docker网络：原生网络、自定义网络、容器通信、跨主机网络

一、 认识docker原生网络

1. bridge

容器和外界的通信：
container — docker0 —eth0 —外界

docker0和eth0直接通过内核路由功能 net.ipv4.ip_forward = 1

docker network ls 查看docker上有哪些网络模式

docker rm -fdocker ps -aq` 删除所有的容器

2. host

docker run -d --name nginx --network host nginx 指定容器的网络模型

host 和宿主机共享网络 缺点：资源竞争

3. none

docker run -d --name nginx --network none busybox 

–network none 表示容器内禁用网络的意思

二、 dokcker自定义网络

1. 创建自定义网桥

[[e-mail] ~]# docker network create -d bridge mynet1
c740f469fc4fe6388b3c8c724253660081e2850cf4aa762c0018ce67b7cb5fc6

[[e-mail] ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
af1f2d72b38b        bridge              bridge              local
04c9c9355a17        harbor_harbor       bridge              local
b74354eca92c        host                host                local
c740f469fc4f        mynet1              bridge              local
b88b514e0f2d        none                null                local

在容器中使用创建的网络

[[e-mail] ~]# docker run -it --name demo --network mynet1 busybox

[[e-mail] ~]# docker network rm mynet1 删除自定义网络

创建网络指定子网 和 网关

docker network create --subnet 192.168.1.0/24 --geteway 192.168.1.1 mynet1
执行ip创建容器（前提时指定了上面的子网和网关）
docker run -it --name vm2 --network mynet1 --ip 192.168.1.10 busybox

三、 docker容器通信

1. joined

joined时容器之间共用网络栈

2. link

link的缺点是：当仓库的分配的地址发生变化时，再次开启仓库时env数据没有随时更改

3. 容器访问外网是通过iptables的SNAT实现的

1. 容器发送数据包到外网时，通过地址伪装
   查看iptables -t nat -nL
   在postrouting中进行伪装

[[e-mail] ~]# iptables -t nat -nL
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  172.17.0.0/16        0.0.0.0/0           

2. 外网访问容器
   
   (1) 端口映射

[[e-mail] ~]# docker run -d --name vm1 -p 80:80 nginx

[[e-mail] ~]# iptables -t nat -nL
Chain DOCKER (2 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:172.17.0.2:80

(2) host也可以

四、 跨主机容器网络

准备server1 server2 两个主机

在server1和server2各添加一个虚拟网卡（virtio）

[[e-mail] network-scripts]# cat ifcfg-eth1 
DEVICE=eth1
ONBOOT=yes
BOOTPROTO=none

[[e-mail] network-scripts]# ifup eth1 **网卡

[[e-mail] network-scripts]# cat ifcfg-eth1
DEVICE=eth1
BOOTPROTO=none
ONBOOT=yes

[[e-mail] network-scripts]# ifup eth1

[[e-mail] network-scripts]# ip link set eth1 promisc on  在eth1网卡上打开混杂模式(开启子接口，回有多个ip地址)
[[e-mail] network-scripts]# ip link set eth1 promisc on

在两台docker主机上创建macvlan网络

[[e-mail] ~]# docker network create -d macvlan --subnet 172.20.0.0/24 --gateway 172.20.0.1 -o parent=eth1 mynet1
d77df1686800c94c450762ba6422e2d8d37ae06af7ceb7b2b4ce436e1215bcef
[[e-mail] ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
af1f2d72b38b        bridge              bridge              local
b74354eca92c        host                host                local
d77df1686800        mynet1              macvlan             local
b88b514e0f2d        none                null                local

[[e-mail] ~]# docker run -it --rm --name vm1 --network mynet1 busybox
/ # ip addr 
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
53: [e-mail]: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:14:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.20.0.2/24 brd 172.20.0.255 scope global eth0
       valid_lft forever preferred_lft forever

[[e-mail] docker]# cat daemon.json 
{
  "registry-mirrors": ["https://qe6d82ah.mirror.aliyuncs.com"]
}
[[e-mail] docker]# systemctl daemon-reload 
[[e-mail] docker]# systemctl restart docker
[[e-mail] docker]# docker pull radial/busyboxplus
[[e-mail] ~]# docker tag radial/busyboxplus:latest busyboxplus

[[e-mail] ~]# docker network create -d macvlan --subnet 172.20.0.0/24 --gateway 172.20.0.1 -o parent=eth1 mynet1

[[e-mail] ~]# docker run -it --name vm2 --rm --network mynet1 --ip 172.20.0.100 busyboxplus
/ # ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
6: [e-mail]: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:14:00:64 brd ff:ff:ff:ff:ff:ff
    inet 172.20.0.100/24 brd 172.20.0.255 scope global eth0
       valid_lft forever preferred_lft forever
/ # ping 172.20.0.2
PING 172.20.0.2 (172.20.0.2): 56 data bytes
64 bytes from 172.20.0.2: seq=0 ttl=64 time=0.649 ms
64 bytes from 172.20.0.2: seq=1 ttl=64 time=0.302 ms

解决mac独占宿主机网卡
[[e-mail] ~]# docker network create -d macvlan --subnet 172.21.0.0/24 --gateway 172.21.0.1 -o parent=eth1.1 mynet2

五、总结