docker基础(19):Docker网络之自定义网络

帮助命令

docker network --help

查看所有的网络

docker network ls

网络模式

网络模式	配置	说明
bridge模式	–net=bridge	默认值，在Docker网桥docker0上为容器创建新的网络栈
none模式	–net=none	不配置网络，用户可以稍后进入容器，自行配置
container模式	– net=container:name/id	容器和另外一个容器共享Network namespace。kubernetes中的pod就是多个容器共享一个Network namespace。
host模式	–net=host	容器和宿主机共享Network namespace
用户自定义	–net=自定义网络	用户自己使用network相关命令定义网络，创建容器的时候可以指定为自己定义的网络

查看一个网络的相信信息

[root@ls-bPtysZTW ~]# docker network inspect 1944197a1821
[
    {
        "Name": "bridge",
        "Id": "1944197a18211b7cbd5f07b9c25f696c6fc74dfe19324b1a51db33335627c8f3",
        "Created": "2022-03-18T18:34:10.650916029+08:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "99610ffcbeb1124ac54bbb2cad77043828793028ffb75612ddbde10ce0d8ed77": {
                "Name": "tomcat02",
                "EndpointID": "da9819333b969861729adee15dae290021fddeeab91b0d878e64d4cee7efe43a",
                "MacAddress": "02:42:ac:11:00:03",
                "IPv4Address": "172.17.0.3/16",
                "IPv6Address": ""
            },
            "b4b7bcb5cf4d2c6b984400b21e2009a7936be6dec0c8db0e62f5a470c926b013": {
                "Name": "tomcat01",
                "EndpointID": "8103ffad548da7aa51eb888bae4f6b808447d49fdcb42c8b19655bddaa4b3958",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            },
            "ee86fd75423ae1d9631dfba52ea7df05904e358a35319c103e990a61e5c7904a": {
                "Name": "tomcat03",
                "EndpointID": "0f25ea01f8ec30eaa002c4e2c2346a3e249875797cf051f5c9d6de9135607d34",
                "MacAddress": "02:42:ac:11:00:04",
                "IPv4Address": "172.17.0.4/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]
[root@ls-bPtysZTW ~]# 

docker0子网段172.17.0.0/16,表示容器划分是0到16位，也就是意味着docker容器可以划分出65535个ip,其中172.17.0.1是网关，那么docker可以划分65534个ip提供给容器使用。

---

自定义网卡

1. 删除所有的容器,查看网卡恢复到最开始。

docker rm -f $(docker ps -aq)

2. 接下来我们创建容器，但是我们知道默认创建的容器都是docker0的网卡。

#我们不配置网络，也叫相当于默认值，--net bridge 使用的docker0
docker run -d -P --name tomcat01 --net bridge tomcat #默认

docker0网络特点

• 他是默认的
• 域名访问不通
• –link 域名通了，但是删除了又不行

3. 我们可以让容器创建的时候使用自定义网络

#自定义创建的默认default bridge
#自定义创建一个网络
docker network create --driver bridge --subnet 192.168.0.0/16 --gateway 192.168.0.1 mynet

查看到我们刚刚创建的网络 docker network ls

我们来启动两个容器测试，使用自己的mynet
[root@ls-bPtysZTW ~]# docker run -d -P --name tomcat-net-01 --net mynet lengcz/tomcat:1.0
855dc33189221c61fbe6bc35ce2b080ff71f34547ce6cf77a5c98e3afcd9daaa
[root@ls-bPtysZTW ~]# docker run -d -P --name tomcat-net-02 --net mynet lengcz/tomcat:1.0
a8dff5c6a82649356385253c96f5ff07771644b8dca85f9a814d1b17041290df
[root@ls-bPtysZTW ~]# docker ps
CONTAINER ID   IMAGE               COMMAND                  CREATED          STATUS          PORTS                                         NAMES
a8dff5c6a826   lengcz/tomcat:1.0   "/bin/sh -c '/usr/lo…"   20 seconds ago   Up 19 seconds   0.0.0.0:49158->8080/tcp, :::49158->8080/tcp   tomcat-net-02
855dc3318922   lengcz/tomcat:1.0   "/bin/sh -c '/usr/lo…"   37 seconds ago   Up 36 seconds   0.0.0.0:49157->8080/tcp, :::49157->8080/tcp   tomcat-net-01
[root@ls-bPtysZTW ~]# 

