docker之网络管理

定位
容器的网络管理是为了实现容器和容器之间，或者容器与外部主机之间的网络通信

实现方式
1，通过端口映射
这种方式通过将容器内的端口映射到宿主机的端口，从而通过宿主机的ip地址和映射出来的端口实现对容器服务的访问

**随机端口映射(以nginx容器为例**) 
通过-P指定，将容器的80端口映射到宿主机的一个随机端口
[root@localhost ~]# docker run -d -P --name nginx-1 nginx

WARNING: IPv4 forwarding is disabled. Networking will not work.
4a00138f70b8da9c8febac75ae432221c104dc2e5dd4fa23a8fe2fa8d6c33c41
[root@localhost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
4a00138f70b8 nginx “/docker-entrypoint.…” 4 seconds ago Up 2 seconds 0.0.0.0:49154->80/tcp, :::49154->80/tcp nginx-1

**指定端口映射**
	使用 -p（小写） 指定宿主机的ip:port 映射到容器服务的端口
	[root@localhost ~]# docker run -d -p 10.10.10.12:999:80 --name nginx-2 nginx

95114e824268b0d01c98b8e32a9ea76518be232131bdfb44462e1869cd25568f
[root@localhost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
95114e824268 nginx “/docker-entrypoint.…” 7 seconds ago Up 6 seconds 10.10.10.12:999->80/tcp nginx-2

2，网络模型

模型名称 特点 备注

bridge 默认模式，网络地址转换 网络效率低

host 使用宿主机的IP地址和端口 效率高

container 容器和容器共享网络 局域网

none 无任何网络 最干净，最复杂

overlay 容器间跨网段通信 第三方工具

示例：

创建一个bridge模型的网络

[root@localhost ~]# docker network create --driver bridge bridge-test
24f2b640cf495cba0ef3c8de7154c5bde5f527c63cacb2867a8f4af20e387ccf

[root@localhost ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
f8fdf62ddaf7 bridge bridge local
24f2b640cf49 bridge-test bridge local
a04b125c34b7 host host local
08c23d442d76 none null local

[root@localhost ~]# docker network inspect bridge-test （inspect参数用于查看具体的网络信息）
[
{
“Name”: “bridge-test”,
“Id”: “24f2b640cf495cba0ef3c8de7154c5bde5f527c63cacb2867a8f4af20e387ccf”,
“Created”: “2021-09-17T21:10:19.409579796+08:00”,
“Scope”: “local”,
“Driver”: “bridge”,
“EnableIPv6”: false,
“IPAM”: {
“Driver”: “default”,
“Options”: {},
“Config”: [
{
“Subnet”: “172.18.0.0/16”,
“Gateway”: “172.18.0.1”
}
]
},
“Internal”: false,
“Attachable”: false,
“Ingress”: false,
“ConfigFrom”: {
“Network”: “”
},
“ConfigOnly”: false,
“Containers”: {},
“Options”: {},
“Labels”: {}
}
]

使用bridge-test这个网络模型创建一个容器

docker run -itd --net=bridge-test --name=nginx-bridge nginx

[root@localhost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
6a76b822c4ba nginx “/docker-entrypoint.…” 3 seconds ago Up 2 seconds 80/tcp nginx-bridge

[root@localhost ~]# docker inspect 6a76b822c4ba (查看容器的信息，截取网络信息部分)
“NetworkID”: “24f2b640cf495cba0ef3c8de7154c5bde5f527c63cacb2867a8f4af20e387ccf”,
“EndpointID”: “7fc544275f75b139bd923f7799c0624eaa4eae16c6c446c7d3d341cdca3b502e”,
“Gateway”: “172.18.0.1”,
“IPAddress”: “172.18.0.2”,
“IPPrefixLen”: 16,
“IPv6Gateway”: “”,
“GlobalIPv6Address”: “”,
“GlobalIPv6PrefixLen”: 0,
“MacAddress”: “02:42:ac:12:00:02”,
“DriverOpts”: null

host模型 (此处不再演示创建host网络模型)

[root@localhost ~]# docker run -itd --net=host --name=nginx-host nginx
8189d33a7976ebcfac344c57e30d040545f8154b81da7fbef7d91af40d0a3701

[root@localhost ~]# docker network inspect host
[
{
“Name”: “host”,
“Id”: “a04b125c34b75e6ae3c1d24c1444430006d57e31ce1872b48736e800da3b8627”,
“Created”: “2021-09-16T22:45:52.335895818+08:00”,
“Scope”: “local”,
“Driver”: “host”,
“EnableIPv6”: false,
“IPAM”: {
“Driver”: “default”,
“Options”: null,
“Config”: []
},
“Internal”: false,
“Attachable”: false,
“Ingress”: false,
“ConfigFrom”: {
“Network”: “”
},
“ConfigOnly”: false,
“Containers”: {
“8189d33a7976ebcfac344c57e30d040545f8154b81da7fbef7d91af40d0a3701”: {
“Name”: “nginx-host”,
“EndpointID”: “478e7d1ed985309a3f90f8817ef64f317827c6b97740b74fd3ae5b399e75a0f2”,
“MacAddress”: “”,
“IPv4Address”: “”,
“IPv6Address”: “”
}
},
“Options”: {},
“Labels”: {}
}
]

(可以看到这个容器并没有网络信息，因为host模型容器是直接使用宿主机的ip和端口的，所以使用host模型的时候要注意，宿主机的响应端口是否被占用)

[root@localhost ~]# netstat -ntulp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 23776/nginx: master
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1032/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1189/master
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 16737/redis-server
tcp6 0 0 :::80 ::😗 LISTEN 23776/nginx: master
tcp6 0 0 :::22 ::😗 LISTEN 1032/sshd
tcp6 0 0 ::1:25 ::😗 LISTEN 1189/master

（可以看到此时宿主机的80端口被容器应用占用了）

断开网络

命令：docker network disconnect 网络名 容器名称

[root@localhost ~]# docker network disconnect bridge-test nginx-bridge

[root@localhost ~]# docker network inspect bridge-test
通过命令查看这个bridge-test网络中已经没有nginx-bridge这个容器了

注意：host模型不支持断开和连接网络

连接网络

命令：docker network connect 网络名 容器名称
[root@localhost ~]# docker network connect bridge-test nginx-bridge

[root@localhost ~]# docker network inspect bridge-test （可以看见容器重新加入到这个网络当中）
[
{
“Name”: “bridge-test”,
“Id”: “24f2b640cf495cba0ef3c8de7154c5bde5f527c63cacb2867a8f4af20e387ccf”,
“Created”: “2021-09-17T21:10:19.409579796+08:00”,
“Scope”: “local”,
“Driver”: “bridge”,
“EnableIPv6”: false,
“IPAM”: {
“Driver”: “default”,
“Options”: {},
“Config”: [
{
“Subnet”: “172.18.0.0/16”,
“Gateway”: “172.18.0.1”
}
]
},
“Internal”: false,
“Attachable”: false,
“Ingress”: false,
“ConfigFrom”: {
“Network”: “”
},
“ConfigOnly”: false,
“Containers”: {
“35a76b0dc44d8c3148aba855deef15bcffc43f3c285c076a0f449c0fbc4c5777”: {
“Name”: “nginx-bridge”,
“EndpointID”: “ef0b3785cb7f95b9ad4efaae1fdd0b2af597bdd29e0c54aeeab91c4ff7b2aac7”,
“MacAddress”: “02:42:ac:12:00:02”,
“IPv4Address”: “172.18.0.2/16”,
“IPv6Address”: “”
}
},
“Options”: {},
“Labels”: {}
}
]

未完待续…