2020-05-24

容器技术之Docker网络

容器技术之Docker网络


默认情况下启动docker容器都是bridge网络,桥接到docker0桥;对于docker容器来讲,各个容器之间的网络上相互隔离的;相互隔离就表示在第一个容器里监听某个端口,对于第二个容器是不可见的;对于宿主机来讲,两个容器的网络都是共享docker0桥的网络;同时在宿主机上的网络名称空间中是可以看到两个容器的虚拟接口是连接到docker0桥的;所以默认情况启动的容器相互之间是可以基于docker0来通信;我们可以把docker0桥理解成连接两个容器的交换机;

  上一篇博客我们主要聊了下docker镜像相关的说明以及怎样基于现有镜像制作镜像、分发镜像到docker仓库中的相关测试;回顾请参考https://www.cnblogs.com/qiuhom-1874/p/12941508.html;今天我们来聊一聊docker的网络相关说明;

  在使用vm虚拟机时,我们知道一个虚拟机可以有三种虚拟网络接口,第一种网络是桥接网络,第二种是NAT网络,第三种是仅主机网络;这三种虚拟网络接口后面对应的都是一个个不同的虚拟网络;我们要想让虚拟机在那个网络中工作就把对应接口更换成那个接口即可;相对于docker来讲,docker内部也有三种虚拟网络接口,它们分别是bridge,host,none这三种;bridge是docker容器默认的网络类型,启动容器不指定网络时默认是bridge,该网络类型是桥接到宿主机的docker0桥上的,而docker0桥上一个NAT桥;host在docker里不是仅主机网络类型,它这里的意思是共享宿主机网络,即同宿主机共享同一网络名称空间;none表示空网络类型,在docker的网络中表现形式就是我们启动容器指定网络类型为none,在容器内部除了lo接口就没有别的其他网络接口,这意味着该容器网络只能自己和自己通信,有点类似vm里的仅主机网络;其实除了以上三种网络,docker也支持自定义网络;自定义网络就是可以创建网络名称空间,docker支持的网络类型有bridge host ipvlan macvlan null overlay;

  提示:以上这张图描述了两个容器的网络。默认情况下启动docker容器都是bridge网络,桥接到docker0桥;对于docker容器来讲,各个容器之间的网络上相互隔离的;相互隔离就表示在第一个容器里监听某个端口,对于第二个容器是不可见的;对于宿主机来讲,两个容器的网络都是共享docker0桥的网络;同时在宿主机上的网络名称空间中是可以看到两个容器的虚拟接口是连接到docker0桥的;所以默认情况启动的容器相互之间是可以基于docker0来通信;我们可以把docker0桥理解成连接两个容器的交换机;

  提示:可以看到宿主机上跑了两个容器,他们的虚拟网络接口都是链在docker0桥的;所以这两个容器是可以相互通信的;但是对于宿主机以外的主机,他俩是不可见;宿主机以外的主机上没法和这两个容器通信的,原因是docker是一个nat桥;如下所示

  提示:以上规则表示源地址为172.17.0.0/16并且不从docker0桥出去的报文,在通过POSTROUTING链时会做地址伪装(SNAT);从上面的信息我们就可以确定docker0桥就是一个nat桥;

  提示:以上图片展示了docker的三种网络,closed container这个容器只有一个lo接口,和其他容器相互隔离,只能自己和自己通信;bridged container这种桥接式网络容器,通常都会有两个接口,一个lo回环接口,一个连接至宿主机上的docker0桥的以太网接口;docker daemon 启动时默认会创建一个名为docker0的网络桥,并且创建的容器为桥接式容器(就是创建的容器的网络桥接至docker0上的)用docker运行容器时我们可以使用--net或--network来指定容器的网络,默认是--net bridage;docker0桥上一个nat桥,因此,桥接式容器可以通过自己的桥接口访问到外部网络,但是防火墙规则组织了一切从外部网络访问桥接式容器的请求;对于open container来讲其实就是共享宿主机的网络名称空间,相当于在网络这层资源上不和宿主机隔离;joined container 我们理解为联盟式网络容器;该容器的网络资源是链接到其他容器的网络资源;本质上就是多个容器共享一个网络空间;

  示例:bridge网络的容器创建

[root@node1 ~]# docker ps CONTAINER ID  IMAGE    COMMAND    CREATED    STATUS    PORTS    NAMES[root@node1 ~]# docker run --name web1 -d --net bridge linux1874/myimg:v0.1bced86e3dcb2e8144ade7cfc5b8c0dcfb5ee0af5e9d729904c7eb971d9c1117f[root@node1 ~]# docker run --name web2 -d --net bridge linux1874/myimg:v0.1 d39dea20d5ea0b52c42c67a8a9a36dcbc2ef78d654dfb9e1d88013306f2f5a50[root@node1 ~]# docker ps CONTAINER ID  IMAGE     COMMAND     CREATED    STATUS    PORTS    NAMESd39dea20d5ea  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 6 seconds ago  Up 5 seconds       web2bced86e3dcb2  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 11 seconds ago  Up 11 seconds       web1[root@node1 ~]# docker container inspect myweb1 -f {{.NetworkSettings.Networks.bridge.NetworkID}}Error: No such container: myweb1[root@node1 ~]# docker container inspect web1 -f {{.NetworkSettings.Networks.bridge.NetworkID}} 2ae9aa6566561e8f1f5c98f4877b34b29a14ed8dd645933926b0615e9e0b2567[root@node1 ~]# docker container inspect web2 -f {{.NetworkSettings.Networks.bridge.NetworkID}} 2ae9aa6566561e8f1f5c98f4877b34b29a14ed8dd645933926b0615e9e0b2567[root@node1 ~]# docker network lsNETWORK ID   NAME    DRIVER    SCOPE2ae9aa656656  bridge    bridge    local93347fb33d89  host    host    locala99b876eee4d  none    null    local[root@node1 ~]# docker container exec web1 ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever10: eth0@if11: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue  link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0  valid_lft forever preferred_lft forever[root@node1 ~]# docker container exec web2 ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever12: eth0@if13: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue  link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0  valid_lft forever preferred_lft forever[root@node1 ~]# docker container exec web2 wget -O - -q 172.17.0.2this test file[root@node1 ~]# docker container exec web1 wget -O - -q 172.17.0.3this test file

