Linux企业应用——Docker（五）之Docker网络

清除所有的不用的镜像、容器、数据卷、网络

dcoekr system prune

一、三种原生网络

[root@k8s2 harbor]# docker network ls
NETWORK ID     NAME      DRIVER    SCOPE
696489daaaf3   bridge    bridge    local
daf109ce4ab0   host      host      local
41928efc6031   none      null      local

1.bridge桥接模式

• bridge模式下容器没有一个公有ip，只有宿主机可以直接访问，外部主机
是不可见的。
• 容器通过宿主机的NAT规则后可以访问外网。

[root@k8s2 harbor]# docker run -it --rm busybox
/ # ip addr
1: lo: ,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
23: eth0@if24: ,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

yum install -y bridge-utils

docker安装时会创建一个名为 docker0 的Linux bridge，新建的容器
会自动桥接到这个接口。

[root@k8s2 harbor]# brctl show
bridge name     bridge id               STP enabled     interfaces
docker0         8000.02425d314189       no
[root@k8s2 harbor]# ip addr
1: lo: ,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: ,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:16:3e:09:e9:3a brd ff:ff:ff:ff:ff:ff
    inet 172.27.84.9/20 brd 172.27.95.255 scope global dynamic eth0
       valid_lft 315359423sec preferred_lft 315359423sec
3: docker0: ,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:5d:31:41:89 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever

防火墙策略查看

[root@k8s2 harbor]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (1 references)
target     prot opt source               destination

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

[root@k8s2 harbor]# docker run -d --name vm1 nginx
69935dabfb2a1f059b8ed97c7a2da1c58825a7bdc4edc84f79b2e55eff950d99
[root@k8s2 harbor]# docker ps
CONTAINER ID   IMAGE     COMMAND                  CREATED         STATUS         PORTS     NAMES
69935dabfb2a   nginx     "/docker-entrypoint.…"   4 seconds ago   Up 3 seconds   80/tcp    vm1
[root@k8s2 harbor]# docker inspect vm1|grep Pid
            "Pid": 11664,
            "PidMode": "",
            "PidsLimit": null,
[root@k8s2 harbor]# cd /proc/11664
[root@k8s2 11664]# ls
attr        cmdline          environ  io         mem         ns             pagemap      sched      stack    task
autogroup   comm             exe      limits     mountinfo   numa_maps      patch_state  schedstat  stat     timers
auxv        coredump_filter  fd       loginuid   mounts      oom_adj        personality  sessionid  statm    uid_map
cgroup      cpuset           fdinfo   map_files  mountstats  oom_score      projid_map   setgroups  status   wchan
clear_refs  cwd              gid_map  maps       net         oom_score_adj  root         smaps      syscall
[root@k8s2 11664]# cd ns/
[root@k8s2 ns]# ls
ipc  mnt  net  pid  user  uts

docker inspect vm1可查看vm1容器被分配到ip地址

宿主机可以直接访问，但其他主机不能访问

[root@k8s2 ns]# curl 172.17.0.2
<!DOCTYPE html>