Docker 05 网络Network
前情提要
一、是什么？
是Docker对容器网络隔离的一项技术，提供了多种不同的模式供用户使用，选择不同的网络模式来实现容器网络的互通以及彻底的隔离。
二、为什么需要？
容器间的网络隔离
实现部分容器之间的网络共享
管理多个子网下容器的ip
三、能干什么
提供了多种模式，可以定制化的为每个容器制定不同的网络
自定义网络模式，划分不同的子网，以及网关、DNS等配置
四、网络互通
不同子网之间的网络互通
基于容器名（主机名）的方式在网络内访问
网络模式
一、brigde (桥接, 默认模式)
在主机中创建了一个叫docker0的网卡（网桥），是实现主机和容器内的网络互通的。主机的网卡跟docker0连接，然后通过dockker0找到一个映射，在Docker0创建一对儿虚拟网卡（可以将docker0理解为一个虚拟交换机），一半在主机上（名称可能是：vethxxx），一半在容器内（名字：eth0）
二、host
容器不再拥有自己的网络空间，而是直接与主机共享网络空间，那么基于该模式创建的容器对应的ip实际就是与主机同一个子网，同一个网段。
192.168.113.1
192.168.113.x
相当于直接把我们的容器暴露出去了，不仅仅是主机可以访问，外部网络也可以访问。这种方式用的比较少，因为就相当于把你的宿主机当作一个虚拟机，或者是你的子网的一个机器，而不是当做一个容器在使用了，这样会牺牲一定容器的安全性，因为容器要实现隔离，这样才能把影响降到最小。
原先只能通过主机来访问我的容器，现在不通过主机也可以访问容器，所以就没那么安全了。
三、none
docker会有自己的网络空间，不与主机共享，在这个网络模式下的容器，不会被分配网卡、ip、路由等相关信息。相当于这台机器是一个物联网的状态，相当于把网线拔了，也不联WIFI，
特点：完全隔离，与外部任何机器都无网络访问，只有自己的lo, 本地网络，127.0.0.1。好处就是绝对安全，除非你把我的宿主机攻破了，否则无法进入容器内部；即便是攻破了宿主机，也无法通过网络进入，只能通过docker命令来处理。
lo：网卡
[root@VM-0-2-centos nginx-html]# ifconfig
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 279004832 bytes 49125616088 (45.7 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 279004832 bytes 49125616088 (45.7 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
四、container模式 （较少使用）
不会创建自己的网络，而是与其他容器共享网络空间，直接使用指定容器的 ip / 端口
五、自定义模式 （推荐）
不使用Docker自带的网络模式，而是自己去定制化自己特有的网络模式。
1. 查看现有网络模式
[root@VM-0-2-centos ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
2bc0758d99d2 bridge bridge local
ccbe9f307426 host host local
19b87063018e none null local
2. 创建自定义网络
[root@VM-0-2-centos ~]# docker network create --driver bridge --subnet 192.168.133.0/24 --gateway 192.168.133.1 wolfcode
7a2a1d1927d1e48b89e7128dcd8d04579727e6c2b7903510a483e89d3b5bcc09
[root@VM-0-2-centos ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
2bc0758d99d2 bridge bridge local
ccbe9f307426 host host local
19b87063018e none null local
7a2a1d1927d1 wolfcode bridge local
[root@VM-0-2-centos ~]# docker network inspect wolfcode
[
{
"Name": "wolfcode",
"Id": "7a2a1d1927d1e48b89e7128dcd8d04579727e6c2b7903510a483e89d3b5bcc09",
"Created": "2026-09-15T18:46:18.110136325+08:00",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": {},
"Config": [
{
"Subnet": "192.168.133.0/24",
"Gateway": "192.168.133.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {},
"Labels": {}
}
]
[root@VM-0-2-centos ~]#
3. 使用自定义的网络创建容器
- 用上面创建的自定义网络创建容器实例
- 进入容器内shell
- 查看容器内的hosts配置
#
[root@VM-0-2-centos ~]# docker run -d --rm -P --name nginx_network --net wolfcode nginx
2a756920b92bb50f56f76ba2ee1c99a5f1f55b2effc6cfcab0b56892f4a993f1
[root@VM-0-2-centos ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
2a756920b92b nginx "/docker-entrypoint.…" 6 seconds ago Up 5 seconds 0.0.0.0:32770->80/tcp, :::32770->80/tcp nginx_network
b16271b02574 nginx "/docker-entrypoint.…" 4 hours ago Up 4 hours 0.0.0.0:9876->80/tcp, :::9876->80/tcp nginx_volume
[root@VM-0-2-centos ~]# docker exec -it nginx_network /bin/bash
root@2a756920b92b:/# ifconfig
bash: ifconfig: command not found
root@2a756920b92b:/# cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
192.168.133.2 2a756920b92b
root@2a756920b92b:/#
六、基于自定义Network的容器之间互通性
1. 验证主机无法跟容器连接
# 在主机中ping 容器名称，失败
[root@VM-0-2-centos ~]# ping nginx_network
ping: nginx_network: 未知的名称或服务
# 查看当前主机ip情况
[root@VM-0-2-centos ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 52:54:00:9b:fd:f6 brd ff:ff:ff:ff:ff:ff
