自定义Docker网络

简介: 这篇文章介绍了如何使用Docker命令自定义网络,并通过创建和配置网络来实现容器间的通信。

作者:尹正杰
版权声明:原创作品,谢绝转载!否则将追究法律责任。

一.docker管理网络的命令

1>.查看docker network的帮助信息

[root@docker102.yinzhengjie.org.cn ~]# docker network --help

Usage:    docker network COMMAND

Manage networks

Commands:
  connect     Connect a container to a network
  create      Create a network
  disconnect  Disconnect a container from a network
  inspect     Display detailed information on one or more networks
  ls          List networks
  prune       Remove all unused networks
  rm          Remove one or more networks

Run 'docker network COMMAND --help' for more information on a command.
[root@docker102.yinzhengjie.org.cn ~]#

2>.查看已经存在的网卡信息

[root@docker102.yinzhengjie.org.cn ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
34d7483acce3        bridge              bridge              local
37f2cd930d53        host                host                local
4089feeb2359        none                null                local
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]#

3>.查看创建网卡命令的帮助信息

[root@docker102.yinzhengjie.org.cn ~]# docker network create --help

Usage:    docker network create [OPTIONS] NETWORK

Create a network

Options:
      --attachable           Enable manual container attachment
      --aux-address map      Auxiliary IPv4 or IPv6 addresses used by Network driver (default map[])
      --config-from string   The network from which copying the configuration
      --config-only          Create a configuration only network
  -d, --driver string        Driver to manage the Network (default "bridge")
      --gateway strings      IPv4 or IPv6 Gateway for the master subnet
      --ingress              Create swarm routing-mesh network
      --internal             Restrict external access to the network
      --ip-range strings     Allocate container ip from a sub-range
      --ipam-driver string   IP Address Management Driver (default "default")
      --ipam-opt map         Set IPAM driver specific options (default map[])
      --ipv6                 Enable IPv6 networking
      --label list           Set metadata on a network
  -o, --opt map              Set driver specific options (default map[])
      --scope string         Control the network's scope
      --subnet strings       Subnet in CIDR format that represents a network segment
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]#

二.自定义docker案例

1>.创建一个bridge模式的网络

[root@docker102.yinzhengjie.org.cn ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
34d7483acce3        bridge              bridge              local
37f2cd930d53        host                host                local
4089feeb2359        none                null                local
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# docker network create -d bridge --subnet 10.30.1.0/24 --gateway 10.30.1.254 yinzhengjie-net
ec32b69e252b7d84a87436f1bb6ae33e2711b98f952df0ad2dd7289a34645827
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
34d7483acce3        bridge              bridge              local
37f2cd930d53        host                host                local
4089feeb2359        none                null                local
ec32b69e252b        yinzhengjie-net     bridge              local
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]#

2>.基于咱们上一步自定义的网络启动一个容器并验证是否可以正常访问互联网

[root@docker102.yinzhengjie.org.cn ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
34d7483acce3        bridge              bridge              local
37f2cd930d53        host                host                local
4089feeb2359        none                null                local
ec32b69e252b        yinzhengjie-net     bridge              local
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# docker container run -it --network yinzhengjie-net --name myCentOS centos:centos7.6.1810 bash
[root@e56d37aa51a9 /]# 
[root@e56d37aa51a9 /]# yum -y install net-tools
[root@e56d37aa51a9 /]# 
[root@e56d37aa51a9 /]# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.30.1.1  netmask 255.255.255.0  broadcast 10.30.1.255
        ether 02:42:0a:1e:01:01  txqueuelen 0  (Ethernet)
        RX packets 2665  bytes 13320309 (12.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2425  bytes 133997 (130.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 66  bytes 5790 (5.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 66  bytes 5790 (5.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@e56d37aa51a9 /]# 
[root@e56d37aa51a9 /]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.30.1.254     0.0.0.0         UG    0      0        0 eth0
10.30.1.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0
[root@e56d37aa51a9 /]# 
[root@e56d37aa51a9 /]# ping www.baidu.com
PING www.a.shifen.com (111.206.223.173) 56(84) bytes of data.
64 bytes from 111.206.223.173 (111.206.223.173): icmp_seq=1 ttl=127 time=7.03 ms
64 bytes from 111.206.223.173 (111.206.223.173): icmp_seq=2 ttl=127 time=6.14 ms
64 bytes from 111.206.223.173 (111.206.223.173): icmp_seq=3 ttl=127 time=6.83 ms
^C
--- www.a.shifen.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 6.140/6.670/7.034/0.383 ms
[root@e56d37aa51a9 /]# 
[root@e56d37aa51a9 /]#