  提示:桥接式网络的容器间是可以通过docker0桥来通信;我们可以理解为同一桥上的网络为一个网络,他们的网络ID都是相同;上面两个容器的网络ID都是bridge的ID;

  示例:none网络容器的创建

[root@node1 ~]# docker ps CONTAINER ID  IMAGE     COMMAND     CREATED    STATUS    PORTS    NAMESd39dea20d5ea  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 8 minutes ago  Up 8 minutes       web2bced86e3dcb2  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 9 minutes ago  Up 9 minutes       web1[root@node1 ~]# docker run --name web3 -d --net none linux1874/myimg:v0.1a0039645d551ef7089d7ff0e588864da48c68a0b301e28728e48d0b520a006ba[root@node1 ~]# docker container inspect web3 -f {{.NetworkSettings.Networks.none.NetworkID}} a99b876eee4d028f6d6410749ac863915711482e6f55aaf38071aabaae53ee2e[root@node1 ~]# docker network lsNETWORK ID   NAME    DRIVER    SCOPE2ae9aa656656  bridge    bridge    local93347fb33d89  host    host    locala99b876eee4d  none    null    local[root@node1 ~]# docker container exec web3 ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever[root@node1 ~]# 

  提示:可以看到none网络的容器网络ID是none的网络ID相同,内部也只有一个lo接口;

  示例:共享式网络容器的创建

[root@node1 ~]# docker ps CONTAINER ID  IMAGE     COMMAND     CREATED    STATUS    PORTS    NAMESa0039645d551  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 2 minutes ago  Up 2 minutes       web3d39dea20d5ea  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 12 minutes ago  Up 12 minutes       web2bced86e3dcb2  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 12 minutes ago  Up 12 minutes       web1[root@node1 ~]# docker run --name web4 -d --net host linux1874/myimg:v0.1f2dc3d0bb6992b6f0f93b3db50d952574c45473911a7133b735ae1b633855962[root@node1 ~]# docker container inspect web4 -f {{.NetworkSettings.Networks.host.NetworkID}} 93347fb33d89a5abd7781ab1a01b51ad46dde4b2409b88d3d5f2e4a7bd0aed2e[root@node1 ~]# docker network lsNETWORK ID   NAME    DRIVER    SCOPE2ae9aa656656  bridge    bridge    local93347fb33d89  host    host    locala99b876eee4d  none    null    local[root@node1 ~]# docker container exec ip aError: No such container: ip[root@node1 ~]# docker container exec web4 ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever inet6 ::1/128 scope host  valid_lft forever preferred_lft forever2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:0c:29:2e:06:0b brd ff:ff:ff:ff:ff:ff inet 192.168.0.31/24 brd 192.168.0.255 scope global ens33  valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe2e:60b/64 scope link  valid_lft forever preferred_lft forever3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue  link/ether 02:42:63:bb:cd:b4 brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0  valid_lft forever preferred_lft forever inet6 fe80::42:63ff:febb:cdb4/64 scope link  valid_lft forever preferred_lft forever11: vethffac5a0@if10: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue master docker0  link/ether 82:b0:23:49:92:de brd ff:ff:ff:ff:ff:ff inet6 fe80::80b0:23ff:fe49:92de/64 scope link  valid_lft forever preferred_lft forever13: veth9e7a8c4@if12: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue master docker0  link/ether a6:d3:a2:c9:9f:45 brd ff:ff:ff:ff:ff:ff inet6 fe80::a4d3:a2ff:fec9:9f45/64 scope link  valid_lft forever preferred_lft forever[root@node1 ~]# docker container exec web4 hostnamenode1[root@node1 ~]# hostnamenode1[root@node1 ~]# 

  提示:host网络是共享宿主机的网络名称空间,所以我们在容器内部看到的网络接口同宿主机上的网络接口一样;

  示例:联盟式网络容器创建

[root@node1 ~]# docker imagesREPOSITORY   TAG     IMAGE ID   CREATED    SIZElinux1874/myimg  v0.1    e408b1c6e04f  29 hours ago  1.22MBbusybox    latest    78096d0a5478  10 days ago   1.22MBcentos    7     b5b4d78bc90c  2 weeks ago   203MBnginx    stable-alpine  ab94f84cc474  4 weeks ago   21.3MB[root@node1 ~]# docker run --name b1 --net container:web4 -it busybox/ # [root@node1 ~]# docker ps CONTAINER ID  IMAGE     COMMAND     CREATED    STATUS    PORTS    NAMES2b7517adb2ad  busybox    "sh"      13 seconds ago  Up 13 seconds       b1f2dc3d0bb699  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 22 minutes ago  Up 22 minutes       web4a0039645d551  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 27 minutes ago  Up 27 minutes       web3d39dea20d5ea  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 36 minutes ago  Up 36 minutes       web2bced86e3dcb2  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 36 minutes ago  Up 36 minutes       web1[root@node1 ~]# docker container exec b1 ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever inet6 ::1/128 scope host  valid_lft forever preferred_lft forever2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:0c:29:2e:06:0b brd ff:ff:ff:ff:ff:ff inet 192.168.0.31/24 brd 192.168.0.255 scope global ens33  valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe2e:60b/64 scope link  valid_lft forever preferred_lft forever3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue  link/ether 02:42:63:bb:cd:b4 brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0  valid_lft forever preferred_lft forever inet6 fe80::42:63ff:febb:cdb4/64 scope link  valid_lft forever preferred_lft forever11: vethffac5a0@if10: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue master docker0  link/ether 82:b0:23:49:92:de brd ff:ff:ff:ff:ff:ff inet6 fe80::80b0:23ff:fe49:92de/64 scope link  valid_lft forever preferred_lft forever13: veth9e7a8c4@if12: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue master docker0  link/ether a6:d3:a2:c9:9f:45 brd ff:ff:ff:ff:ff:ff inet6 fe80::a4d3:a2ff:fec9:9f45/64 scope link  valid_lft forever preferred_lft forever

