Docker的网络机制
Docker的网络有三种类型(driver): bridge, host 和 null.
- birdge: 就如同桥接的switch/hub, 使用bridge网络的container会分配一个当前bridge配置的子网IP, 在通过run创建container时通过 --ip 指定.
- host: 需要使用 --network=host 参数指定. 使用主机网络, 此时 container 的网络会附属在主机上, 两者是互通的. 例如在container中的服务监听8080端口, 则主机的8080端口就会自动映射到这个端口.
- none: 需要使用 --network=none 参数指定. 不分配局域网的IP
可以通过命令 docker network ls 和 docker network inspect [name] 查看
$ docker network ls
NETWORK ID NAME DRIVER SCOPE
771ed6aaa9f8 bridge bridge local
243e4b881761 host host local
1c2c6b04e22c none null local $ docker network inspect bridge
[
{
"Name": "bridge",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},
...
}
]
在宿主机上, 通过ifconfig能看到bridge的网关IP, 而container IP是不能直接看到的.
创建自定义Network
启动Docker容器的时候，使用默认的网络是不支持指派固定IP的
docker run -itd --net bridge --ip 172.17.0.10 centos:latest /bin/bash
6eb1f228cf308d1c60db30093c126acbfd0cb21d76cb448c678bab0f1a7c0df6
docker: Error response from daemon: User specified IP address is supported on user defined networks only.
需要使用自定义的network, 创建完后, 在宿主机上能看到新的bridge 的网关IP
$ docker network create --subnet=192.168.250.1/24 mybridge
760fb4aec8aef1eacece34d3a28aee1eabde7c47ce8ef9ec646c7c320a4da195 $ docker network ls
NETWORK ID NAME DRIVER SCOPE
771ed6aaa9f8 bridge bridge local
243e4b881761 host host local
760fb4aec8ae mybridge bridge local
1c2c6b04e22c none null local
使用固定IP创建Container
$ docker run --name eureka -itd --net mybridge --ip 192.168.250.3 scot-eureka:latest /bin/bash
ba7f9fcb4178c5181d3ea85eca5d03a132b8f32727c1ca0ee13bfd1ec15e4cc8 $ ping 192.168.250.3
PING 192.168.250.3 (192.168.250.3) 56(84) bytes of data.
64 bytes from 192.168.250.3: icmp_seq=1 ttl=64 time=0.102 ms
64 bytes from 192.168.250.3: icmp_seq=2 ttl=64 time=0.102 ms
使用固定IP启动官方4.0.11版本的redis (启动latest=5.0.0版本的redis, 无法链接6379端口, 尚未检查具体原因, 4.0.11是没问题的)
$ docker run -d --name redis2 --net mybridge --ip 192.168.250.2 redis:4.0.
Docker的 Macvlan 网络
创建macvlan网络, 可以使docker的虚拟网卡直接绑定宿主机的物理网卡, 直接与宿主机所在网络进行通讯. 此时, 除了宿主机和docker容器之间无法通信以外, docker容器与容器之间, 容器与宿主机网段其他机器之间都可以互访.
参考的说明 https://docs.docker.com/v17.09/engine/userguide/networking/get-started-macvlan/ 其中特别提到的, 这是因为安全隔离所造成的, 如果需要宿主机和容器之间通信, 需要增加子网卡.
Communication with the Docker host over macvlan
When using macvlan, you cannot ping or communicate with the default namespace IP address. For example, if you create a container and try to ping the Docker host’s eth0, it will not work. That traffic is explicitly filtered by the kernel modules themselves to offer additional provider isolation and security.
A macvlan subinterface can be added to the Docker host, to allow traffic between the Docker host and containers. The IP address needs to be set on this subinterface and removed from the parent address.
创建macvlan的命令
|
1
2
3
4
5
6
7
8
|
# 断开连接$ docker network disconnect bridge-local redis
# 删除网络$ docker network rm bridge-local
# 创建网络$ docker network create -d macvlan --subnet=192.168.252.0/24 --gateway=192.168.252.1 --aux-address="parent_host=192.168.252.151" -o parent=enp2s0f0 bridge-local
# 将运行中的docker连接至bridge-local$ docker network connect bridge-local redis --ip 192.168.252.10
|
参考 http://networkstatic.net/configuring-macvlan-ipvlan-linux-networking/
以及如何在Ubuntu18.04下配置subinterface https://askubuntu.com/questions/971126/17-10-netplan-config-with-bridge