inet 172.21.0.2/20 brd 172.21.15.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fe9b:fdf6/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:f3:ad:d5:a7 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:f3ff:fead:d5a7/64 scope link
valid_lft forever preferred_lft forever
41: vethf837054@if40: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether 3e:7b:a8:db:59:d2 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::3c7b:a8ff:fedb:59d2/64 scope link
valid_lft forever preferred_lft forever
# 这个相当于网关的地址：192.168.133.1/24 就是上面自定义网络时设置的。
42: br-7a2a1d1927d1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:b2:fb:4c:a4 brd ff:ff:ff:ff:ff:ff
inet 192.168.133.1/24 brd 192.168.133.255 scope global br-7a2a1d1927d1
valid_lft forever preferred_lft forever
inet6 fe80::42:b2ff:fefb:4ca4/64 scope link
valid_lft forever preferred_lft forever
# 这个是桥接模式的网卡
44: veth709bfd7@if43: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-7a2a1d1927d1 state UP group default
link/ether 2e:76:13:1a:ea:29 brd ff:ff:ff:ff:ff:ff link-netnsid 1
inet6 fe80::2c76:13ff:fe1a:ea29/64 scope link
valid_lft forever preferred_lft forever
2. 容器和容器之间可以网络互联
但是由于nginx容器环境中没有ping 命令，所以ping探测网络联通失败。
[root@VM-0-2-centos ~]# docker run -d --rm -P --name nginx_network2 --net wolfcode nginx
07ce40a037cbc160a1c56860fe79aa69f957d7cb0845d85d6178254b26f4c2af
[root@VM-0-2-centos ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
07ce40a037cb nginx "/docker-entrypoint.…" 5 seconds ago Up 4 seconds 0.0.0.0:32771->80/tcp, :::32771->80/tcp nginx_network2
2a756920b92b nginx "/docker-entrypoint.…" 10 minutes ago Up 10 minutes 0.0.0.0:32770->80/tcp, :::32770->80/tcp nginx_network
b16271b02574 nginx "/docker-entrypoint.…" 4 hours ago Up 4 hours 0.0.0.0:9876->80/tcp, :::9876->80/tcp nginx_volume
[root@VM-0-2-centos ~]# docker exec -it nginx_network ping nginx_network2
OCI runtime exec failed: exec failed: unable to start container process: exec: "ping": executable file not found in $PATH: unknown
[root@VM-0-2-centos ~]# docker exec -it nginx_network /bin/bash
root@2a756920b92b:/# ping
bash: ping: command not found
启用有ping命令的centos 容器
- centos是一个系统，不是软件，一般是作为基础镜像来使用，而不是直接把它运行成一个容器。运行成容器有一个先决条件：内部必须有一个前端运行的命令，来让这个容器卡住，不会退出。
容器的运行特点： - 如果容器运行起来了，没有什么事情可干的话，容器就会自动退出。而容器启动时如果有--rm参数，则会自动把容器删除掉。
# 拉取centos容器镜像
[root@VM-0-2-centos ~]# docker pull centos
Using default tag: latest
latest: Pulling from library/centos
a1d0c7532777: Pull complete
Digest: sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f432b177
Status: Downloaded newer image for centos:latest
docker.io/library/centos:latest
# 查看镜像
[root@VM-0-2-centos ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 5f52b9aca7a7 12 days ago 170MB
openjdk 8 b273004037cc 4 years ago 526MB
centos latest 5d0da3dc9764 5 years ago 231MB
# 启动centos容器
[root@VM-0-2-centos ~]# docker run -d --rm -P --name centos_network01 --net wolfcode centos
5b6856ab3d948e2fd3614c1aeb7877da1eb6f5fede540a3ea0df00444fddc107
# 查看运行中的镜像，发现没有centos
[root@VM-0-2-centos ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
07ce40a037cb nginx "/docker-entrypoint.…" 12 minutes ago Up 12 minutes 0.0.0.0:32771->80/tcp, :::32771->80/tcp nginx_network2
2a756920b92b nginx "/docker-entrypoint.…" 22 minutes ago Up 22 minutes 0.0.0.0:32770->80/tcp, :::32770->80/tcp nginx_network
b16271b02574 nginx "/docker-entrypoint.…" 5 hours ago Up 5 hours 0.0.0.0:9876->80/tcp, :::9876->80/tcp nginx_volume
取巧做法，使centos不退出
为启动命令添加一个 ping 127.0.0.1，这个容器内部一直有事可做，就不会停，不会被删除。（Linux中ping会一直ping），这个容器就卡住了，不
[root@VM-0-2-centos ~]# docker run -d --rm -P --name centos_network01 --net wolfcode centos ping 127.0.0.1
