#导入连接到host2的环境变量
[root@host1:~ [host2]]#eval $(docker-machine env host2)
#查看docker的原生网络：桥接、本机、无三种
[root@host1:~ [host2]]#docker network ls
NETWORK ID NAME DRIVER SCOPE
88cb1b40a898 bridge bridge local
4aa36335be46 host host local
7eadfbd8b20c none null local
#none网络类型的容器，对安全性要求高：比如生成随机密码的容器
# [root@host1:~ [host2]]#docker run -it --network=none busybox
/# ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
#host网络类型的容器，共享docker host的网络栈，容器的网络配置和host完全一样
[root@host1:~ [host2]]#docker run -it --network=host busybox
/ # ifconfig
docker0 Link encap:Ethernet HWaddr 02:42:B1:61:57:56
inet addr:172.17.0.1 Bcast:0.0.0.0 Mask:255.255.0.0
inet6 addr: fe80::42:b1ff:fe61:5756/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:1060 (1.0 KiB)
ens33 Link encap:Ethernet HWaddr 00:0C:29:CB:87:7A
inet addr:192.168.142.170 Bcast:192.168.142.255 Mask:255.255.255.0
inet6 addr: fe80::3f46:a638:8094:76e4/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:15374 errors:0 dropped:0 overruns:0 frame:0
TX packets:3605 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6923612 (6.6 MiB) TX bytes:507427 (495.5 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:1760 errors:0 dropped:0 overruns:0 frame:0
TX packets:1760 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:137627 (134.4 KiB) TX bytes:137627 (134.4 KiB)
#桥接
1）默认情况有一个叫docker0的Linux bridge，如果不指定网络的话，创建的容器会挂载到此网络上
[root@host1:~]#brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.02426a0b9c15 no
2）当我们创建一个网络时，一个名为veth88b534c的网络接口被挂载了此网络上
[root@host1:~]#docker run -d httpd
e4c5b37d239d3a6b9da599edf57a4f5d9dec2f0c22886b421d8f29c5e6381727
[root@host1:~]#brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.02426a0b9c15 no veth88b534c
#查看容器的网络配置，其中if8和veth88b534c是一对儿特殊的网络设备，这样虚拟机可以连接到docker0（即将docker0（172.17.0.1）作为网关）
[root@host1:~]#docker run -d httpd
e4c5b37d239d3a6b9da599edf57a4f5d9dec2f0c22886b421d8f29c5e6381727
[root@host1:~]#docker exec -it e4c5b37d239d3a6b9da599edf57a4f5d9dec2f0c22886b421d8f29c5e6381727 bash
root@e4c5b37d239d:/usr/local/apache2# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
7: eth0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.2/16 scope global eth0
valid_lft forever preferred_lft forever
#自定义网络
#创建my_net的桥接网络
[root@host1:~]#docker network create --driver bridge my_net
7342a6a014718ad595b71f2173e546cbcf0d67b3a6a662b5592fd51e1540894f
#可以查看创建的br-7342a6a01471
[root@host1:~]#brctl show
bridge name bridge id STP enabled interfaces
br-7342a6a01471 8000.024278ac213f no
docker0 8000.02426a0b9c15 no veth0294be2
#查看my_net的详细信息
[root@host1:~]#docker network inspect my_net
[
{
"Name": "my_net",
"Id": "7342a6a014718ad595b71f2173e546cbcf0d67b3a6a662b5592fd51e1540894f",
"Created": "2017-07-30T00:39:57.199683843-07:00",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": {},
"Config": [
{
"Subnet": "172.18.0.0/16",
"Gateway": "172.18.0.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {},
"Labels": {}
}
]
#指定子网和网关的的bridge：my_net2
[root@host1:~]#docker network create --driver bridge --subnet 172.22.16.0/24 --gateway 172.22.16.1 my_net2
#创建容器时可以指定网络和ip地址，ip地址需要在此网络中，不能只单独指定IP
#IP不在此子网中
[root@host1:~]#docker run -d --network my_net --ip 172.22.16.2 busybox
82924b593ed13028f60bef65e6fd796e3e4cb47f163f650302a73246328ec201
docker: Error response from daemon: user specified IP address is supported only when connecting to networks with user configured subnets.
