Docker的網絡機制
Docker的網絡有三種類型(driver): bridge, host 和 null.
- birdge: 就如同橋接的switch/hub, 使用bridge網絡的container會分配一個當前bridge配置的子網IP, 在通過run創建container時通過 --ip 指定.
- host: 需要使用 --network=host 參數指定. 使用主機網絡, 此時 container 的網絡會附屬在主機上, 兩者是互通的. 例如在container中的服務監聽8080端口, 則主機的8080端口就會自動映射到這個端口.
- none: 需要使用 --network=none 參數指定. 不分配局域網的IP
可以通過命令 docker network ls 和 docker network inspect [name] 查看
$ docker network ls NETWORK ID NAME DRIVER SCOPE 771ed6aaa9f8 bridge bridge local 243e4b881761 host host local 1c2c6b04e22c none null local $ docker network inspect bridge [ { "Name": "bridge", "Scope": "local", "Driver": "bridge", "EnableIPv6": false, "IPAM": { "Driver": "default", "Options": null, "Config": [ { "Subnet": "172.17.0.0/16", "Gateway": "172.17.0.1" } ] }, ... } ]
在宿主機上, 通過ifconfig能看到bridge的網關IP, 而container IP是不能直接看到的.
創建自定義Network
啟動Docker容器的時候，使用默認的網絡是不支持指派固定IP的
docker run -itd --net bridge --ip 172.17.0.10 centos:latest /bin/bash 6eb1f228cf308d1c60db30093c126acbfd0cb21d76cb448c678bab0f1a7c0df6 docker: Error response from daemon: User specified IP address is supported on user defined networks only.
需要使用自定義的network, 創建完后, 在宿主機上能看到新的bridge 的網關IP
$ docker network create --subnet=192.168.250.1/24 mybridge 760fb4aec8aef1eacece34d3a28aee1eabde7c47ce8ef9ec646c7c320a4da195 $ docker network ls NETWORK ID NAME DRIVER SCOPE 771ed6aaa9f8 bridge bridge local 243e4b881761 host host local 760fb4aec8ae mybridge bridge local 1c2c6b04e22c none null local
使用固定IP創建Container
$ docker run --name eureka -itd --net mybridge --ip 192.168.250.3 scot-eureka:latest /bin/bash ba7f9fcb4178c5181d3ea85eca5d03a132b8f32727c1ca0ee13bfd1ec15e4cc8 $ ping 192.168.250.3 PING 192.168.250.3 (192.168.250.3) 56(84) bytes of data. 64 bytes from 192.168.250.3: icmp_seq=1 ttl=64 time=0.102 ms 64 bytes from 192.168.250.3: icmp_seq=2 ttl=64 time=0.102 ms
使用固定IP啟動官方4.0.11版本的redis (啟動latest=5.0.0版本的redis, 無法鏈接6379端口, 尚未檢查具體原因, 4.0.11是沒問題的)
$ docker run -d --name redis2 --net mybridge --ip 192.168.250.2 redis:4.0.11
Docker的 Macvlan 網絡
創建macvlan網絡, 可以使docker的虛擬網卡直接綁定宿主機的物理網卡, 直接與宿主機所在網絡進行通訊. 此時, 除了宿主機和docker容器之間無法通信以外, docker容器與容器之間, 容器與宿主機網段其他機器之間都可以互訪.
參考的說明 https://docs.docker.com/v17.09/engine/userguide/networking/get-started-macvlan/ 其中特別提到的, 這是因為安全隔離所造成的, 如果需要宿主機和容器之間通信, 需要增加子網卡.
Communication with the Docker host over macvlan
When using macvlan, you cannot ping or communicate with the default namespace IP address. For example, if you create a container and try to ping the Docker host’s eth0, it will not work. That traffic is explicitly filtered by the kernel modules themselves to offer additional provider isolation and security.
A macvlan subinterface can be added to the Docker host, to allow traffic between the Docker host and containers. The IP address needs to be set on this subinterface and removed from the parent address.
創建macvlan的命令
# 斷開連接 $ docker network disconnect bridge-local redis # 刪除網絡 $ docker network rm bridge-local # 創建網絡 $ docker network create -d macvlan --subnet=192.168.252.0/24 --gateway=192.168.252.1 --aux-address="parent_host=192.168.252.151" -o parent=enp2s0f0 bridge-local # 將運行中的docker連接至bridge-local $ docker network connect bridge-local redis --ip 192.168.252.10
參考 http://networkstatic.net/configuring-macvlan-ipvlan-linux-networking/
以及如何在Ubuntu18.04下配置subinterface https://askubuntu.com/questions/971126/17-10-netplan-config-with-bridge