

  添加远程登录ip
[root@zzz ~]# systemctl daemon-reload 
[root@zzz ~]# systemctl restart docker

验证

[root@zzz ~]# docker run -dit --name zzz --rm centos
718f09205c67528aa9eb465395e3d8817d24fac08e0a5aa0c37735868bee5a40
[root@zzz ~]# docker ps
CONTAINER ID   IMAGE     COMMAND       CREATED         STATUS         PORTS     NAMES
718f09205c67   centos    "/bin/bash"   6 seconds ago   Up 5 seconds             zzz

[root@yyy ~]# docker -H 192.168.87.128:2375 ps
CONTAINER ID   IMAGE     COMMAND       CREATED          STATUS         PORTS     NAMES
718f09205c67   centos    "/bin/bash"   10 seconds ago   Up 9 seconds             zzz

docker创建自定义桥接网络

创建一个额外的自定义桥，区别于docker0

[root@zzz ~]# docker network create -d bridge --subnet "192.168.2.0/24" --gateway "192.168.2.1" br0
83974f83467d4dcfb8e4a51cd335629ff6168c3208ff25ba02bff49bc360438c
[root@zzz ~]# docker network ls
NETWORK ID     NAME      DRIVER    SCOPE
83974f83467d   br0       bridge    local
6931280df105   bridge    bridge    local
fd0bc1a7f6d3   host      host      local
dc22d04563c4   none      null      local
[root@zzz ~]#

使用新创建的自定义桥来创建容器：

[root@zzz ~]# docker run -dit --name web --network br0 --rm centos
584c3f51ba22df6452c82bc68c2ea0ce2c74b1eeb1aeaf9636ed613dbea7eab4
[root@zzz ~]# docker exec -it web /bin/bash
[root@584c3f51ba22 /]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
51: eth0@if52: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:c0:a8:02:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 192.168.2.2/24 brd 192.168.2.255 scope global eth0
       valid_lft forever preferred_lft forever

再创建一个容器，使用默认的bridge桥：

[root@zzz ~]# docker run -dit --name web2 --rm centos
86dad844a4113e6e49edb8edace3cba7f66d2554e8951b8cd6fdc093b82ee456
[root@zzz ~]# docker exec -it web2 /bin/bash
[root@86dad844a411 /]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
53: eth0@if54: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:c0:a8:42:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 192.168.66.2/24 brd 192.168.66.255 scope global eth0
       valid_lft forever preferred_lft forever

测试联通性

[root@86dad844a411 /]# ping 192.168.2.2
PING 192.168.2.2 (192.168.2.2) 56(84) bytes of data.
64 bytes from 192.168.2.2: icmp_seq=1 ttl=63 time=0.138 ms
64 bytes from 192.168.2.2: icmp_seq=2 ttl=63 time=0.158 ms
64 bytes from 192.168.2.2: icmp_seq=3 ttl=63 time=0.175 ms
^C
--- 192.168.2.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2082ms
rtt min/avg/max/mdev = 0.138/0.157/0.175/0.015 ms
[root@86dad844a411 /]#

在这里插入图片描述