默认网络模型
先介绍默认的网络模型:
安装docker后，输入ifconfig就会发现多了网卡中多了一个docker0:
$ ifconfig
docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
ether 02:42:e0:2e:fe:77 txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
docker0是一个二层网络设备，即网桥(交换机)，将Linux支持的不同的端口连接起来，实现交换机多对多的通信。默认网络模模式为桥接模式，使用veth pair技术，即虚拟以太网设备，成对出现用于解决网络命名空间之间的隔离，一端连接Container network namespace，另一端连接Host network namespace
下面启动一个centos容器用于测试: sudo docker run -it centos bash，输入ip a s查看网卡
$ ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
5: eth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
可以看到创建出了lo网卡和eth0网卡
同时可以看到宿主机上创建出了一个虚拟网卡:
vethee50e32: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::d847:e3ff:fe86:b0e8 prefixlen 64 scopeid 0x20<link>
ether da:47:e3:86:b0:e8 txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 29 bytes 4524 (4.5 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
容器访问外网
如上展示了容器访问外网的方式，veth一头连接容器，一头连接主机，eth0是宿主机的物理网卡，SNAT进行IP地址转换，容器所有到外部网络的连接，源地址都会被 NAT 成本地系统的 IP 地址，这是使用 iptables 的源地址伪装操作实现的
启动一个Nginx容器进行演示:sudo docker run -d --name web1 -p 8081:80 nginx，将宿主机的8081端口映射到nginx容器的80端口
在启动容器之前，查看POSTROUTING链的NAT规则:
$ sudo iptables -t nat -vnL POSTROUTING
Chain POSTROUTING (policy ACCEPT 31 packets, 2428 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0
启动容器后发现多了一条:
$ sudo iptables -t nat -vnL POSTROUTING
Chain POSTROUTING (policy ACCEPT 31 packets, 2428 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0
0 0 MASQUERADE tcp -- * * 172.17.0.3 172.17.0.3 tcp dpt:80
多出来一条MASQUERADE，这是新创建的端口映射
外网访问容器
数据包发送到eth0，经过DNAT转换，例如进行8081和80端口的映射时，发送宿主机的端口的数据包会被转发到容器的80端口，如下查看DOCKER链的NAT规则:
$ sudo iptables -t nat -vnL DOCKER
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0
0 0 DNAT tcp -- !docker0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8081 to:172.17.0.3:80
可以看到增加了如上的转换
Docker四种网络模型
详细解释:
| 模式 | 使用方法 | 说明 |
|---|---|---|
| bridge [桥接式网络(Bridge container A)] | --network bridge | 桥接容器，除了有一块本地回环接口(Loopback interface)外，还有一块私有接口(Private interface)通过容器虚拟接口(Container virtual interface)连接到桥接虚拟接口(Docker bridge virtual interface)，之后通过逻辑主机接口(Logical host interface)连接到主机物理网络(Physical network interface)。 桥接网卡默认会分配到172.17.0.0/16的IP地址段。 如果我们在创建容器时没有指定网络模型，默认就是(Nat)桥接网络，这也就是为什么在登录到一个容器后，发现IP地址段都在172.17.0.0/16网段的原因。 |
| host [开放式容器(Open container)] | --network host | 比联盟式网络更开放，联盟式网络是多个容器共享网络(Net),而开放式容器(Open contaner)就直接共享了宿主机的名称空间。因此物理网卡有多少个，那么该容器就能看到多少网卡信息。我们可以说Open container是联盟式容器的衍生 |
| none [封闭式网络(Closed container)] | --network none | 封闭式容器，只有本地回环接口(Loopback interface，和服务器看到的lo接口类似)，无法与外界进行通信 |
| container [联盟式网络(Joined container A | Joined container B ] | --network container:c1(容器名称或容器ID) | 每个容器都各有一部分名称空间(Mount,PID,User)，另外一部分名称空间是共享的(UTS,Net,IPC)。 由于它们的网络是共享的，因此各个容器可以通过本地回环接口(Loopback interface)进行通信。 除了共享同一组本地回环接口(Loopback interface)外，还有一块一块私有接口(Private interface)通过联合容器虚拟接口(Joined container virtual interface)连接到桥接虚拟接口(Docker bridge virtual interface)，之后通过逻辑主机接口(Logical host interface)连接到主机物理网络(Physical network interface) |
输入docker network -h查看网络相关的帮助指令:
$ sudo docker network -h
Flag shorthand -h has been deprecated, please use --help
Usage: docker network COMMAND
Manage networks
Commands:
connect Connect a container to a network
create Create a network
disconnect Disconnect a container from a network
inspect Display detailed information on one or more networks
ls List networks
prune Remove all unused networks
rm Remove one or more networks
Run 'docker network COMMAND --help' for more information on a command.
查看已有的网络模型
$ sudo docker network ls
NETWORK ID NAME DRIVER SCOPE
de27040d1dbb bridge bridge local
95aa02052f1e host host local
f877107fa92a none null local
查看已有的网络模型的详细信息，查看bridge网络模式:
$ sudo docker network inspect bridge
[
{
"Name": "bridge",
"Id": "de27040d1dbb5375a429f6c0a11eadbfe468749be366ff1ebe1a681db0c67419",
"Created": "2022-08-07T16:40:03.780510605+08:00",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},
....