  提示:运行bubybox容器要注意容器前台跑什么程序,如果前台没有跑程序,容器一启动就会处于退出状态;我上面是先交互式运行/bin/sh,然后在用ctrl+p松开,然后再按ctrl+q两个组合键来剥离当前终端,使得b1容器运行起来;从上面的信息来看,我们把b1容器的网络加入到web4容器的网络,b1和web4就都处于同一网络名称空间;web4是共享宿主机网络名称空间,所以b1的网络里也是能够看到宿主机上的网络接口的;

[root@node1 ~]# docker psCONTAINER ID  IMAGE     COMMAND     CREATED    STATUS    PORTS    NAMES2b7517adb2ad  busybox    "sh"      15 minutes ago  Up 15 minutes       b1f2dc3d0bb699  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 38 minutes ago  Up 38 minutes       web4a0039645d551  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 42 minutes ago  Up 42 minutes       web3d39dea20d5ea  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 52 minutes ago  Up 52 minutes       web2bced86e3dcb2  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 52 minutes ago  Up 52 minutes       web1[root@node1 ~]# ss -tnlState  Recv-Q Send-Q          Local Address:Port              Peer Address:Port    LISTEN  0  128              *:22                 *:*     LISTEN  0  100            127.0.0.1:25                 *:*     LISTEN  0  9              :::80                 :::*     LISTEN  0  128              :::22                 :::*     LISTEN  0  100              ::1:25                 :::*     [root@node1 ~]# docker attach b1/ # netstat -tnlActive Internet connections (only servers)Proto Recv-Q Send-Q Local Address   Foreign Address   State  tcp  0  0 0.0.0.0:22    0.0.0.0:*    LISTEN  tcp  0  0 127.0.0.1:25   0.0.0.0:*    LISTEN  tcp  0  0 :::80     :::*     LISTEN  tcp  0  0 :::22     :::*     LISTEN  tcp  0  0 ::1:25     :::*     LISTEN  / # read escape sequence[root@node1 ~]# docker container exec -it web4 /bin/sh/ # netstat -ntlActive Internet connections (only servers)Proto Recv-Q Send-Q Local Address   Foreign Address   State  tcp  0  0 0.0.0.0:22    0.0.0.0:*    LISTEN  tcp  0  0 127.0.0.1:25   0.0.0.0:*    LISTEN  tcp  0  0 :::80     :::*     LISTEN  tcp  0  0 :::22     :::*     LISTEN  tcp  0  0 ::1:25     :::*     LISTEN  / # exit[root@node1 ~]# 

  提示:b1和web4和宿主机都处于同一网络名称空间,在web4上监听的80,在宿主机和b1上是能够看到的,同时宿主机上监听的其他端口,在b1和web4上也能够看到;进入剥离的终端容器,需要用docker attach 命令进入;这样一来我们就可以通过访问宿主机的80端口访问到容器内部的服务;也可以通过访问b1主机的lo接口访问到web4上的服务

[root@node1 ~]# docker attach b1/ # ps auxPID USER  TIME COMMAND 1 root  0:00 sh 14 root  0:00 ps aux/ # wget -O - -q test file/ # read escape sequence[root@node1 ~]# 

  提示:虽然通过lo接口可以访问到web4上的服务,但他们的其他资源还是相互隔离的,只是网络名称空间是共享的同一个;

  除此以外,我们在运行容器时还可以通过docker run 的一些选项来注入一些信息到容器内部

  示例:注入hostname到容器内部

[root@node1 ~]# docker run --name web01 -it --rm --net bridge --hostname www.ilinux.io linux1874/myimg:v0.1 /bin/sh     / # hostnamewww.ilinux.io/ # exit[root@node1 ~]# 

提示:可以看到在容器内部主机名就是我们运行容器时给定的主机名;--rm表示退出容器时删除容器;-d 和--rm不能同时使用,这两个选项是相互排斥的;

  示例:从外部指定hostname与主机地址解析列表

[root@node1 ~]# docker run --name web01 -it --rm --net bridge --hostname www.ilinux.io --add-host www.test.com:1.1.1.1 --add-host www.test2.com:2.2.2.2 linux1874/myimg:v0.1 /bin/sh/ # cat /etc/hosts127.0.0.1  localhost::1  localhost ip6-localhost ip6-loopbackfe00::0 ip6-localnetff00::0 ip6-mcastprefixff02::1 ip6-allnodesff02::2 ip6-allrouters1.1.1.1 www.test.com2.2.2.2 www.test2.com172.17.0.4  www.ilinux.io www/ # exit[root@node1 ~]# 

  提示:--add-host选项可以重复使用很多次;应用场景,如果多容器间通信需要用到解析主机名的方式,那么我们就需要用到注入主机名到主机的解析;