3>.再基于咱们自定义的网络启动一个容器并验证它们是否可以相互通信

[root@docker102.yinzhengjie.org.cn ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
34d7483acce3        bridge              bridge              local
37f2cd930d53        host                host                local
4089feeb2359        none                null                local
ec32b69e252b        yinzhengjie-net     bridge              local
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# docker container run -it --network yinzhengjie-net --name myCentOS2 centos:centos7.6.1810 bash 
[root@83a18f56cc14 /]# 
[root@83a18f56cc14 /]# hostname -i
10.30.1.2
[root@83a18f56cc14 /]# 
[root@83a18f56cc14 /]# ping 10.30.1.1
PING 10.30.1.1 (10.30.1.1) 56(84) bytes of data.
64 bytes from 10.30.1.1: icmp_seq=1 ttl=64 time=0.071 ms
64 bytes from 10.30.1.1: icmp_seq=2 ttl=64 time=0.097 ms
64 bytes from 10.30.1.1: icmp_seq=3 ttl=64 time=0.041 ms
64 bytes from 10.30.1.1: icmp_seq=4 ttl=64 time=0.037 ms
64 bytes from 10.30.1.1: icmp_seq=5 ttl=64 time=0.039 ms
64 bytes from 10.30.1.1: icmp_seq=6 ttl=64 time=0.052 ms

三.使自定义网络和默认的bridge网络互通

1>.默认情况下自定义的网络和默认的bridge网络是不互通的(如果想要它们相互通信就得修改iptables规则)

[root@docker102.yinzhengjie.org.cn ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
34d7483acce3        bridge              bridge              local
37f2cd930d53        host                host                local
4089feeb2359        none                null                local
ec32b69e252b        yinzhengjie-net     bridge              local
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# docker container run -it -p 8080:80 --network bridge --rm centos:centos7.6.1810 bash
[root@87b5dc93b45d /]# 
[root@87b5dc93b45d /]# hostname -i
10.200.0.1
[root@87b5dc93b45d /]# 
[root@87b5dc93b45d /]# ping 10.30.1.1
PING 10.30.1.1 (10.30.1.1) 56(84) bytes of data.

[root@docker102.yinzhengjie.org.cn ~]# docker container run -it -p 8080:80 --network bridge --rm centos:centos7.6.1810 bash

[root@docker102.yinzhengjie.org.cn ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
34d7483acce3        bridge              bridge              local
37f2cd930d53        host                host                local
4089feeb2359        none                null                local
ec32b69e252b        yinzhengjie-net     bridge              local
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# docker container run -it -p 80:80 --network yinzhengjie-net --rm centos:centos7.6.1810 bash
[root@ad24d400de75 /]# 
[root@ad24d400de75 /]# hostname -i
10.30.1.1
[root@ad24d400de75 /]# 
[root@ad24d400de75 /]# ping 10.200.0.1
PING 10.200.0.1 (10.200.0.1) 56(84) bytes of data.

