Docker实战之容器网络机制（下）

Linux namespace详解

namespace & container

namespace还拥有层次关系。图3中，一个parent namespace下有两个child namespace。 parent namespace和它的两个child namespace都有三个进程号为1,2,3的进程，同时child namespace的每个进程被映射到了parent namespace中的4,5,6,7,8,9。虽然只有9个进程，但需要15个进程号来表示它们。

今年4月份，有人问霍金：“单向乐队（One Direction）的成员Zayn离队让全球无数少女心碎不已，这件事会产生怎样的宇宙效应呢？”

veth pair是用于不同network namespace间进行通信的方式， veth pair将一个network namespace数据发往另一个network namespace的veth。

Linux Bridge可以实现类似交换机的工作模式，将多个不同Namespace上的网卡连通

node1：

[root@node1 ~]# yum -y install bridge-utils
[root@node1 ~]# brctl show
bridge name     bridge id               STP enabled     interfaces
docker0         8000.02421cbdfc1e       no
[root@node1 ~]# docker run --rm=true -it java /bin/bash
root@c508b337ed93:/#
[root@node1 ~]# brctl show
bridge name     bridge id               STP enabled     interfaces
docker0         8000.02421cbdfc1e       no              veth88e97e6

root@c508b337ed93:/# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
213: eth0@if214: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default    #eth0连接214索引网卡
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
[root@node1 ~]# ip addr show veth88e97e6
214: veth88e97e6@if213: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default    #veth88e97e6接口连
接213索引网卡
    link/ether be:3a:14:f8:e7:33 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::bc3a:14ff:fef8:e733/64 scope link
       valid_lft forever preferred_lft forever
[root@node1 ~]# docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
c508b337ed93        java                "/bin/bash"         3 minutes ago       Up 3 minutes                            sweet_mclaren
[root@node1 ~]# docker inspect -f '{{.State.Pid}}' c508b337ed93    #得到容器真正的pid
73542
[root@node1 ~]# mkdir -p /var/run/netns
[root@node1 ~]# ln -s /proc/73542/ns/net /var/run/netns/73542
[root@node1 ~]# ip netns ls
73542 (id: 0)
[root@node1 ~]# ip netns exec 73542 ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
213: eth0@if214: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
[root@node1 ~]# ip netns exec 73542 ethtool -S eth0
NIC statistics:
     peer_ifindex: 214
[root@node1 ~]# ip addr show veth88e97e6
214: veth88e97e6@if213: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
    link/ether be:3a:14:f8:e7:33 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::bc3a:14ff:fef8:e733/64 scope link
       valid_lft forever preferred_lft forever

OVS +Docker

node1：

[root@node1 ~]# vim /etc/selinux/config
SELINUX=permissive
[root@node1 ~]# setenforce 0
[root@node1 ~]# getenforce
Permissive
[root@node1 ~]# vim /etc/yum.repos.d/openstack-train.repo
[openstack-train]
name=openstack-rocky
baseurl=https://mirrors.aliyun.com/centos/7.7.1908/cloud/x86_64/openstack-train/
gpgcheck=0
gpgkey=https://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
repo_gpgcheck=0
enabled=1
[root@node1 ~]# yum clean all
[root@node1 ~]# yum makecache
[root@node1 ~]# yum -y install openvswitch
[root@node1 ~]# systemctl restart openvswitch
[root@node1 ~]# systemctl status openvswitch
[root@node1 ~]# tail -f /var/log/messages    #提示没有libibverbs.so.1模块
Feb 29 17:24:23 node1 ovs-ctl: net_mlx5: cannot load glue library: libibverbs.so.1: cannot open shared object file: No such file or directory
[root@node1 ~]# yum -y install libibverbs
[root@node1 ~]# systemctl restart openvswitch

node2：

[root@node2 ~]# vim /etc/selinux/config
SELINUX=permissive
[root@node2 ~]# setenforce 0
[root@node2 ~]# getenforce
Permissive
[root@node2 ~]# vim /etc/yum.repos.d/openstack-train.repo
[openstack-train]
name=openstack-rocky
baseurl=https://mirrors.aliyun.com/centos/7.7.1908/cloud/x86_64/openstack-train/
gpgcheck=0
gpgkey=https://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
repo_gpgcheck=0
enabled=1
[root@node2 ~]# yum clean all
[root@node2 ~]# yum makecache
[root@node2 ~]# yum -y install openvswitch libibverbs
[root@node2 ~]# yum -y install bridge-utils
[root@node2 ~]# systemctl restart openvswitch
[root@node2 ~]# systemctl status openvswitch