  示例:注入dns服务器地址到容器

[root@node1 ~]# docker run --name web01 -it --rm --net bridge --hostname www.ilinux.io --add-host www.test.com:1.1.1.1 --add-host www.test2.com:2.2.2.2 --dns 3.3.3.3 --dns 4.4.4.4 linux1874/myimg:v0.1 /bin/sh / # cat /etc/resolv.conf nameserver 3.3.3.3nameserver 4.4.4.4/ # exit[root@node1 ~]# 

  提示:--dns表示指定dns服务器地址;该选项也可同时使用多次用来指定多个dns服务器地址;

  示例:注入dns search

[root@node1 ~]# docker run --name web01 -it --rm --net bridge --hostname www.ilinux.io --add-host www.test.com:1.1.1.1 --add-host www.test2.com:2.2.2.2 --dns 3.3.3.3 --dns 4.4.4.4 --dns-search test.com --dns-search test2.com linux1874/myimg:v0.1 /bin/sh/ # cat /etc/resolv.conf search test.com test2.comnameserver 3.3.3.3nameserver 4.4.4.4/ # exit[root@node1 ~]# 

  提示:--dns-search 选项表示指定dns search;该选项也可同时使用多次,用来指定多个dns search;

  示例:注入ip地址为容器ip地址

[root@node1 ~]# docker run --name web01 -it --rm --net bridge --hostname www.ilinux.io --add-host www.test.com:1.1.1.1 --add-host www.test2.com:2.2.2.2 --dns 3.3.3.3 --dns 4.4.4.4 --dns-search test.com --dns-search test2.com --ip 172.17.0.20 linux1874/myimg:v0.1 /bin/shdocker: Error response from daemon: user specified IP address is supported on user defined networks only.[root@node1 ~]# docker network lsNETWORK ID   NAME    DRIVER    SCOPE2ae9aa656656  bridge    bridge    local93347fb33d89  host    host    locala99b876eee4d  none    null    local[root@node1 ~]# docker network create --subnet 10.0.0.0/24 mynete80b4e4cc6e9f2c772797c27b0cd81b93cc874e0ffbc5cc2ea2d3a1d9d5530fb[root@node1 ~]# docker network lsNETWORK ID   NAME    DRIVER    SCOPE2ae9aa656656  bridge    bridge    local93347fb33d89  host    host    locale80b4e4cc6e9  mynet    bridge    locala99b876eee4d  none    null    local[root@node1 ~]# docker run --name web01 -it --rm --net mynet --hostname www.ilinux.io --add-host www.test.com:1.1.1.1 --add-host www.test2.com:2.2.2.2 --dns 3.3.3.3 --dns 4.4.4.4 --dns-search test.com --dns-search test2.com --ip 10.0.0.200 linux1874/myimg:v0.1 /bin/sh     / # ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever29: eth0@if30: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue  link/ether 02:42:0a:00:00:c8 brd ff:ff:ff:ff:ff:ff inet 10.0.0.200/24 brd 10.0.0.255 scope global eth0  valid_lft forever preferred_lft forever/ # exit[root@node1 ~]#

  提示:docker 默认情况是不支持启动容器指定ip地址的,指定ip地址只允许在自定义网络上指定;所以要想给容器指定ip地址,首先要自己创建一个网络名称空间;运行容器时通过--net或--network指定网络,然后在指定IP地址就没有问题了;

  示例:给容器连接多个网络

[root@node1 ~]# docker run --name web1 -it --rm --network bridge linux1874/myimg:v0.1 /bin/sh/ # ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever52: eth0@if53: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue  link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0  valid_lft forever preferred_lft forever/ # [root@node1 ~]# docker network lsNETWORK ID   NAME    DRIVER    SCOPE03e2689873d0  bridge    bridge    local93347fb33d89  host    host    locale80b4e4cc6e9  mynet    bridge    locala99b876eee4d  none    null    local[root@node1 ~]# docker network connect mynet web1[root@node1 ~]# docker attach web1/ # ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever52: eth0@if53: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue  link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0  valid_lft forever preferred_lft forever54: eth1@if55: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue  link/ether 02:42:0a:00:00:02 brd ff:ff:ff:ff:ff:ff inet 10.0.0.2/24 brd 10.0.0.255 scope global eth1  valid_lft forever preferred_lft forever/ # 

  提示:docker nerwork connect 类似给容器添加一块网络,然后将容器里的网卡连接至我们指定的网络;

  端口暴露

  通常情况下我们运行docker容器都是使用的bridge网络,只有特殊场景才会用到自定义网络和其他网络;使用bridge网络有一个问题就是容器里的服务怎么让外界的主机访问到呢?首先要让外部访问到容器内部的网络,这一层是不太可能了,原因是docker0桥是一个nat桥,它只可让内部容器访问外部主机,不可用外部主机访问内部容器;如果要访问,我们需要修改iptables的规则,很麻烦;除此之外还可以在宿主机上搭建一个反向代理,外部通过访问代理,然后代理访问容器内部服务,这样的方式可行,但通常不这么做;除此之外就只有把容器里跑的服务端口映射到宿主机上某端口,外部通过访问宿主机的某端口,通过iptables规则做DNAT;通过端口映射到方式让外部主机可以访问到容器内部的服务;其实docker container run这个命令有一个-p的选项就是用来做这个事的;我们用-p选项来指定把宿主机的那个ip或端口映射到容器的某个ip或端口上;它的原理就是通过修改宿主机的iptables规则,做DNAT实现的;

