我的目标是为每个docker容器提供可路由的公共IPv6地址.我希望能够使用IPv6协议连接进出容器.
我正在使用Linode,我已经被分配了一个公共IPv6池:
2600:3c01:e000:00e2:: / 64 routed to 2600:3c01::f03c:91ff:feae:d7d7
“路由到”地址由dhcp自动配置:
# ip -6 addr show eth0
3: eth0: mtu 1500 qlen 1000
inet6 2600:3c01::f03c:91ff:feae:d7d7/64 scope global mngtmpaddr dynamic
valid_lft 2591987sec preferred_lft 604787sec
inet6 fe80::f03c:91ff:feae:d7d7/64 scope link
valid_lft forever preferred_lft forever
我为ipv6.daaku.org设置了AAAA记录,以便更轻松地使用:
# nslookup -q=AAAA ipv6.daaku.org
ipv6.daaku.org has AAAA address 2600:3c01:e000:e2::1
为了测试,我手动分配了该地址:
# ip -6 addr add 2600:3c01:e000:00e2::1/64 dev eth0
# ip -6 addr show eth0
3: eth0: mtu 1500 qlen 1000
inet6 2600:3c01:e000:e2::1/64 scope global
valid_lft forever preferred_lft forever
inet6 2600:3c01::f03c:91ff:feae:d7d7/64 scope global mngtmpaddr dynamic
valid_lft 2591984sec preferred_lft 604784sec
inet6 fe80::f03c:91ff:feae:d7d7/64 scope link
valid_lft forever preferred_lft forever
我现在可以从支持IPv6的家庭网络ping这个:
# ping6 -c3 ipv6.daaku.org
PING6(56=40+8+8 bytes) 2601:9:400:12ab:1db7:a353:a7b4:c192 --> 2600:3c01:e000:e2::1
16 bytes from 2600:3c01:e000:e2::1, icmp_seq=0 hlim=54 time=16.855 ms
16 bytes from 2600:3c01:e000:e2::1, icmp_seq=1 hlim=54 time=19.506 ms
16 bytes from 2600:3c01:e000:e2::1, icmp_seq=2 hlim=54 time=17.467 ms
--- ipv6.daaku.org ping6 statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 16.855/17.943/19.506/1.133 ms
我删除了地址,因为我只想在容器中,并返回到原始状态:
# ip -6 addr del 2600:3c01:e000:00e2::1/64 dev eth0
# ip -6 addr show eth0
3: eth0: mtu 1500 qlen 1000
inet6 2600:3c01::f03c:91ff:feae:d7d7/64 scope global mngtmpaddr dynamic
valid_lft 2591987sec preferred_lft 604787sec
inet6 fe80::f03c:91ff:feae:d7d7/64 scope link
valid_lft forever preferred_lft forever
我在另一个终端中启动了一个没有网络的docker容器:
# docker run -it --rm --net=none debian bash
root@b96ea38f03b3:/#
为了易于使用,将它的pid放在变量中:
CONTAINER_PID=$(docker inspect -f '{{.State.Pid}}' b96ea38f03b3)
设置该pid的净额:
# mkdir -p /run/netns
# ln -s /proc/$CONTAINER_PID/ns/net /run/netns/$CONTAINER_PID
创建了一个新设备,为其分配了IP:
# ip link add container0 link eth0 type macvlan
# ip link set container0 netns $CONTAINER_PID
# ip netns exec $CONTAINER_PID ip link set dev container0 name eth0
# ip netns exec $CONTAINER_PID ip link set eth0 up
# ip netns exec $CONTAINER_PID ip addr add 2600:3c01:e000:00e2::1/64 dev eth0
回到我启动容器的另一个终端:
# ip -6 addr show eth0
22: eth0@gre0: mtu 1500
inet6 2600:3c01::a083:1eff:fea5:5ad2/64 scope global dynamic
valid_lft 2591979sec preferred_lft 604779sec
inet6 2600:3c01:e000:e2::1/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::a083:1eff:fea5:5ad2/64 scope link
valid_lft forever preferred_lft forever
# ip -6 route
2600:3c01::/64 dev eth0 proto kernel metric 256 expires 2591976sec
2600:3c01:e000:e2::/64 dev eth0 proto kernel metric 256
fe80::/64 dev eth0 proto kernel metric 256
default via fe80::1 dev eth0 proto ra metric 1024 expires 67sec
这不起作用,我无法从容器连接(使用ping6 ipv6.google.com作为我的测试)也不能从我的家庭网络通过互联网ping容器(使用ping6 ipv6.daaku.org as我的测试).
更新:我通过这样做设法让传出的IPv6工作:
ip -6 addr add 2600:3c01:e000:00e2::1111:1/112 dev docker0 &&
ip6tables -P FORWARD ACCEPT &&
sysctl -w net.ipv6.conf.all.forwarding=1 &&
sysctl -w net.ipv6.conf.all.proxy_ndp=1
CONTAINER_PID=$(docker inspect -f '{{.State.Pid}}' 4fd3b05a04bb)
mkdir -p /run/netns &&
ln -s /proc/$CONTAINER_PID/ns/net /run/netns/$CONTAINER_PID &&
ip netns exec $CONTAINER_PID ip -6 addr add 2600:3c01:e000:00e2::1111:20/112 dev eth0 &&
ip netns exec $CONTAINER_PID ip -6 route add default via 2600:3c01:e000:00e2::1111:1 dev eth0
主机上的IPv6路由:
# ip -6 r
2600:3c01::/64 dev eth0 proto kernel metric 256 expires 2582567sec
2600:3c01:e000:e2::1111:0/112 dev docker0 proto kernel metric 256
2600:3c01:e000:e2::/64 dev eth0 proto kernel metric 256
fe80::/64 dev eth0 proto kernel metric 256
fe80::/64 dev docker0 proto kernel metric 256
fe80::/64 dev veth1775864 proto kernel metric 256
fe80::/64 dev veth102096c proto kernel metric 256
fe80::/64 dev vethdf3a55b proto kernel metric 256
容器中的IPv6路由:
# ip -6 r
2600:3c01:e000:e2::1111:0/112 dev eth0 proto kernel metric 256
fe80::/64 dev eth0 proto kernel metric 256
default via 2600:3c01:e000:e2::1111:1 dev eth0 metric 1024
仍然无法从我的家用机器ping它.