#####Docker原生网络#####
1.docker 安装后会自动生成3种网络:bridge 、host 、none
[root@server4 docker]# docker network ls
NETWORK ID NAME DRIVER SCOPE
91c7c4709d58 bridge bridge local
de8ea88b39f4 host host local
1aa09618140e none null local
bridge类型:
安装docker自动生成的bridge类型docker0,新建的容器会自动桥接到这个接口
[root@server4 docker]# ip addr show ##默认生成的docker0,默认使用bridge类ing
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN
link/ether 02:42:3d:1d:de:8b brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0 ##默认网段172.17.0.1/16
valid_lft forever preferred_lft forever
之后新建的容器就会以单调递增的方式分配ip
[root@server4 ~]# docker run -d nginx ##运行nginx容器
6c12b1d008cae73622ff7438d49cb3b6bf2b5a36ab11a627712fd0595797e064
[root@server4 ~]# docker ps ##查看docker容器进程
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
6c12b1d008ca nginx "nginx -g 'daemon of…" 51 seconds ago Up 46 seconds 80/tcp awesome_pike
[root@server4 ~]# docker inspect 6c12b1d008ca ##通过容器名或容器id进行操作
"Gateway": "172.17.0.1", ##网关
"IPAddress": "172.17.0.2", ##ip地址,
"IPPrefixLen": 16,
"IPv6Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"MacAddress": "02:42:ac:11:00:02",
"DriverOpts": null
[root@server4 ~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.02423d1dde8b no veth43b78a0 ##已自动桥接到docker0上
[root@server4 ~]# docker run -it --name vm2 ubuntu #再运行一个vm2容器,
root@95b6fb0e0dda:/# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
6: eth0@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0 #分配的ip地址172.17.0.3/16
valid_lft forever preferred_lft forever
- 桥接模式下容器没有一个公有ip,只有宿主机可以直接访问(外部主机不可见)
- 容器可以通过宿主机的NAT规则后访问外网(net.ipv4.ip_forward=1)
在创建容器时操作系统会自动生成虚拟网络对(一端连接到nginx的网络栈(eth0),另一端连接到docker0;如此就可以实现nginx与docker0互通),docker0再通过ip转发到真实物理网卡上与外部主机连接
host类型:host网络模式在容器创建时需指定–network=host
host模式可以让容器共享宿主机网络栈.(外部主机与容器可以直接通信,但容器的网络缺少隔离性,宿主机和容器的网络资源不能冲突)
[root@server4 ~]# docker run -it --name vm1 --network host ubuntu ##运行一个host网络模式的容器
root@server4:/# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 52:54:00:3b:25:e2 brd ff:ff:ff:ff:ff:ff
inet 172.25.46.4/24 brd 172.25.46.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fe3b:25e2/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:3d:1d:de:8b brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0 ##在当前容器内的ip与宿主机的一致
valid_lft forever preferred_lft forever
inet6 fe80::42:3dff:fe1d:de8b/64 scope link
valid_lft forever preferred_lft forever
root@server4:/# exit crtl + d ##退出并停止运行容器
[root@server4 ~]# docker ps ##docker 没有容器运行的进程
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
[root@server4 ~]# ip addr ##查看宿主机的ip
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN
link/ether 02:42:3d:1d:de:8b brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:3dff:fe1d:de8b/64 scope link
valid_lft forever preferred_lft forever
[root@server4 ~]# docker start vm1 #打开容器
vm1
[root@server4 ~]# docker container attach vm1 #连接容器vm1
root@server4:/# ip addr3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:3d:1d:de:8b brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:3dff:fe1d:de8b/64 scope link
valid_lft forever preferred_lft foreve
none模式:禁用网络功能(没有ip地址和网络接口),只有lo接口,在创建容器时 --network=none指定
作用:不需要外网连接,可存放的数据较敏感
[root@server4 ~]# docker run -it --name vm2 --network none ubuntu
root@fe51f4141f76:/# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo #只有lo 回环接口
valid_lft forever preferred_lft forever
####Docker自定义网络###
自定义网络模式,docker提供了三种自定义网络驱动:
- bridge #bridge驱动类似于默认的bridge网络模式,但新增加了一些功能(DNS解析容器名称到ip地址)
- overlay
- macvlan
overlay 和macvlan用于创建跨主机网络,bridge针对单机网络 - 建议使用自定义网络来控制哪些容器可以互相通信,
1.自定义网络的bridge
[root@server4 ~]# docker network create -d bridge my_net1 ##创建自定义网络bridge
2bb11ae5b66c93c32ef6e68ae2690f23b052f436ea91517f41b9c8227e65ead4
[root@server4 ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
91c7c4709d58 bridge bridge local
de8ea88b39f4 host host local
2bb11ae5b66c my_net1 bridge local #自定义的bridge网络模式
1aa09618140e none null local
[root@server4 ~]# docker run -it --name vm1 --network my_net1 ubuntu #用自定义的bridge运行一个容纳vm1
root@c7822672ee80:/# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
9: eth0@if10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:ac:12:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0 #分配的ip 172.18.0.2/16
valid_lft forever preferred_lft forever
root@c7822672ee80:/# [root@server4 ~]# #ctrl +pq 退出但保持容器运行
[root@server4 ~]# docker ps -a #查看进程
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c7822672ee80 ubuntu