dcfd6e21a1c0ce582cda483728acbd0e3cd778f5f68af7229c3b2a4ea7f42c27
[root@VM-0-2-centos ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
dcfd6e21a1c0 centos "ping 127.0.0.1" 24 seconds ago Up 23 seconds centos_network01
07ce40a037cb nginx "/docker-entrypoint.…" 16 minutes ago Up 16 minutes 0.0.0.0:32771->80/tcp, :::32771->80/tcp nginx_network2
2a756920b92b nginx "/docker-entrypoint.…" 26 minutes ago Up 26 minutes 0.0.0.0:32770->80/tcp, :::32770->80/tcp nginx_network
b16271b02574 nginx "/docker-entrypoint.…" 5 hours ago Up 5 hours 0.0.0.0:9876->80/tcp, :::9876->80/tcp nginx_volume
相同自定义network的两容器直接网络是互通的，可以ping通
[root@VM-0-2-centos ~]# docker run -d --rm -P --name centos_network01 --net wolfcode centos ping 127.0.0.1
[root@VM-0-2-centos ~]# docker run -d --rm -P --name centos_network02 --net wolfcode centos ping 127.0.0.1
679fd4c797c03fec269bc4a341d40e7a43c7661579fc492492f6f409e42a9fb2
[root@VM-0-2-centos ~]# clear
[root@VM-0-2-centos ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
679fd4c797c0 centos "ping 127.0.0.1" 13 seconds ago Up 13 seconds centos_network02
dcfd6e21a1c0 centos "ping 127.0.0.1" 4 minutes ago Up 4 minutes centos_network01
07ce40a037cb nginx "/docker-entrypoint.…" 20 minutes ago Up 20 minutes 0.0.0.0:32771->80/tcp, :::32771->80/tcp nginx_network2
2a756920b92b nginx "/docker-entrypoint.…" 30 minutes ago Up 30 minutes 0.0.0.0:32770->80/tcp, :::32770->80/tcp nginx_network
b16271b02574 nginx "/docker-entrypoint.…" 5 hours ago Up 5 hours 0.0.0.0:9876->80/tcp, :::9876->80/tcp nginx_volume
[root@VM-0-2-centos ~]# docker exec -it centos_network01 ping centos_network02
PING centos_network02 (192.168.133.5) 56(84) bytes of data.
64 bytes from centos_network02.wolfcode (192.168.133.5): icmp_seq=1 ttl=64 time=0.080 ms
64 bytes from centos_network02.wolfcode (192.168.133.5): icmp_seq=2 ttl=64 time=0.066 ms
64 bytes from centos_network02.wolfcode (192.168.133.5): icmp_seq=3 ttl=64 time=0.055 ms
64 bytes from centos_network02.wolfcode (192.168.133.5): icmp_seq=4 ttl=64 time=0.050 ms
64 bytes from centos_network02.wolfcode (192.168.133.5): icmp_seq=5 ttl=64 time=0.050 ms
^C
--- centos_network02 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4001ms
rtt min/avg/max/mdev = 0.050/0.060/0.080/0.012 ms
[root@VM-0-2-centos ~]#
总结
通过自定义网络创建的多个不同的容器，两个不同的容器在同一个网络下，可以互相访问。
七、默认桥接模式的Network互通性验证
容器之间用docker名字互相ping不通，只能用ip去ping
[root@VM-0-2-centos ~]# docker run -d --rm -P --name docker_net1 --net bridge centos ping 127.0.0.1
b2d81cd03aab9579550b26419411e4203ebd73e9854aaa26e1f987ea1d09f8ad
[root@VM-0-2-centos ~]# docker run -d --rm -P --name docker_net2 --net bridge centos ping 127.0.0.1
3652179f47e7cd6008c6db5c4aeebc10557745485b31301ee2318785eb17e92c
[root@VM-0-2-centos ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
3652179f47e7 centos "ping 127.0.0.1" 3 seconds ago Up 3 seconds docker_net2
b2d81cd03aab centos "ping 127.0.0.1" 10 seconds ago Up 9 seconds docker_net1
[root@VM-0-2-centos ~]# docker exec -it docker_net1 ping docker_net2
ping: docker_net2: Name or service not known
# 查看ip
[root@VM-0-2-centos ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 52:54:00:9b:fd:f6 brd ff:ff:ff:ff:ff:ff
inet 172.21.0.2/20 brd 172.21.15.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fe9b:fdf6/64 scope link
valid_lft forever preferred_lft forever
# docker的网段是 172.17.0.1
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:f3:ad:d5:a7 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:f3ff:fead:d5a7/64 scope link