查看Docker支持的网络模型:
$ sudo docker info | grep Network
Network: bridge host ipvlan macvlan null overlay
创建指定类型的网络模型
输入docker network create --help查看帮助指令:
$ sudo docker network create --help
Usage: docker network create [OPTIONS] NETWORK
Create a network
Options:
--attachable Enable manual container attachment
--aux-address map Auxiliary IPv4 or IPv6 addresses used by Network driver (default map[])
--config-from string The network from which to copy the configuration
--config-only Create a configuration only network
-d, --driver string Driver to manage the Network (default "bridge")
--gateway strings IPv4 or IPv6 Gateway for the master subnet
--ingress Create swarm routing-mesh network
--internal Restrict external access to the network
--ip-range strings Allocate container ip from a sub-range
--ipam-driver string IP Address Management Driver (default "default")
--ipam-opt map Set IPAM driver specific options (default map[])
--ipv6 Enable IPv6 networking
--label list Set metadata on a network
-o, --opt map Set driver specific options (default map[])
--scope string Control the network's scope
--subnet strings Subnet in CIDR format that represents a network segment
桥接网络
Bridge网络模型，创建一个名为mybr0的桥接网络:
$ sudo docker network create -d bridge --subnet '192.168.100.0/24' --gateway '192.168.100.1' -o com.docker.network.bridge.name=docker1 mybr0
d3edc3f6b0a83e4500a6ddce59b498897d28f9509ee4dbce565f695e4fbb535b
用-d指定网络模型，用--subnet指定子网网段，用--gateway指定网关IP，-o指定options，最后是网络的名称，关于options的信息可以在inspect帮助信息中找到:
$ sudo docker network inspect bridge
....
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
}
启动容器并连接到已经创建mybr0的网络:
$ sudo docker run -it --network mybr0 --rm busybox
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:C0:A8:64:02
inet addr:192.168.100.2 Bcast:192.168.100.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:45 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:7129 (6.9 KiB) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
使用--network连接到网络中，在伪终端中输入ifconfig来查看网卡信息，可以看到eth0中显示的网段正是上述创建网络时使用的网段
在Linux Docker主机上，默认的bridge网络被映射到内核中的docker0的Linux网桥
host网络模型
如下查看该模型的详细信息:
$ sudo docker network inspect host
[
{
"Name": "host",
"Id": "95aa02052f1e6bc5b2254079ec0d352a44f4ac36a80719942d851a237265ce1f",
"Created": "2022-07-11T15:16:39.407947148+08:00",
"Scope": "local",
"Driver": "host",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": []
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {},
"Labels": {}
}
]
以host网络模式启动容器:
$ sudo docker run -it --network host --rm busybox
这时在容器的伪终端中收入ifconfig就可以查看到宿主机的网卡信息，宿主机有多少网卡，就能看到多少个:
/ # ifconfig
docker0 Link encap:Ethernet HWaddr 02:42:9E:EA:84:EA
inet addr:172.17.0.1 Bcast:172.17.255.255 Mask:255.255.0.0
inet6 addr: fe80::42:9eff:feea:84ea/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:120 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:21121 (20.6 KiB)
docker1 Link encap:Ethernet HWaddr 02:42:C7:38:02:B7
inet addr:192.168.100.1 Bcast:192.168.100.255 Mask:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
enp8s0 Link encap:Ethernet HWaddr 00:2B:67:B3:23:FE
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
....
如果是启动一个Nginx容器，那么应当访问主机地址即可访问到Nginx容器，因为共享了网络命名空间:
$ sudo docker run -d --network host nginx
40ce947653e6ee080b3463f8cbb45ee31f2e11dc976e325c9d3390734aa161dd
这时直接访问宿主机的IP地址:
$ curl http://192.168.2.8
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
....
发现可以访问Nginx，这证明了该模式下共享网络命名空间，无需NAT转换，但是不能再运行一个这样的容器
none模型，这类似于虚拟机的仅主机模式，查看详细信息:
$ sudo docker inspect none
[
{
"Name": "none",
"Id": "f877107fa92a6a1842003cba07a908dce5ec42101a82945a54988f6d616aba95",
"Created": "2022-07-11T15:16:39.402959094+08:00",
"Scope": "local",
"Driver": "null",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": []
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {},
"Labels": {}
}
]
使用这种网络模型意味着没有网络
$ sudo docker run -it --network none --rm busybox
/ # ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
初始状态下仅有一个环回设备
联盟网络
首先创建一个C1容器，使用默认网络模型，查看网络设备:
$ sudo docker run -it --name c1 --rm busybox
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02
inet addr:172.17.0.2 Bcast:172.17.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:20 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3202 (3.1 KiB) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
按下Ctrl+P+Q暂时退出，输入以下指令建立联盟网络，进入终端后输入ifconifg查看网卡信息
$ sudo docker run -it --name c2 --network container:c1 --rm busybox
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02
inet addr:172.17.0.2 Bcast:172.17.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:49 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:7623 (7.4 KiB) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
在c2中创建一个httpd服务，并写入首页文件:
echo "Hello World" >> /tmp/index.html
httpd -h /tmp
按下Ctrl+P+Q，保持容器运行并退出，使用c1运行wget命令，向127.0.0.1发起http请求
$ sudo docker exec c1 wget -O - -q 127.0.0.1
hello world
得到如上响应，代表访问成功，这证明了在这个联盟式网络中，容器共享一部分网络命名空间，可以通过回环地址来访问