# 再次查看一下我们定义的网络,会发现containers列表里包含了两个容器的网络信息。
[root@ls-bPtysZTW ~]# docker network inspect mynet
[
    {
        "Name": "mynet",
        "Id": "c81f4fcc9c8b2b916d0dce6400495dd69375032c358e2a24061e8c0dd48ffb89",
        "Created": "2022-03-21T09:54:51.169378153+08:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "192.168.0.0/16",
                    "Gateway": "192.168.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "855dc33189221c61fbe6bc35ce2b080ff71f34547ce6cf77a5c98e3afcd9daaa": {
                "Name": "tomcat-net-01",
                "EndpointID": "3f5751193ffa31fa723c2a999575186e343da653e39d654c9b62a3fdf72ef8bd",
                "MacAddress": "02:42:c0:a8:00:02",
                "IPv4Address": "192.168.0.2/16",
                "IPv6Address": ""
            },
            "a8dff5c6a82649356385253c96f5ff07771644b8dca85f9a814d1b17041290df": {
                "Name": "tomcat-net-02",
                "EndpointID": "68859294c6ce5f5179390e29718982bbfd2848b6e260d0486cd33967239e4990",
                "MacAddress": "02:42:c0:a8:00:03",
                "IPv4Address": "192.168.0.3/16",
                "IPv6Address": ""
            }
        },
        "Options": {},
        "Labels": {}
    }
]

# 测试一下ping容器名和ip,都可以ping通
[root@ls-bPtysZTW ~]# docker exec -it tomcat-net-01 ping 192.168.0.3 -c4
PING 192.168.0.3 (192.168.0.3) 56(84) bytes of data.
64 bytes from 192.168.0.3: icmp_seq=1 ttl=64 time=0.099 ms
64 bytes from 192.168.0.3: icmp_seq=2 ttl=64 time=0.131 ms
[root@ls-bPtysZTW ~]# docker exec -it tomcat-net-01 ping tomcat-net-02 -c4
PING tomcat-net-02 (192.168.0.3) 56(84) bytes of data.
64 bytes from tomcat-net-02.mynet (192.168.0.3): icmp_seq=1 ttl=64 time=0.067 ms
64 bytes from tomcat-net-02.mynet (192.168.0.3): icmp_seq=2 ttl=64 time=0.105 ms
rtt min/avg/max/mdev = 0.067/0.090/0.105/0.014 ms

结论：我们自定义的网络docker已经帮我们维护好了对应的关系。所以我们平时都可以使用这样的网络，不使用–link效果一样，所有东西实时维护好，直接域名ping通。
到这里，我们基本可以理解docker网络了。

---

网络连通

docker0和自定义网络肯定不通，我们是使用自定义网络的好处就是网络隔离：
大家公司项目部署的业务都非常多，假设我们有一个商城，我们会有订单业务（操作不同数据），会有 订单业务购物车业务（操作不同缓存）。如果在一个网络下，有的程序猿的恶意代码就不能防止了，所 以我们就在部署的时候网络隔离，创建两个桥接网卡，比如订单业务（里面的数据库，redis，mq，全 部业务 都在order-net网络下）其他业务在其他网络。
那么关键问题来了，如何让tomcat-net-01访问tomcat01?