node1：

[root@node1 ~]# ovs-vsctl add-br br0
[root@node1 ~]# ovs-vsctl add-port br0 gre1 -- set interface gre1 type=gre option:remote_ip=172.16.100.68
[root@node1 ~]# brctl addif docker0 br0
[root@node1 ~]# brctl addif docker0 br0
[root@node1 ~]# ip link set dev br0 up
[root@node1 ~]# ip link set dev docker0 up
[root@node1 ~]# ip route del 172.18.0.0/16 via 172.16.100.68
[root@node1 ~]# ip route add 172.18.0.0/16 dev docker0
[root@node1 ~]# ip route show
default via 192.168.204.2 dev ens37 proto dhcp metric 101
172.16.100.0/24 dev ens33 proto kernel scope link src 172.16.100.67 metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
172.18.0.0/16 dev docker0 scope link
192.168.204.0/24 dev ens37 proto kernel scope link src 192.168.204.135 metric 101
[root@node1 ~]# iptables -t nat -F
[root@node1 ~]# iptables -F

node2：

[root@node2 ~]# ovs-vsctl add-br br0
[root@node2 ~]# ovs-vsctl add-port br0 gre1 -- set interface gre1 type=gre option:remote_ip=172.16.100.67
[root@node2 ~]# brctl addif docker0 br0
[root@node2 ~]# ip link set dev br0 up
[root@node2 ~]# ip link set dev docker0 up
[root@node2 ~]# ip route del 172.17.0.0/16 via 172.16.100.67
[root@node2 ~]# ip route add 172.17.0.0/16 dev docker0
[root@node2 ~]# ip route show
default via 192.168.204.2 dev ens37 proto dhcp metric 101
172.16.100.0/24 dev ens33 proto kernel scope link src 172.16.100.68 metric 100
172.17.0.0/16 dev docker0 scope link
172.18.0.0/16 dev docker0 proto kernel scope link src 172.18.0.1
192.168.204.0/24 dev ens37 proto kernel scope link src 192.168.204.136 metric 101
[root@node2 ~]# iptables -t nat -F
[root@node2 ~]# iptables -F

node1：

[root@node1 ~]# docker run --rm=true -it java /bin/bash
root@383f22fbeb91:/# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: gre0@NONE: <NOARP> mtu 1476 qdisc noop state DOWN group default qlen 1000
    link/gre 0.0.0.0 brd 0.0.0.0
3: gretap0@NONE: <BROADCAST,MULTICAST> mtu 1462 qdisc noop state DOWN group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
220: eth0@if221: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
root@383f22fbeb91:/#

node2：

[root@node2 ~]# docker run --rm=true -it java /bin/bash
root@149ae1c4c922:/# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: gre0@NONE: <NOARP> mtu 1476 qdisc noop state DOWN group default qlen 1000
    link/gre 0.0.0.0 brd 0.0.0.0
3: gretap0@NONE: <BROADCAST,MULTICAST> mtu 1462 qdisc noop state DOWN group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
12: eth0@if13: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:ac:12:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0
       valid_lft forever preferred_lft forever

node1：

root@383f22fbeb91:/# ping 172.18.0.2
PING 172.18.0.2 (172.18.0.2): 56 data bytes
64 bytes from 172.18.0.2: icmp_seq=0 ttl=63 time=0.977 ms
64 bytes from 172.18.0.2: icmp_seq=1 ttl=63 time=0.724 ms
64 bytes from 172.18.0.2: icmp_seq=2 ttl=63 time=1.958 ms
^C--- 172.18.0.2 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.724/1.220/1.958/0.532 ms
[root@node1 ~]# tshark -i ens33 ip proto gre
Running as user "root" and group "root". This could be dangerous.
Capturing on 'ens33'
  1 0.000000000   172.17.0.2 -> 172.18.0.2   ICMP 136 Echo (ping) request  id=0x000a, seq=95/24320, ttl=63
  2 0.001374220   172.18.0.2 -> 172.17.0.2   ICMP 136 Echo (ping) reply    id=0x000a, seq=95/24320, ttl=63 (request in 1)
  3 1.002087969   172.17.0.2 -> 172.18.0.2   ICMP 136 Echo (ping) request  id=0x000a, seq=96/24576, ttl=63
  4 1.003074831   172.18.0.2 -> 172.17.0.2   ICMP 136 Echo (ping) reply    id=0x000a, seq=96/24576, ttl=63 (request in 3)
4 packets captured

发表于 2020-02-28 22:02 深秋、阅读(113) 评论(0) 收藏举报

公告