065、容器在Weave中如何通信和隔离？（2019-04-08 周一）
在host2上执行如下命令：
weave launch host1_ip
必须在host2上指定host1的IP地址，这样host1和host2才能加入到同一个weave网络
然后在host2上运行容器 bbox3
eval $(weave env)
docker run --name bbox3 -itd busybox
进行weave网络下的跨主机通信测试
root@host2:~# weave launch 10.12.31.211
991ca22eb2ef47a48d64d5fbcad293756b47a4ff9fa54d4e54bed69f5fb691ba
root@host2:~# eval $(weave env)
root@host2:~# docker network ls
NETWORK ID NAME DRIVER SCOPE
19f77dcbd2e8 bridge bridge local
cf4c89650a1f host host local
39f1aab9f5b8 mac_net1 macvlan local
a90d23d941a9 mac_net10 macvlan local
d73128405403 mac_net20 macvlan local
2f7d79e0114d none null local
186591b0bb3c weave weavemesh local
root@host2:~# docker network inspect weave
[
{
"Name": "weave",
"Id": "186591b0bb3c0dca2062f736eb70126237ced4fee9de259561b7034c9a78e6b1",
"Created": "2019-04-08T14:49:03.190599122+08:00",
"Scope": "local",
"Driver": "weavemesh",
"EnableIPv6": false,
"IPAM": {
"Driver": "weavemesh",
"Options": null,
"Config": [
{
"Subnet": "10.32.0.0/12"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {
"works.weave.multicast": "true"
},
"Labels": {}
}
]
root@host2:~# docker run -itd --name bbox3 busybox
5df354fedabaac606215513a7d3fd6d1f76e7be61bcfc36dfbdcf4c25be689fd
root@host2:~# docker exec bbox3 ip r
default via 10.2.44.1 dev eth0
10.2.44.0/24 dev eth0 scope link src 10.2.44.2
10.32.0.0/12 dev ethwe scope link src 10.44.0.0
224.0.0.0/4 dev ethwe scope link
root@host2:~# docker exec bbox3 ping -c 2 bbox1
PING bbox1 (10.32.0.1): 56 data bytes
64 bytes from 10.32.0.1: seq=0 ttl=64 time=1.435 ms
64 bytes from 10.32.0.1: seq=1 ttl=64 time=0.422 ms
--- bbox1 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.422/0.928/1.435 ms
root@host2:~# docker exec bbox3 ping -c 2 bbox2
PING bbox2 (10.32.0.2): 56 data bytes
64 bytes from 10.32.0.2: seq=0 ttl=64 time=1.616 ms
64 bytes from 10.32.0.2: seq=1 ttl=64 time=0.551 ms
--- bbox2 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.551/1.083/1.616 ms
bbox1、bbox2、bbox3 的IP分别为 10.32.0.1/12 、10.32.0.2/12 、10.44.0.0/12 。这三个IP属于同一个subnet 10.32.0.0/12 。通过host1和host2之间的 vxlan隧道，三个容器逻辑上是在同一个lan中，所以就可以直接通信了。下面是bbox3 ping bbox1 的数据流向
weave网络隔离
默认情况下weave使用一个大的subnet，所有主机的容器都从这个地址空间中分配IP，因为同属一个subnet，容器可以直接通信。
如要实现网络隔离，可以通过环境变量 WEAVE_CIDR 为容器分配不同的subnet的IP
除了分配特定的subnet，还可以直接为容器指定IP地址 -e WEAVE_CIDR=net:10.32.2.9/24
root@host2:~# docker run -itd --name bbox4 -e WEAVE_CIDR=net:10.32.2.0/24 busybox
d791e8c55df9b1df37cf822d288034c8f6c988026995fc0fca0396c02d26124e
root@host2:~# docker exec bbox4 ip r
default via 10.2.44.1 dev eth0
10.2.44.0/24 dev eth0 scope link src 10.2.44.3
10.32.2.0/24 dev ethwe scope link src 10.32.2.128
224.0.0.0/4 dev ethwe scope link
root@host2:~# docker exec bbox4 ping -c 2 bbox3
PING bbox3 (10.44.0.0): 56 data bytes
--- bbox3 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
root@host2:~# docker exec bbox4 ping -c 2 bbox2
PING bbox2 (10.32.0.2): 56 data bytes
--- bbox2 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
root@host2:~# docker exec bbox4 ping -c 2 bbox1
PING bbox1 (10.32.0.1): 56 data bytes
--- bbox1 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