#启动默认的容器，在docker0网络下
[root@ls-bPtysZTW ~]# docker run -d -P --name tomcat01 lengcz/tomcat:1.0
a8f874ddc701eff4adf3921b65f91f1fd080bdf5c3ce429c59808249b72ca020
[root@ls-bPtysZTW ~]# docker run -d -P --name tomcat02 lengcz/tomcat:1.0
184e19b40cd39662e7d6d0ccf1cf440d7a455f22505a57d64636b23ea29e6945
#查看当前的容器
[root@ls-bPtysZTW ~]# docker ps
CONTAINER ID   IMAGE               COMMAND                  CREATED          STATUS          PORTS                                         NAMES
184e19b40cd3   lengcz/tomcat:1.0   "/bin/sh -c '/usr/lo…"   8 seconds ago    Up 7 seconds    0.0.0.0:49160->8080/tcp, :::49160->8080/tcp   tomcat02
a8f874ddc701   lengcz/tomcat:1.0   "/bin/sh -c '/usr/lo…"   20 seconds ago   Up 19 seconds   0.0.0.0:49159->8080/tcp, :::49159->8080/tcp   tomcat01
a8dff5c6a826   lengcz/tomcat:1.0   "/bin/sh -c '/usr/lo…"   3 hours ago      Up 3 hours      0.0.0.0:49158->8080/tcp, :::49158->8080/tcp   tomcat-net-02
855dc3318922   lengcz/tomcat:1.0   "/bin/sh -c '/usr/lo…"   3 hours ago      Up 3 hours      0.0.0.0:49157->8080/tcp, :::49157->8080/tcp   tomcat-net-01
#查看network帮助
[root@ls-bPtysZTW ~]# docker network --help
Usage:  docker network COMMAND
Manage networks
Commands:
  connect     Connect a container to a network # 连接一个容器到一个网络
  create      Create a network
  disconnect  Disconnect a container from a network
  inspect     Display detailed information on one or more networks
  ls          List networks
  prune       Remove all unused networks
  rm          Remove one or more networks

#测试一下！打通一下mynet-docker0
#命令docker network connect [OPTIONS] NETWORK CONTAINER
[root@ls-bPtysZTW ~]# docker network connect mynet tomcat01
[root@ls-bPtysZTW ~]# docker network inspect mynet
[
    {
        .....
        "Containers": {
            "855dc33189221c61fbe6bc35ce2b080ff71f34547ce6cf77a5c98e3afcd9daaa": {
                "Name": "tomcat-net-01",
                "EndpointID": "3f5751193ffa31fa723c2a999575186e343da653e39d654c9b62a3fdf72ef8bd",
                "MacAddress": "02:42:c0:a8:00:02",
                "IPv4Address": "192.168.0.2/16",
                "IPv6Address": ""
            },
            "a8dff5c6a82649356385253c96f5ff07771644b8dca85f9a814d1b17041290df": {
                "Name": "tomcat-net-02",
                "EndpointID": "68859294c6ce5f5179390e29718982bbfd2848b6e260d0486cd33967239e4990",
                "MacAddress": "02:42:c0:a8:00:03",
                "IPv4Address": "192.168.0.3/16",
                "IPv6Address": ""
            },
            "a8f874ddc701eff4adf3921b65f91f1fd080bdf5c3ce429c59808249b72ca020": {
                "Name": "tomcat01",  #发现tomcat01加入了该网络，tomcat01拥有双ip
                "EndpointID": "39e946d3c4b510712ab3b6dd2c921b0941e2341b914cf5e645e56e82ea725e71",
                "MacAddress": "02:42:c0:a8:00:04",
                "IPv4Address": "192.168.0.4/16",
                "IPv6Address": ""
            }
        },
        "Options": {},
        "Labels": {}
    }
]


#tomcat01可以ping通了
[root@ls-bPtysZTW ~]# docker exec -it tomcat01 ping tomcat-net-01 -c2
PING tomcat-net-01 (192.168.0.2) 56(84) bytes of data.
64 bytes from tomcat-net-01.mynet (192.168.0.2): icmp_seq=1 ttl=64 time=0.074 ms
64 bytes from tomcat-net-01.mynet (192.168.0.2): icmp_seq=2 ttl=64 time=0.085 ms
#tomcat02依旧ping不通
[root@ls-bPtysZTW ~]# docker exec -it tomcat02 ping tomcat-net-01 -c2
ping: tomcat-net-01: Name or service not known

结论:如果要跨网络访问，就需要使用

docker network connect [OPTIONS] NETWORK CONTAINER  进行连接，否则就无法互相访问