  示例:将容器80端口映射至宿主机某动态端口

[root@node1 ~]# docker run --name web01 -d -p 80 linux1874/myimg:v0.1 7dd827a920f07badc79911120aa9fee5dc74d8d9959f554ac9c19d911befd31c[root@node1 ~]# docker container port web0180/tcp -> 0.0.0.0:32768[root@node1 ~]# iptables -t nat -nvLChain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target  prot opt in  out  source    destination   11 852 DOCKER  all -- *  *  0.0.0.0/0   0.0.0.0/0   ADDRTYPE match dst-type LOCALChain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target  prot opt in  out  source    destination   Chain OUTPUT (policy ACCEPT 1 packets, 76 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 DOCKER  all -- *  *  0.0.0.0/0   !127.0.0.0/8   ADDRTYPE match dst-type LOCALChain POSTROUTING (policy ACCEPT 1 packets, 76 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 MASQUERADE all -- *  !br-e80b4e4cc6e9 10.0.0.0/24   0.0.0.0/0    6 379 MASQUERADE all -- *  !docker0 172.17.0.0/16  0.0.0.0/0    0  0 MASQUERADE tcp -- *  *  172.17.0.4   172.17.0.4   tcp dpt:80Chain DOCKER (2 references) pkts bytes target  prot opt in  out  source    destination    0  0 RETURN  all -- br-e80b4e4cc6e9 *  0.0.0.0/0   0.0.0.0/0    0  0 RETURN  all -- docker0 *  0.0.0.0/0   0.0.0.0/0    0  0 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32768 to:172.17.0.4:80[root@node1 ~]# 

  提示:-p 指定容器里服务的端口,表示把容器的该端口映射到宿主机上的一个随机端口,通常这个随机端口是从32768开始;从上面的接口可以看到我们把80端口映射到宿主机上的32768端口上,随之docker会在宿主机的iptables的nat表上添加一条DNAT规则;现在我们就可以通过访问宿主机的32768端口来访问容器内部的服务;通常我们不建议把容器里的服务随机映射到宿主机上的一个端口;原因是客户端不知道随机端口后面的服务是什么,当然访问也就受限;

  测试:访问宿主机的32768端口看看是否能够访问到容器内部的web服务?

[root@docker_node1 ~]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever inet6 ::1/128 scope host  valid_lft forever preferred_lft forever2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:22:36:7f brd ff:ff:ff:ff:ff:ff inet 192.168.0.22/24 brd 192.168.0.255 scope global ens33  valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe22:367f/64 scope link  valid_lft forever preferred_lft forever3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN  link/ether 02:42:72:cb:66:6d brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0  valid_lft forever preferred_lft forever[root@docker_node1 ~]# curl 192.168.0.31:32768this test file[root@docker_node1 ~]# 

  示例:将容器端口映射到指定主机端口

[root@node1 ~]# docker run --name web02 -d --net bridge -p 80:80 linux1874/myimg:v0.1351ed7833aa1908c43abc061f5acdc7bd5e083ea097b26c1f4d4a7422bfbfcfa[root@node1 ~]# docker container port web0280/tcp -> 0.0.0.0:80[root@node1 ~]# docker ps CONTAINER ID  IMAGE     COMMAND     CREATED    STATUS    PORTS     NAMES351ed7833aa1  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 23 seconds ago  Up 21 seconds  0.0.0.0:80->80/tcp  web027dd827a920f0  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 10 minutes ago  Up 10 minutes  0.0.0.0:32768->80/tcp web01[root@node1 ~]# ss -tnlState  Recv-Q Send-Q          Local Address:Port              Peer Address:Port    LISTEN  0  128              *:22                 *:*     LISTEN  0  100            127.0.0.1:25                 *:*     LISTEN  0  128              :::80                 :::*     LISTEN  0  128              :::22                 :::*     LISTEN  0  100              ::1:25                 :::*     LISTEN  0  128              :::32768                :::*     [root@node1 ~]# iptables -t nat -nvLChain PREROUTING (policy ACCEPT 2 packets, 466 bytes) pkts bytes target  prot opt in  out  source    destination   12 912 DOCKER  all -- *  *  0.0.0.0/0   0.0.0.0/0   ADDRTYPE match dst-type LOCALChain INPUT (policy ACCEPT 2 packets, 466 bytes) pkts bytes target  prot opt in  out  source    destination   Chain OUTPUT (policy ACCEPT 1 packets, 76 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 DOCKER  all -- *  *  0.0.0.0/0   !127.0.0.0/8   ADDRTYPE match dst-type LOCALChain POSTROUTING (policy ACCEPT 1 packets, 76 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 MASQUERADE all -- *  !br-e80b4e4cc6e9 10.0.0.0/24   0.0.0.0/0    6 379 MASQUERADE all -- *  !docker0 172.17.0.0/16  0.0.0.0/0    0  0 MASQUERADE tcp -- *  *  172.17.0.4   172.17.0.4   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.2   172.17.0.2   tcp dpt:80Chain DOCKER (2 references) pkts bytes target  prot opt in  out  source    destination    0  0 RETURN  all -- br-e80b4e4cc6e9 *  0.0.0.0/0   0.0.0.0/0    0  0 RETURN  all -- docker0 *  0.0.0.0/0   0.0.0.0/0    1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32768 to:172.17.0.4:80 0  0 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:80 to:172.17.0.2:80[root@node1 ~]#

  提示:可以看到我们指定把容器的80端口映射到宿主机的80端口,宿主机上的80端口就处于监听状态了;同时iptables的nat表上又生成了一条新的DNT规则;

  测试:通过其他主机访问宿主机上的80看看是否能够访问到容器里的80服务?

