docker网络原理

int32位 posted @ Mar 22, 2016 03:35:21 PM in docker , 3819 阅读
转载请注明：http://krystism.is-programmer.com/若有错误，请多多指正，谢谢！

以下内容引用Docker —— 从入门到实践

当 Docker 启动时，会自动在主机上创建一个 docker0 虚拟网桥，实际上是 Linux 的一个 bridge，可以理解为一个软件交换机。它会在挂载到它的网口之间进行转发。 同时，Docker 随机分配一个本地未占用的私有网段（在 RFC1918 中定义）中的一个地址给 docker0 接口。比如典型的 172.17.42.1，掩码为 255.255.0.0。此后启动的容器内的网口也会自动分配一个同一网段（172.17.0.0/16）的地址。 当创建一个 Docker 容器的时候，同时会创建了一对 veth pair 接口（当数据包发送到一个接口时，另外一个接口也可以收到相同的数据包）。这对接口一端在容器内，即 eth0；另一端在本地并被挂载到 docker0 网桥，名称以 veth 开头（例如 vethAQI2QT）。通过这种方式，主机可以跟容器通信，容器之间也可以相互通信。Docker 就创建了在主机和所有容器之间一个虚拟共享网络。如图 

docker network

 

下面以自定义的容器方式，一步步配置网络, 达到以下目标:

  • 容器间能够通信
  • 容器能够联外网

首先创建一个容器，但不使用默认网络配置，使用--net=none选项:

docker run -t -i --net=none ubuntu:14.04 bash
docker ps # 获取容器id=d344e6e05a99

获取容器pid:

docker inspect d344e6e05a99 | grep -i "\<pid\""
#  "Pid": 27383,
pid=27383

创建netns，并把容器放入新建的netns中，好像不能使用ip netns命令创建,使用以下方法创建:

sudo ln -s /proc/$pid/ns/net /var/run/netns/$pid

验证是否创建成功:

sudo ip netns show
# 27383
# ns1
# test

可见命名为27383的netns已经成功创建！

接下来创建一个veth对，其中一个设置为容器所在的netns

sudo ip link add name veth_d344 type veth peer name veth_d344_peer
sudo ip link set veth_d344_peer netns $pid

进入$pid netns设置网卡名称和ip:

sudo ip netns exec  27383 bash
sudo ip link set veth_d344_peer name eth0
sudo ifconfig  eth0 10.0.0.2/24 # 设置ip为10.0.0.2
ping 10.0.0.2 # 能ping通
exit

在容器中ping 10.0.0.2也能ping通,说明设置正确

ping 10.0.0.2 # 应该不通
docker exec d344e6e05a99 ping 10.0.0.2 # 成功ping通

创建网桥，并把veth另一端的虚拟网卡加入新创建的网桥中:

sudo brctl addbr br0 # 创建新网桥br0
sudo brctl addif br0 veth_d344 # 把虚拟网卡加入网桥br0中
sudo ifconfig br0 10.0.0.1/24 # 设置网桥ip
sudo ip link set veth_d344 up # 启动虚拟网卡

测试下:

ping 10.0.0.2 # 成功ping通
docker exec d344e6e05a99 ping 10.0.0.1 # 成功ping通

若以上两个都能ping通说明配置成功！

最后，我们需要使得容器能够联外网，需要设置NAT，使用iptables设置:

sudo iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o em1 -j MASQUERADE

设置容器默认路由为网桥ip（注意在容器内使用route add 添加, 会出现SIOCADDRT: Operation not permitted错误), 因此只能使用ip netns exec设置:

sudo ip netns exec 27383 route add default gw 10.0.0.1

测试，此时请确保宿主机能够联外网,进入容器内部:

ping baidu.com # 成功ping通，确保icmp没有被禁

 

转载请注明：http://krystism.is-programmer.com/若有错误，请多多指正，谢谢！
  • 无匹配
  • 无匹配
Small_feed 评论 (10)
1
[回复]
Model Paper 2022 Pdf 说:
2021年11月05日 14:52

Download the board-wide class standard SSC/SSLC/HSC Model Paper 2022 Pdf for each topic of the course based on previous years' old exam model question paper 2022 Model Paper 2022 Pdf from the table below. The Model Paper 2022 Pdf can be downloaded from the URL provided above. Obtain information from official state websites as well.

