docker容器网络配置

Linux内核实现名称空间的创建 ip netns命令

可以借助ip netns命令来完成对 Network Namespace 的各种操作。ip netns命令来自于iproute安装包，一般系统会默认安装，如果没有的话，请自行安装

[root@localhost ~]# rpm -qa|grep iproute
iproute-5.12.0-4.el8.x86_64
[root@localhost ~]# systemctl stop docker
Warning: Stopping docker.service, but it can still be activated by:
  docker.socket
[root@localhost ~]# systemctl status docker
● docker.service - Docker Application Container Engine
   Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled;>
   Active: inactive (dead) since Thu 2022-04-28 22:17:30 CST; 2s ago
     Docs: https://docs.docker.com
  Process: 1307 ExecStart=/usr/bin/dockerd -H fd:// --containerd=/r>
 Main PID: 1307 (code=exited, status=0/SUCCESS)

Apr 28 14:57:26 localhost.localdomain dockerd[1307]: time="2022-04->
Apr 28 14:57:26 localhost.localdomain dockerd[1307]: time="2022-04->
Apr 28 14:57:26 localhost.localdomain dockerd[1307]: time="2022-04->
Apr 28 14:57:26 localhost.localdomain systemd[1]: Started Docker Ap>
Apr 28 14:57:26 localhost.localdomain dockerd[1307]: time="2022-04->
Apr 28 22:17:30 localhost.localdomain systemd[1]: Stopping Docker A>
Apr 28 22:17:30 localhost.localdomain dockerd[1307]: time="2022-04->
Apr 28 22:17:30 localhost.localdomain dockerd[1307]: time="2022-04->
Apr 28 22:17:30 localhost.localdomain systemd[1]: docker.service: S>
Apr 28 22:17:30 localhost.localdomain systemd[1]: Stopped Docker Ap>
lines 1-17/17 (END)

注意：ip netns命令修改网络配置时需要 sudo 权限。

可以通过ip netns命令完成对Network Namespace 的相关操作，可以通过ip netns help查看命令帮助信息：

[root@localhost ~]# ip netns help
Usage:	ip netns list      //查看
	ip netns add NAME       //添加名称空间
	ip netns attach NAME PID    //进入
	ip netns set NAME NETNSID   //设置名字
	ip [-all] netns delete [NAME]   //删除
	ip netns identify [PID]
	ip netns pids NAME
	ip [-all] netns exec [NAME] cmd ...   //进入
	ip netns monitor   //监控
	ip netns list-id [target-nsid POSITIVE-INT] [nsid POSITIVE-INT]
NETNSID := auto | POSITIVE-INT
[root@localhost ~]#

默认情况下，Linux系统中是没有任何 Network Namespace的，所以ip netns list命令不会返回任何信息。

创建Network Namespace

通过命令创建一个名为ns0的命名空间：

[root@localhost ~]# ip netns list    //列出当前有哪些名称空间
[root@localhost ~]# ip netns add  ns0   //添加一个ns0的名称空间
[root@localhost ~]# ip netns list
ns0

新创建的 Network Namespace 会出现在/var/run/netns/目录下。如果相同名字的 namespace 已经存在，命令会报Cannot create namespace file “/var/run/netns/ns0”: File exists的错误。

[root@localhost ~]# ls /var/run/netns/
ns0

[root@localhost ~]# ip netns add ns0
Cannot create namespace file "/var/run/netns/ns0": File exists

对于每个 Network Namespace 来说，它会有自己独立的网卡、路由表、ARP 表、iptables 等和网络相关的资源。

操作Network Namespace

ip命令提供了ip netns exec子命令可以在对应的 Network Namespace 中执行命令。

查看新创建 Network Namespace 的网卡信息

[root@localhost ~]# ip netns exec ns0 ip a
1: lo:  mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

可以看到，新创建的Network Namespace中会默认创建一个lo回环网卡，此时网卡处于关闭状态。此时，尝试去 ping 该lo回环网卡，会提示Network is unreachable

[root@localhost ~]# ip netns exec ns0 ping 127.0.0.1
connect: Network is unreachabl