[root@docker_node1 ~]# ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever inet6 ::1/128 scope host  valid_lft forever preferred_lft forever2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:22:36:7f brd ff:ff:ff:ff:ff:ff inet 192.168.0.22/24 brd 192.168.0.255 scope global ens33  valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe22:367f/64 scope link  valid_lft forever preferred_lft forever3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN  link/ether 02:42:72:cb:66:6d brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0  valid_lft forever preferred_lft forever[root@docker_node1 ~]# curl 192.168.0.31this test file[root@docker_node1 ~]# 

  示例:将指定的容器端口映射到宿主机的指定ip上的动态端口

[root@node1 ~]# docker run --name web03 -d --net bridge -p 192.168.0.214::80 linux1874/myimg:v0.1b4276ea0d0c0265a608b8111d64655a8667871f1b19cf971b42921a9a464c020[root@node1 ~]# docker container port web0380/tcp -> 192.168.0.214:32769[root@node1 ~]# docker psCONTAINER ID  IMAGE     COMMAND     CREATED    STATUS    PORTS       NAMESb4276ea0d0c0  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 15 seconds ago  Up 15 seconds  192.168.0.214:32769->80/tcp web03351ed7833aa1  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 10 minutes ago  Up 10 minutes  0.0.0.0:80->80/tcp   web027dd827a920f0  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 20 minutes ago  Up 20 minutes  0.0.0.0:32768->80/tcp   web01[root@node1 ~]# ss -tnlState  Recv-Q Send-Q          Local Address:Port              Peer Address:Port    LISTEN  0  128              *:22                 *:*     LISTEN  0  100            127.0.0.1:25                 *:*     LISTEN  0  128           192.168.0.214:32769                 *:*     LISTEN  0  128              :::80                 :::*     LISTEN  0  128              :::22                 :::*     LISTEN  0  100              ::1:25                 :::*     LISTEN  0  128              :::32768                :::*     [root@node1 ~]# iptables -t nat -nvLChain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target  prot opt in  out  source    destination   15 1068 DOCKER  all -- *  *  0.0.0.0/0   0.0.0.0/0   ADDRTYPE match dst-type LOCALChain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target  prot opt in  out  source    destination   Chain OUTPUT (policy ACCEPT 2 packets, 152 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 DOCKER  all -- *  *  0.0.0.0/0   !127.0.0.0/8   ADDRTYPE match dst-type LOCALChain POSTROUTING (policy ACCEPT 2 packets, 152 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 MASQUERADE all -- *  !br-e80b4e4cc6e9 10.0.0.0/24   0.0.0.0/0    6 379 MASQUERADE all -- *  !docker0 172.17.0.0/16  0.0.0.0/0    0  0 MASQUERADE tcp -- *  *  172.17.0.4   172.17.0.4   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.2   172.17.0.2   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.3   172.17.0.3   tcp dpt:80Chain DOCKER (2 references) pkts bytes target  prot opt in  out  source    destination    0  0 RETURN  all -- br-e80b4e4cc6e9 *  0.0.0.0/0   0.0.0.0/0    0  0 RETURN  all -- docker0 *  0.0.0.0/0   0.0.0.0/0    1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32768 to:172.17.0.4:80 1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:80 to:172.17.0.2:80 0  0 DNAT  tcp -- !docker0 *  0.0.0.0/0   192.168.0.214  tcp dpt:32769 to:172.17.0.3:80[root@node1 ~]# 

  提示:可以看到宿主机上的192.168.0.214的32769处于监听状体;同时iptables的nat表示也新增了一条DNAT规则;

  测试:通过其他主机访问宿主机的192.168.0.214的32769端口,看看是否能够访问到容器内部的80服务?

[root@docker_node1 ~]# ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever inet6 ::1/128 scope host  valid_lft forever preferred_lft forever2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:22:36:7f brd ff:ff:ff:ff:ff:ff inet 192.168.0.22/24 brd 192.168.0.255 scope global ens33  valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe22:367f/64 scope link  valid_lft forever preferred_lft forever3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN  link/ether 02:42:72:cb:66:6d brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0  valid_lft forever preferred_lft forever[root@docker_node1 ~]# curl 192.168.0.214:32769this test file[root@docker_node1 ~]# 

  示例:将容器的端口映射至宿主机的指定ip的指定端口

[root@node1 ~]# docker run --name web04 -d --net bridge -p 192.168.0.214:81:80 linux1874/myimg:v0.11f58cd21b2c861b8761032a07d9e47d3bf1a2c072816d931918171ea38a9c090[root@node1 ~]# docker container port web0480/tcp -> 192.168.0.214:81[root@node1 ~]# docker psCONTAINER ID  IMAGE     COMMAND     CREATED    STATUS    PORTS       NAMES1f58cd21b2c8  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 19 seconds ago  Up 17 seconds  192.168.0.214:81->80/tcp  web04b4276ea0d0c0  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 7 minutes ago  Up 7 minutes  192.168.0.214:32769->80/tcp web03351ed7833aa1  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 17 minutes ago  Up 17 minutes  0.0.0.0:80->80/tcp   web027dd827a920f0  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 27 minutes ago  Up 27 minutes  0.0.0.0:32768->80/tcp   web01[root@node1 ~]# ss -tnlState  Recv-Q Send-Q          Local Address:Port              Peer Address:Port    LISTEN  0  128           192.168.0.214:81                 *:*     LISTEN  0  128              *:22                 *:*     LISTEN  0  100            127.0.0.1:25                 *:*     LISTEN  0  128           192.168.0.214:32769                 *:*     LISTEN  0  128              :::80                 :::*     LISTEN  0  128              :::22                 :::*     LISTEN  0  100              ::1:25                 :::*     LISTEN  0  128              :::32768                :::*     [root@node1 ~]# iptables -t nat -nvLChain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target  prot opt in  out  source    destination   16 1128 DOCKER  all -- *  *  0.0.0.0/0   0.0.0.0/0   ADDRTYPE match dst-type LOCALChain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target  prot opt in  out  source    destination   Chain OUTPUT (policy ACCEPT 1 packets, 76 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 DOCKER  all -- *  *  0.0.0.0/0   !127.0.0.0/8   ADDRTYPE match dst-type LOCALChain POSTROUTING (policy ACCEPT 1 packets, 76 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 MASQUERADE all -- *  !br-e80b4e4cc6e9 10.0.0.0/24   0.0.0.0/0    6 379 MASQUERADE all -- *  !docker0 172.17.0.0/16  0.0.0.0/0    0  0 MASQUERADE tcp -- *  *  172.17.0.4   172.17.0.4   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.2   172.17.0.2   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.3   172.17.0.3   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.5   172.17.0.5   tcp dpt:80Chain DOCKER (2 references) pkts bytes target  prot opt in  out  source    destination    0  0 RETURN  all -- br-e80b4e4cc6e9 *  0.0.0.0/0   0.0.0.0/0    0  0 RETURN  all -- docker0 *  0.0.0.0/0   0.0.0.0/0    1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32768 to:172.17.0.4:80 1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:80 to:172.17.0.2:80 1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   192.168.0.214  tcp dpt:32769 to:172.17.0.3:80 0  0 DNAT  tcp -- !docker0 *  0.0.0.0/0   192.168.0.214  tcp dpt:81 to:172.17.0.5:80[root@node1 ~]# 