#OK的情况，既指定了网络也指定了IP
[root@host1:~]#docker run -d --network my_net2 --ip 172.22.16.2 busybox
3c7d600ab60f6b33bcc8c05adb241037c33d242c5ea00d2acd72908a3486211b
#容器间不同网段的通信是由防火墙的DROP规则实现的
[root@host1:~]#iptables-save
# Generated by iptables-save v1.6.0 on Sun Jul 30 02:13:54 2017
*nat
:PREROUTING ACCEPT [51:5969]
:INPUT ACCEPT [37:4065]
:OUTPUT ACCEPT [201:15938]
:POSTROUTING ACCEPT [199:15902]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.22.16.0/24 ! -o br-1040ac23396d -j MASQUERADE
-A POSTROUTING -s 172.18.0.0/16 ! -o br-7342a6a01471 -j MASQUERADE
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A DOCKER -i br-1040ac23396d -j RETURN
-A DOCKER -i br-7342a6a01471 -j RETURN
-A DOCKER -i docker0 -j RETURN
COMMIT
# Completed on Sun Jul 30 02:13:54 2017
# Generated by iptables-save v1.6.0 on Sun Jul 30 02:13:54 2017
*filter
:INPUT ACCEPT [3360:245776]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [2689:254929]
:DOCKER - [0:0]
:DOCKER-ISOLATION - [0:0]
:DOCKER-USER - [0:0]
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o br-1040ac23396d -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-1040ac23396d -j DOCKER
-A FORWARD -i br-1040ac23396d ! -o br-1040ac23396d -j ACCEPT
-A FORWARD -i br-1040ac23396d -o br-1040ac23396d -j ACCEPT
-A FORWARD -o br-7342a6a01471 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-7342a6a01471 -j DOCKER
-A FORWARD -i br-7342a6a01471 ! -o br-7342a6a01471 -j ACCEPT
-A FORWARD -i br-7342a6a01471 -o br-7342a6a01471 -j ACCEPT
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER-ISOLATION -i docker0 -o br-1040ac23396d -j DROP
-A DOCKER-ISOLATION -i br-1040ac23396d -o docker0 -j DROP
-A DOCKER-ISOLATION -i br-7342a6a01471 -o br-1040ac23396d -j DROP
-A DOCKER-ISOLATION -i br-1040ac23396d -o br-7342a6a01471 -j DROP
-A DOCKER-ISOLATION -i docker0 -o br-7342a6a01471 -j DROP
-A DOCKER-ISOLATION -i br-7342a6a01471 -o docker0 -j DROP
-A DOCKER-ISOLATION -j RETURN
-A DOCKER-USER -j RETURN
COMMIT
# Completed on Sun Jul 30 02:13:54 2017
#可以通过多块网卡实现容器间通信
[root@host1:~]#docker network connect my_net2 512cefa7565b
#容器间通信的三种方式
1）容器共有一个同属一个子网的网卡
2）在自定义网络中，可以通过DOCKER DNS SERVER 实现，即定义容器的名字
[root@host1:~]#docker run -it --network=my_net2 --name=bbox3 busybox
/ # ping bbox3
PING bbox3 (172.22.16.2): 56 data bytes
64 bytes from 172.22.16.2: seq=0 ttl=64 time=0.038 ms
^C
--- bbox3 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.038/0.038/0.038 ms
/ # ping bbox4
PING bbox4 (172.22.16.4): 56 data bytes
64 bytes from 172.22.16.4: seq=0 ttl=64 time=0.183 ms
^C
--- bbox4 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.183/0.183/0.183 ms
3）joined 容器之间可以通过 127.0.0.1 直接通信 --network=container:bbox4
#不同容器中的程序希望通过 loopback 高效快速地通信，比如 web server 与 app server。
[root@host1:~]#docker run -it --network=container:bbox4 busybox
/ # ping bbox4
PING bbox4 (172.22.16.4): 56 data bytes
64 bytes from 172.22.16.4: seq=0 ttl=64 time=0.037 ms
64 bytes from 172.22.16.4: seq=1 ttl=64 time=0.144 ms
^C
--- bbox4 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.037/0.090/0.144 ms
#容器如何访问外网
busybox 发送 ping 包：172.17.0.2 > www.bing.com
docker0 收到包，发现是发送到外网的，交给 NAT 处理
NAT 将源地址换成 enp0s3 的 IP：10.0.2.15 > www.bing.com。
ping 包从 enp0s3 发送出去，到达 www.bing.com。
#外部世界如何访问容器
A：端口映射 -p参数
总结：
1）首先学习了 Docker 的三种网络：none, host 和 bridge 并讨论了它们的不同使用场景；
2）然后我们实践了创建自定义网络；
3）最后详细讨论了如何实现容器与容器之间，容器与外部网络之间的通信。