[root@docker102.yinzhengjie.org.cn ~]# docker container run -it -p 80:80 --network yinzhengjie-net --rm centos:centos7.6.1810 bash

2>.修改iptables的规则

[root@docker102.yinzhengjie.org.cn ~]# iptables-save > iptables-rule.txt          #先将iptables的规则导出
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# vim iptables-rule.txt                  #编辑防火墙的规则,为了保险起见,将上图所示的两行代码注释掉,不推荐直接删除。
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# cat iptables-rule.txt 
# Generated by iptables-save v1.4.21 on Sun Feb  2 01:59:26 2020
*filter
:INPUT ACCEPT [390:27397]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [229:44673]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o br-ec32b69e252b -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-ec32b69e252b -j DOCKER
-A FORWARD -i br-ec32b69e252b ! -o br-ec32b69e252b -j ACCEPT
-A FORWARD -i br-ec32b69e252b -o br-ec32b69e252b -j ACCEPT
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -s 172.200.0.0/21 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i br-ec32b69e252b ! -o br-ec32b69e252b -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
#-A DOCKER-ISOLATION-STAGE-2 -o br-ec32b69e252b -j DROP
#-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
COMMIT
# Completed on Sun Feb  2 01:59:26 2020
# Generated by iptables-save v1.4.21 on Sun Feb  2 01:59:26 2020
*nat
:PREROUTING ACCEPT [3:208]
:INPUT ACCEPT [3:208]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 10.30.1.0/24 ! -o br-ec32b69e252b -j MASQUERADE
-A POSTROUTING -s 10.200.0.0/16 ! -o docker0 -j MASQUERADE
-A DOCKER -i br-ec32b69e252b -j RETURN
-A DOCKER -i docker0 -j RETURN
COMMIT
# Completed on Sun Feb  2 01:59:26 2020
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# iptables-restore < iptables-rule.txt         #再将修改后的iptables规则导入
[root@docker102.yinzhengjie.org.cn ~]#

3>.再次通过自定义的网络和默认的bridge网络启动容器验证容器是否互通

[root@docker102.yinzhengjie.org.cn ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
34d7483acce3        bridge              bridge              local
37f2cd930d53        host                host                local
4089feeb2359        none                null                local
ec32b69e252b        yinzhengjie-net     bridge              local
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# docker container run -it -p 8080:80 --network bridge --rm centos:centos7.6.1810 bash
[root@70da6a2cad6b /]# 
[root@70da6a2cad6b /]# hostname -i
10.200.0.1
[root@70da6a2cad6b /]# 
[root@70da6a2cad6b /]# ping 10.30.1.1
PING 10.30.1.1 (10.30.1.1) 56(84) bytes of data.
64 bytes from 10.30.1.1: icmp_seq=1 ttl=63 time=0.104 ms
64 bytes from 10.30.1.1: icmp_seq=2 ttl=63 time=0.057 ms
64 bytes from 10.30.1.1: icmp_seq=3 ttl=63 time=0.047 ms
64 bytes from 10.30.1.1: icmp_seq=4 ttl=63 time=0.052 ms
64 bytes from 10.30.1.1: icmp_seq=5 ttl=63 time=0.047 ms
64 bytes from 10.30.1.1: icmp_seq=6 ttl=63 time=0.052 ms
64 bytes from 10.30.1.1: icmp_seq=7 ttl=63 time=0.049 ms
64 bytes from 10.30.1.1: icmp_seq=8 ttl=63 time=0.053 ms
64 bytes from 10.30.1.1: icmp_seq=9 ttl=63 time=0.051 ms

[root@docker102.yinzhengjie.org.cn ~]# docker container run -it -p 8080:80 --network bridge --rm centos:centos7.6.1810 bash

