Route实现容器跨主机通信

Route实现容器跨主机通信

1 试验环境

试验环境如下所示：

Node1节点：

宿主机ip 192.168.248.172 容器网段10.10.0.1/16  a起的容器ip是10.10.0.2

Node2节点

宿主机ip 192.168.248.173 容器网段10.20.0.1/16  b起的容器ip是10.20.0.2

2 修改docker的配置文件

修改docker的配置文件docker.service

Node1节点修改内容如下

[root@localhost ~]# cat /usr/lib/systemd/system/docker.service

[Unit]

Description=Docker Application Container Engine

Documentation=https://docs.docker.com

BindsTo=containerd.service

After=network-online.target firewalld.service containerd.service

Wants=network-online.target

Requires=docker.socket

 

[Service]

Type=notify

# the default is not to use systemd for cgroups because the delegate issues still

# exists and systemd currently does not support the cgroup feature set required

# for containers run by docker

ExecStart=/usr/bin/dockerd -H fd:// --bip=10.10.0.1/16

ExecReload=/bin/kill -s HUP $MAINPID

TimeoutSec=0

RestartSec=2

Restart=always

 

# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.

# Both the old, and new location are accepted by systemd 229 and up, so using the old location

# to make them work for either version of systemd.

StartLimitBurst=3

 

# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.

# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make

# this option work for either version of systemd.

StartLimitInterval=60s

 

# Having non-zero Limit*s causes performance problems due to accounting overhead

# in the kernel. We recommend using cgroups to do container-local accounting.

LimitNOFILE=infinity

LimitNPROC=infinity

LimitCORE=infinity

 

# Comment TasksMax if your systemd version does not supports it.

# Only systemd 226 and above support this option.

TasksMax=infinity

 

# set delegate yes so that systemd does not reset the cgroups of docker containers

Delegate=yes

 

# kill only the docker process, not all processes in the cgroup

KillMode=process

 

[Install]

WantedBy=multi-user.target

Node2节点：

[root@localhost ~]# cat /usr/lib/systemd/system/docker.service

[Unit]

Description=Docker Application Container Engine

Documentation=https://docs.docker.com

BindsTo=containerd.service

After=network-online.target firewalld.service containerd.service

Wants=network-online.target

Requires=docker.socket

 

[Service]

Type=notify

# the default is not to use systemd for cgroups because the delegate issues still

# exists and systemd currently does not support the cgroup feature set required

# for containers run by docker

ExecStart=/usr/bin/dockerd -H fd:// --bip=10.20.0.1/16

ExecReload=/bin/kill -s HUP $MAINPID

TimeoutSec=0

RestartSec=2

Restart=always

 

# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.

# Both the old, and new location are accepted by systemd 229 and up, so using the old location

# to make them work for either version of systemd.

StartLimitBurst=3

 

# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.

# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make

# this option work for either version of systemd.

StartLimitInterval=60s

 

# Having non-zero Limit*s causes performance problems due to accounting overhead

# in the kernel. We recommend using cgroups to do container-local accounting.

LimitNOFILE=infinity

LimitNPROC=infinity

LimitCORE=infinity

 

# Comment TasksMax if your systemd version does not supports it.

# Only systemd 226 and above support this option.

TasksMax=infinity

 

# set delegate yes so that systemd does not reset the cgroups of docker containers

Delegate=yes

 

# kill only the docker process, not all processes in the cgroup

KillMode=process

 

[Install]

WantedBy=multi-user.target

3 配置路由信息

Node1节点：

route add –net 10.20.0.0 netmask 255.255.0.0 gw 192.168.248.173

Node2节点

route add –net 10.10.0.0 netmask 255.255.0.0 gw 192.168.248.172

4 修改网卡路由转发信息

Node1和Node2节点进行如下配置

[root@localhost ~]# cat /proc/sys/net/ipv4/ip_forward

1

[root@localhost ~]# cat /etc/sysconfig/network

# Created by anaconda

#

#

FORWARD_IPV4="YES"

如果对于iptables不熟的情况下，可以关闭iptables

5 进行网络互通验证