  提示:可以看到宿主机上的81端口处于监听状态,同时iptables中的nat表也新加了一条DNAT规则;

  测试:用其他主机访问192.168.0.214的81端口看看是否能够访问到容器里80服务?

[root@docker_node1 ~]# ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo  valid_lft forever preferred_lft forever inet6 ::1/128 scope host  valid_lft forever preferred_lft forever2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:22:36:7f brd ff:ff:ff:ff:ff:ff inet 192.168.0.22/24 brd 192.168.0.255 scope global ens33  valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe22:367f/64 scope link  valid_lft forever preferred_lft forever3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN  link/ether 02:42:72:cb:66:6d brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0  valid_lft forever preferred_lft forever[root@docker_node1 ~]# curl 192.168.0.214:81this test file[root@docker_node1 ~]# 

  示例:将容器多个端口映射到宿主机

[root@node1 ~]# docker run --name web05 -d --net bridge -p 80 -p 443 linux1874/myimg:v0.1    898e99cf0f37104954913488717969584d35677a0660874a52a502934599caf7[root@node1 ~]# docker container port web05443/tcp -> 0.0.0.0:3277080/tcp -> 0.0.0.0:32771[root@node1 ~]# ss -ntlState  Recv-Q Send-Q          Local Address:Port              Peer Address:Port    LISTEN  0  128           192.168.0.214:81                 *:*     LISTEN  0  128              *:22                 *:*     LISTEN  0  100            127.0.0.1:25                 *:*     LISTEN  0  128           192.168.0.214:32769                 *:*     LISTEN  0  128              :::80                 :::*     LISTEN  0  128              :::22                 :::*     LISTEN  0  100              ::1:25                 :::*     LISTEN  0  128              :::32768                :::*     LISTEN  0  128              :::32770                :::*     LISTEN  0  128              :::32771                :::*     [root@node1 ~]# docker ps CONTAINER ID  IMAGE     COMMAND     CREATED    STATUS    PORTS           NAMES898e99cf0f37  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 31 seconds ago  Up 29 seconds  0.0.0.0:32771->80/tcp, 0.0.0.0:32770->443/tcp web051f58cd21b2c8  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 19 minutes ago  Up 19 minutes  192.168.0.214:81->80/tcp      web04b4276ea0d0c0  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 26 minutes ago  Up 26 minutes  192.168.0.214:32769->80/tcp      web03351ed7833aa1  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 35 minutes ago  Up 35 minutes  0.0.0.0:80->80/tcp        web027dd827a920f0  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 46 minutes ago  Up 46 minutes  0.0.0.0:32768->80/tcp       web01[root@node1 ~]# iptables -t nat -nvLChain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target  prot opt in  out  source    destination   17 1188 DOCKER  all -- *  *  0.0.0.0/0   0.0.0.0/0   ADDRTYPE match dst-type LOCALChain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target  prot opt in  out  source    destination   Chain OUTPUT (policy ACCEPT 3 packets, 228 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 DOCKER  all -- *  *  0.0.0.0/0   !127.0.0.0/8   ADDRTYPE match dst-type LOCALChain POSTROUTING (policy ACCEPT 3 packets, 228 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 MASQUERADE all -- *  !br-e80b4e4cc6e9 10.0.0.0/24   0.0.0.0/0    6 379 MASQUERADE all -- *  !docker0 172.17.0.0/16  0.0.0.0/0    0  0 MASQUERADE tcp -- *  *  172.17.0.4   172.17.0.4   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.2   172.17.0.2   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.3   172.17.0.3   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.5   172.17.0.5   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.6   172.17.0.6   tcp dpt:443 0  0 MASQUERADE tcp -- *  *  172.17.0.6   172.17.0.6   tcp dpt:80Chain DOCKER (2 references) pkts bytes target  prot opt in  out  source    destination    0  0 RETURN  all -- br-e80b4e4cc6e9 *  0.0.0.0/0   0.0.0.0/0    0  0 RETURN  all -- docker0 *  0.0.0.0/0   0.0.0.0/0    1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32768 to:172.17.0.4:80 1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:80 to:172.17.0.2:80 1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   192.168.0.214  tcp dpt:32769 to:172.17.0.3:80 1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   192.168.0.214  tcp dpt:81 to:172.17.0.5:80 0  0 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32770 to:172.17.0.6:443 0  0 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32771 to:172.17.0.6:80[root@node1 ~]#