[root@docker102.yinzhengjie.org.cn ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
34d7483acce3        bridge              bridge              local
37f2cd930d53        host                host                local
4089feeb2359        none                null                local
ec32b69e252b        yinzhengjie-net     bridge              local
[root@docker102.yinzhengjie.org.cn ~]# 
[root@docker102.yinzhengjie.org.cn ~]# docker container run -it -p 80:80 --network yinzhengjie-net --rm centos:centos7.6.1810 bash
[root@ec704cf0295c /]# 
[root@ec704cf0295c /]# hostname -i
10.30.1.1
[root@ec704cf0295c /]# 
[root@ec704cf0295c /]# ping 10.200.0.1
PING 10.200.0.1 (10.200.0.1) 56(84) bytes of data.
64 bytes from 10.200.0.1: icmp_seq=1 ttl=63 time=0.047 ms
64 bytes from 10.200.0.1: icmp_seq=2 ttl=63 time=0.048 ms
64 bytes from 10.200.0.1: icmp_seq=3 ttl=63 time=0.050 ms
64 bytes from 10.200.0.1: icmp_seq=4 ttl=63 time=0.049 ms
64 bytes from 10.200.0.1: icmp_seq=5 ttl=63 time=0.124 ms
64 bytes from 10.200.0.1: icmp_seq=6 ttl=63 time=0.051 ms
64 bytes from 10.200.0.1: icmp_seq=7 ttl=63 time=0.050 ms
64 bytes from 10.200.0.1: icmp_seq=8 ttl=63 time=0.072 ms
64 bytes from 10.200.0.1: icmp_seq=9 ttl=63 time=0.058 ms

[root@docker102.yinzhengjie.org.cn ~]# docker container run -it -p 80:80 --network yinzhengjie-net --rm centos:centos7.6.1810 bash

目录
相关文章
|
26天前
|
负载均衡 网络协议 开发者
掌握 Docker 网络:构建复杂的容器通信
在 Docker 容器化环境中,容器间的通信至关重要。本文详细介绍了 Docker 网络的基本概念和类型,包括桥接网络、宿主网络、覆盖网络和 Macvlan 网络等,并提供了创建、管理和配置自定义网络的实用命令。通过掌握这些知识,开发者可以构建更健壮和灵活的容器化应用,提高应用的可扩展性和安全性。
|
2月前
|
Kubernetes Devops 持续交付
DevOps实践:使用Docker和Kubernetes实现持续集成和部署网络安全的守护盾:加密技术与安全意识的重要性
【8月更文挑战第27天】本文将引导读者理解并应用DevOps的核心理念,通过Docker和Kubernetes的实战案例,深入探讨如何在现代软件开发中实现自动化的持续集成和部署。文章不仅提供理论知识,还结合真实示例,旨在帮助开发者提升效率,优化工作流程。
|
2天前
|
安全 NoSQL Redis
Docker自定义网络
Docker自定义网络
21 11
|
2天前
|
Linux 数据库 网络架构
Docker网络
Docker网络
26 10
|
1天前
|
Kubernetes 负载均衡 Docker
Docker 网络模型
【10月更文挑战第3天】
14 1
|
2天前
|
监控 Kubernetes 测试技术
掌握Docker网络模式:构建高效容器通信
【10月更文挑战第3天】本文深入探讨了Docker的网络模式,包括它们的工作原理、使用场景以及如何配置和优化容器间的通信。希望能够帮助开发者在项目中有效地应用Docker网络模式,构建高效的容器化应用。
|
6天前
|
Docker 容器
docker nginx-proxy 添加自定义https网站
docker nginx-proxy 添加自定义https网站
17 4
|
19天前
|
jenkins 持续交付 Docker
docker之自定义制作镜像(python程序)
docker之自定义制作镜像(python程序)
|
1月前
|
NoSQL 应用服务中间件 Redis
Docker跨宿主机容器通信-通过网络跨宿主机互联
这篇文章介绍了Docker容器跨宿主机通信的实现方法,包括Docker的四种网络模式(host、none、container、bridge)以及如何通过修改网络配置和添加路由规则来实现不同宿主机上的容器之间的互联。
112 0
Docker跨宿主机容器通信-通过网络跨宿主机互联
|
1月前
|
Kubernetes 安全 Docker