通过下面的命令启用lo回环网卡：

[root@localhost ~]# ip netns exec ns0 ip link set lo up    //激活网卡
[root@localhost ~]# ip netns exec ns0 ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
[root@localhost ~]# ip netns exec ns0 ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.051 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.082 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.083 ms
64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.073 ms
^C
--- 127.0.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3057ms
rtt min/avg/max/mdev = 0.051/0.072/0.083/0.014 ms

转移设备

我们可以在不同的 Network Namespace 之间转移设备（如veth）。由于一个设备只能属于一个 Network Namespace ，所以转移后在这个 Network Namespace 内就看不到这个设备了。

其中，veth设备属于可转移设备，而很多其它设备（如lo、vxlan、ppp、bridge等）是不可以转移的。

veth pair

veth pair 全称是 Virtual Ethernet Pair，是一个成对的端口，所有从这对端口一端进入的数据包都将从另一端出来，反之也是一样。
引入veth pair是为了在不同的 Network Namespace 直接进行通信，利用它可以直接将两个 Network Namespace 连接起来。

创建veth pair

[root@localhost ~]# ip link show
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens160:  mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether 00:0c:29:70:bc:8f brd ff:ff:ff:ff:ff:ff
3: docker0:  mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default 
    link/ether 02:42:5b:9b:57:e5 brd ff:ff:ff:ff:ff:ff
[root@localhost ~]# ip link add type veth
[root@localhost ~]# ip link show
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens160:  mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether 00:0c:29:70:bc:8f brd ff:ff:ff:ff:ff:ff
3: docker0:  mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default 
    link/ether 02:42:5b:9b:57:e5 brd ff:ff:ff:ff:ff:ff
4: veth0@veth1:  mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 52:10:da:00:2c:d7 brd ff:ff:ff:ff:ff:ff
5: veth1@veth0:  mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether a2:fa:89:e6:43:35 brd ff:ff:ff:ff:ff:ff

可以看到，此时系统中新增了一对veth pair，将veth0和veth1两个虚拟网卡连接了起来，此时这对 veth pair 处于”未启用“状态。

实现Network Namespace间通信

下面我们利用veth pair实现两个不同的 Network Namespace 之间的通信。刚才我们已经创建了一个名为ns0的 Network Namespace，下面再创建一个信息Network Namespace，命名为ns1

[root@localhost ~]# ip netns add ns1
[root@localhost ~]# ip netns list
ns1
ns0

然后我们将veth0加入到ns0，将veth1加入到ns1

[root@localhost ~]# ip link set veth0 netns ns0
[root@localhost ~]# ip link set veth1 netns ns1

然后我们分别为这对veth pair配置上ip地址，并启用它们

[root@localhost ~]# ip link set veth0 netns ns0   //将veth0加入到ns0
[root@localhost ~]# ip link set veth1 netns ns1   //将veth1加入到ns1
[root@localhost ~]# ip netns exec ns0 ip link set veth0 up   //开启veth0
[root@localhost ~]# ip netns exec ns0 ip addr add 1.1.1.1/24 dev veth0  //为veth0配置ip
[root@localhost ~]# ip netns exec ns1 ip link set lo up  //启动ns1 lowangka
[root@localhost ~]# ip netns  exec ns1 ip link set veth1 up //启动ns1 veth1网卡
[root@localhost ~]# ip netns exec ns1 ip addr add 1.1.1.2/24 dev veth1  //为veth1配置ip
[root@localhost ~]# ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
64 bytes from 1.1.1.1: icmp_seq=1 ttl=128 time=233 ms
64 bytes from 1.1.1.1: icmp_seq=2 ttl=128 time=247 ms
64 bytes from 1.1.1.1: icmp_seq=4 ttl=128 time=242 ms
64 bytes from 1.1.1.1: icmp_seq=5 ttl=128 time=215 ms

查看这对veth pair的状态

[root@localhost ~]# ip netns exec ns0 ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
4: veth0@if5:  mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 52:10:da:00:2c:d7 brd ff:ff:ff:ff:ff:ff link-netns ns1
    inet 1.1.1.1/24 scope global veth0
       valid_lft forever preferred_lft forever
    inet6 fe80::5010:daff:fe00:2cd7/64 scope link 
       valid_lft forever preferred_lft forever
       