valid_lft forever preferred_lft forever
42: br-7a2a1d1927d1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:b2:fb:4c:a4 brd ff:ff:ff:ff:ff:ff
inet 192.168.133.1/24 brd 192.168.133.255 scope global br-7a2a1d1927d1
valid_lft forever preferred_lft forever
inet6 fe80::42:b2ff:fefb:4ca4/64 scope link
valid_lft forever preferred_lft forever
# dockers容器1的网卡
54: veth15f4add@if53: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether aa:20:00:de:7d:fb brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::a820:ff:fede:7dfb/64 scope link
valid_lft forever preferred_lft forever
# dockers容器2的网卡
56: vethf3a0c6e@if55: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether 92:be:82:b0:18:89 brd ff:ff:ff:ff:ff:ff link-netnsid 1
inet6 fe80::90be:82ff:feb0:1889/64 scope link
valid_lft forever preferred_lft forever
# 进入到docker1的容器中去，查看docker1的ip
[root@VM-0-2-centos ~]# docker exec -it docker_net1 /bin/bash
[root@b2d81cd03aab /]# cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2 b2d81cd03aab
#退出doker1
[root@b2d81cd03aab /]# exit
exit
# 通过名称ping ip的形式可以ping通
[root@VM-0-2-centos ~]# docker exec -it docker_net2 ping 172.17.0.2
PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.
64 bytes from 172.17.0.2: icmp_seq=1 ttl=64 time=0.088 ms
64 bytes from 172.17.0.2: icmp_seq=2 ttl=64 time=0.034 ms
64 bytes from 172.17.0.2: icmp_seq=3 ttl=64 time=0.039 ms
64 bytes from 172.17.0.2: icmp_seq=4 ttl=64 time=0.050 ms
64 bytes from 172.17.0.2: icmp_seq=5 ttl=64 time=0.039 ms
^C
--- 172.17.0.2 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4000ms
rtt min/avg/max/mdev = 0.034/0.050/0.088/0.019 ms
[root@VM-0-2-centos ~]#
实际情况是我们不可能通过这种情况去看容器的ip是多少，通常在使用容器的时候我们会忽略ip，我们希望所有这些ip的管理都交给docker容器，docker引擎去帮我们管理 ，而不是我们自己。
默认桥接网络启动容器时加启动参数 --link other_container_name
这种网络模式必须加--link参数，并且只能单向访问，这种方式对应自定义网络不灵活。实现原理是在设置了启动参数--link的容器里维护/etc/hosts 文件做了映射
[root@VM-0-2-centos ~]# docker run -d --rm -P --name docker_net1 centos ping 127.0.0.1
48762ed1c86c4f5e7218a68b6a2a53be9e9b0c03eb262625f846908427dd3cc3
[root@VM-0-2-centos ~]# docker run -d --rm -P --name docker_net2 --link docker_net1 centos ping 127.0.0.1
b173d0df592d6789d32c66e95b81cb99c97d45b996f2ae27899770847f31771a
[root@VM-0-2-centos ~]# docker exec -it docker_net2 ping docker_net1
PING docker_net1 (172.17.0.2) 56(84) bytes of data.
64 bytes from docker_net1 (172.17.0.2): icmp_seq=1 ttl=64 time=0.057 ms
64 bytes from docker_net1 (172.17.0.2): icmp_seq=2 ttl=64 time=0.047 ms
^C
--- docker_net1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.047/0.052/0.057/0.005 ms
[root@VM-0-2-centos ~]# docker exec -it docker_net1 ping docker_net2
ping: docker_net2: Name or service not known
[root@VM-0-2-centos ~]#
[root@VM-0-2-centos ~]# docker exec -it docker_net1 ping docker_net2
ping: docker_net2: Name or service not known
[root@VM-0-2-centos ~]# docker exec -it docker_net2 /bin/bash
[root@b173d0df592d /]# cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2 docker_net1 48762ed1c86c
172.17.0.3 b173d0df592d
[root@b173d0df592d /]#
不同模式下的连接问题
docker netwrok connect 网络 net1
#默认桥接模式启动
docker run -d --rm -P --name net1 centos ping 127.0.0.1
#通过自定义netwrok ： wolfcode启动
docker run -d --rm -P --name net2 --net wolfcode centos ping 127.0.0.1
#ping失败
docker exec -it net2 ping net1
# 先建立网络连接，然就可以网络 互联了。
docker netwrok connect wolfcode net1
#ping成功
docker exec -it net2 ping net1
预实现联通方式目标
实际实现联通方式目标
浙公网安备 33010602011771号