  提示:-p选项可以使用多次,来指定需要映射端口和宿主机的端口映射关系;除此还可以使用-P(大写) 加--expose来指定要映射的端口

[root@node1 ~]# docker run --name web06 -d --net bridge -P --expose 80 --expose 443 linux1874/myimg:v0.1 b377f6d380828ece81d69fd83cf7678800466f45689850a7e47dde1619602ffa[root@node1 ~]# docker container port web06443/tcp -> 0.0.0.0:3277280/tcp -> 0.0.0.0:32773[root@node1 ~]# docker psCONTAINER ID  IMAGE     COMMAND     CREATED    STATUS    PORTS           NAMESb377f6d38082  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 19 seconds ago  Up 18 seconds  0.0.0.0:32773->80/tcp, 0.0.0.0:32772->443/tcp web06898e99cf0f37  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 3 minutes ago  Up 3 minutes  0.0.0.0:32771->80/tcp, 0.0.0.0:32770->443/tcp web051f58cd21b2c8  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 22 minutes ago  Up 22 minutes  192.168.0.214:81->80/tcp      web04b4276ea0d0c0  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 29 minutes ago  Up 29 minutes  192.168.0.214:32769->80/tcp      web03351ed7833aa1  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 39 minutes ago  Up 39 minutes  0.0.0.0:80->80/tcp        web027dd827a920f0  linux1874/myimg:v0.1 "/bin/sh -c '/bin/ht…" 49 minutes ago  Up 49 minutes  0.0.0.0:32768->80/tcp       web01[root@node1 ~]# ss -tnlState  Recv-Q Send-Q          Local Address:Port              Peer Address:Port    LISTEN  0  128           192.168.0.214:81                 *:*     LISTEN  0  128              *:22                 *:*     LISTEN  0  100            127.0.0.1:25                 *:*     LISTEN  0  128           192.168.0.214:32769                 *:*     LISTEN  0  128              :::80                 :::*     LISTEN  0  128              :::22                 :::*     LISTEN  0  100              ::1:25                 :::*     LISTEN  0  128              :::32768                :::*     LISTEN  0  128              :::32770                :::*     LISTEN  0  128              :::32771                :::*     LISTEN  0  128              :::32772                :::*     LISTEN  0  128              :::32773                :::*     [root@node1 ~]# iptables -t nat -nvLChain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target  prot opt in  out  source    destination   17 1188 DOCKER  all -- *  *  0.0.0.0/0   0.0.0.0/0   ADDRTYPE match dst-type LOCALChain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target  prot opt in  out  source    destination   Chain OUTPUT (policy ACCEPT 3 packets, 228 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 DOCKER  all -- *  *  0.0.0.0/0   !127.0.0.0/8   ADDRTYPE match dst-type LOCALChain POSTROUTING (policy ACCEPT 3 packets, 228 bytes) pkts bytes target  prot opt in  out  source    destination    0  0 MASQUERADE all -- *  !br-e80b4e4cc6e9 10.0.0.0/24   0.0.0.0/0    6 379 MASQUERADE all -- *  !docker0 172.17.0.0/16  0.0.0.0/0    0  0 MASQUERADE tcp -- *  *  172.17.0.4   172.17.0.4   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.2   172.17.0.2   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.3   172.17.0.3   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.5   172.17.0.5   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.6   172.17.0.6   tcp dpt:443 0  0 MASQUERADE tcp -- *  *  172.17.0.6   172.17.0.6   tcp dpt:80 0  0 MASQUERADE tcp -- *  *  172.17.0.7   172.17.0.7   tcp dpt:443 0  0 MASQUERADE tcp -- *  *  172.17.0.7   172.17.0.7   tcp dpt:80Chain DOCKER (2 references) pkts bytes target  prot opt in  out  source    destination    0  0 RETURN  all -- br-e80b4e4cc6e9 *  0.0.0.0/0   0.0.0.0/0    0  0 RETURN  all -- docker0 *  0.0.0.0/0   0.0.0.0/0    1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32768 to:172.17.0.4:80 1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:80 to:172.17.0.2:80 1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   192.168.0.214  tcp dpt:32769 to:172.17.0.3:80 1 60 DNAT  tcp -- !docker0 *  0.0.0.0/0   192.168.0.214  tcp dpt:81 to:172.17.0.5:80 0  0 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32770 to:172.17.0.6:443 0  0 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32771 to:172.17.0.6:80 0  0 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32772 to:172.17.0.7:443 0  0 DNAT  tcp -- !docker0 *  0.0.0.0/0   0.0.0.0/0   tcp dpt:32773 to:172.17.0.7:80[root@node1 ~]# 

  提示:使用-P(大写) --expose 的方式暴露端口,不可以选择暴露给宿主机的某个ip的某个端口或随机端口,只能暴露给宿主机的所有ip的随机端口;简单说就是不能指定固定宿主机的IP和端口;

  示例:修改docker0桥的网络属性

  提示:修改docker0桥的网络信息,我们需要在/etc/docker/daemon.json这个文件中添加一项bip来指定docker0桥的网络地址;这里需要注意一点的是如果这个文件没有内容我们直接用大括号加“bip”: "ip地址和子网掩码"即可,如果有其他项需要注意后面的逗号,如上所示;如果后续还有其他配置,需要在最后的一项后面加逗号,然后在添加其他配置;末尾可以不写逗号;其实这个文件中可以添加很多配置,对于配置docker0桥的属性也有很多,但核心配置选项就是bip,它主要是用来指定docker0桥的ip地址和子网掩码信息;其他的选项可以不用指定,它们都可以通过bip这个选项自动计算生成;有关/etc/docker/daemon.json文件的相关说明可以参考官方文档https://docs.docker.com/engine/reference/commandline/dockerd/#run-multiple-daemons;

 


No comments:

Post a Comment