2
[回复]
Question Paper 2022 说:
2021年11月08日 16:31

They begin their search for such preparation materials on the internet, hoping to find some good Question Papers pdf. So, in order to assist you, Question Paper 2022 Pdf we've compiled a list of the greatest Question Papers, which you can readily download from this page. Students who are studying often wonder which questions are most significant for the board test.

3
[回复]
Navodaya Result 2022 说:
2022年1月10日 20:08

The Jawahar Navodaya Vidyalaya (JNV) Samiti has also successfully completed the lateral entry admission selection tests for vacant seats of Class 7th, 8th, 9th, 10th, 12th Grade admission selection tests. A huge number of students are participated in lateral entry exam and the students are waiting to check JNV Result 2022 District Selected list Navodaya Result 2022 Class 6 along with waiting listed student details for all rural and urban area schools across in the state. Navodaya Vidyalaya Samity is announced the 5th to 6th Class Result for the listed regions or zones in district wise for all rural and urban area schools of the country in roll number wise along with the name of the student.

4
[回复]
Emma 说:
2022年12月29日 19:24

"In Java, the ""Hello World!"" program is traditionally written as follows: public class hemp for pets HelloWorld { public static void main(String[] args) { System.out.println(""Hello World!""); } } When run, this program will display the text ""Hello World!"" on the screen. "

5
[回复]
amarnath helicopter 说:
2024年6月06日 00:49

I recently came across your article and have been reading along. I want to express my admiration of your writing skill and ability to make readers read from the beginning to the end. I would like to read newer posts and to share my thoughts with you.

6
[回复]
tech 说:
2024年6月07日 23:21

I’m excited to uncover this page. I need to to thank you for ones time for this particularly fantastic read!! I definitely really liked every part of it and i also have you saved to fav to look at new information in your site. kërkesat shëndetësore të Covid 19 për turistët e huaj që udhëtojnë në Turqi

7
[回复]
토지노 说:
2024年7月01日 19:57

Casinos are exploring the use of gamification beyond traditional gambling. By incorporating elements like achievements, leaderboards, and quests into their loyalty programs and overall experience, <a href="https://www.outlookindia.com/plugin-play/%ED%86%A0%EC%A7%80%EB%85%B8%EC%82%AC%EC%9D%B4%ED%8A%B8-%EC%B6%94%EC%B2%9C-%EA%B5%AD%EB%82%B4-%ED%86%A0%EC%A7%80%EB%85%B8-%EC%88%9C%EC%9C%84-%EB%AA%A9%EB%A1%9D-2024%EB%85%84">토지노</a> casinos can engage players in new and exciting ways. Gamification adds an extra layer of fun and competition, encouraging players to stay longer and return more often.

8
[回复]
tech 说:
2024年9月05日 09:24

This post is excellent. I've been going back to this blog for a while now, and I'm always impressed! The information here is incredibly helpful, especially on this page. Thank you, and good luck. guia turística dels llocs més assequibles per visitar a l'Índia

9
[回复]
tech 说:
2024年10月16日 18:08

It's amazing how you manage to make your content so engaging. This clarity in your writing is outstanding! Thank you so much, and I hope many more will enjoy your work. 印度電子簽證利比里亞公民的資格

10
[回复]
tech 说:
2024年12月03日 00:28

Your blog is really great. I easily discovered what I was looking for. In addition, the content quality is fantastic. I appreciate the prod! must see places in maui hawaii usa


登录 *


loading captcha image...
(输入验证码)
or Ctrl+Enter