posts - 1014, comments - 299, trackbacks - 1, articles - 1
  博客园  :: 首页  :: 新随笔  :: 联系 :: 订阅 订阅  :: 管理


Posted on 2014-10-30 16:58 feisky 阅读(...) 评论(...) 编辑 收藏



  1. --net=bridge — The default action, that connects the container to the Docker bridge as described above.

  2. --net=host — Tells Docker to skip placing the container inside of a separate network stack. In essence, this choice tells Docker to not containerize the container's networking! While container processes will still be confined to their own filesystem and process list and resource limits, a quick ip addr command will show you that, network-wise, they live “outside” in the main Docker host and have full access to its network interfaces. Note that this doesnot let the container reconfigure the host network stack — that would require --privileged=true — but it does let container processes open low-numbered ports like any other root process. It also allows the container to access local network services like D-bus. This can lead to processes in the container being able to do unexpected things like restart your computer. You should use this option with caution.

  3. --net=container:NAME_or_ID — Tells Docker to put this container's processes inside of the network stack that has already been created inside of another container. The new container's processes will be confined to their own filesystem and process list and resource limits, but will share the same IP address and port numbers as the first container, and processes on the two containers will be able to connect to each other over the loopback interface.

  4. --net=none — Tells Docker to put the container inside of its own network stack but not to take any steps to configure its network, leaving you free to build any of the custom configurations explored in the last few sections of this document.


首先,配置一个用于创建container interface的网桥,可以使用ovs,也可以使用Linux bridge,以Linux bridge为例:

brctl addbr $br_name
ip addr add dev $br_name
ip addr del dev em1
ip link set $br_name up
brctl addif $br_name eth0


# start new container
cid=$(docker run -d -i -h $hostname --net=none -t centos)
pid=$(docker inspect -f '{{.State.Pid}}' $cid)


# set up netns
mkdir -p /var/run/netns
ln -s /proc/$pid/ns/net /var/run/netns/$pid
# set up bridge
ip link add q$pid type veth peer name r$pid
brctl addif $br_name q$pid
ip link set q$pid up
# set up docker interface
ip link set r$pid netns $pid
ip netns exec $pid ip link set dev r$pid name eth0
ip netns exec $pid ip link set eth0 up
ip netns exec $pid ip addr add $fixed_ip dev eth0
ip netns exec $pid ip route add default via


pipework docker0 be8365e3b2834


# stop and delete container
docker stop $cid
docker rm $cid
# delete docker's net namespace (also delete veth pair)
ip netns delete $pid