[root@localhost ~]# ip netns exec ns1 ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
5: veth1@if4:  mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether a2:fa:89:e6:43:35 brd ff:ff:ff:ff:ff:ff link-netns ns0
    inet 1.1.1.2/24 scope global veth1
       valid_lft forever preferred_lft forever
    inet6 fe80::a0fa:89ff:fee6:4335/64 scope link 
       valid_lft forever preferred_lft forever

从上面可以看出，我们已经成功启用了这个veth pair，并为每个veth设备分配了对应的ip地址。我们尝试在ns1中访问ns0中的ip地址：

[root@localhost ~]# ip netns exec ns1 ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
64 bytes from 1.1.1.1: icmp_seq=1 ttl=64 time=0.080 ms
64 bytes from 1.1.1.1: icmp_seq=2 ttl=64 time=0.069 ms
64 bytes from 1.1.1.1: icmp_seq=3 ttl=64 time=0.080 ms
64 bytes from 1.1.1.1: icmp_seq=4 ttl=64 time=0.078 ms
^C
--- 1.1.1.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3095ms
rtt min/avg/max/mdev = 0.069/0.076/0.080/0.011 ms

可以看到，veth pair成功实现了两个不同Network Namespace之间的网络交互。

veth设备重命名

[root@localhost ~]# ip netns exec ns0 ip link set veth0 down
[root@localhost ~]# ip netns exec ns0 ip link set dev veth0 name eth0
[root@localhost ~]# ip netns exec ns0 ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
4: eth0@if5:  mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:10:da:00:2c:d7 brd ff:ff:ff:ff:ff:ff link-netns ns1
    inet 1.1.1.1/24 scope global eth0
       valid_lft forever preferred_lft forever
[root@localhost ~]# ip netns exec ns0 ip link set eth0 up
[root@localhost ~]# ip netns exec ns0 ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
4: eth0@if5:  mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 52:10:da:00:2c:d7 brd ff:ff:ff:ff:ff:ff link-netns ns1
    inet 1.1.1.1/24 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::5010:daff:fe00:2cd7/64 scope link 
       valid_lft forever preferred_lft forever

[root@localhost ~]# ip netns exec ns1 ip link set veth1 down
[root@localhost ~]# ip netns exec ns1 ip link set dev veth1 name eth0
[root@localhost ~]# ip netns exec ns1 ip link set eth0 up
[root@localhost ~]# ip netns exec ns1 ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
5: eth0@if4:  mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether a2:fa:89:e6:43:35 brd ff:ff:ff:ff:ff:ff link-netns ns0
    inet 1.1.1.2/24 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::a0fa:89ff:fee6:4335/64 scope link 
       valid_lft forever preferred_lft forever
[root@localhost ~]# ip netns exec ns1 ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
64 bytes from 1.1.1.1: icmp_seq=1 ttl=64 time=0.097 ms
64 bytes from 1.1.1.1: icmp_seq=2 ttl=64 time=0.219 ms
64 bytes from 1.1.1.1: icmp_seq=3 ttl=64 time=0.099 ms
^C
--- 1.1.1.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2069ms
rtt min/avg/max/mdev = 0.097/0.138/0.219/0.057 ms

四种网络模式配置 bridge模式配置

[root@localhost ~]# docker run -it --rm busybox     
/ # ip a
1: lo:  mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
6: eth0@if7:  mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

/ # exit
[root@localhost ~]# docker container ls -a


# 在创建容器时添加--network bridge与不加--network选项效果是一致的
[root@localhost ~]# docker run -it --network bridge busybox   //默认模式
/ # ip a 
1: lo:  mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
10: eth0@if11:  mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
/ # exit

none模式配置

[root@localhost ~]# docker run -it --rm --network none busybox    //孤岛模式
/ # ip a
1: lo:  mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
/ # exit

container模式配置

启动第一个容器

[root@localhost ~]# docker run -it --rm --name b1 busybox
/ # ip a
1: lo:  mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
12: eth0@if13:  mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
/ # 

启动第二个容器

```text
b2的容器IP与B1容器IP一致，也即共享IP，但不共享文件系统。
[root@localhost ~]# docker run -it --rm --network container:b1 busybox
/ # ip a
1: lo:  mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
12: eth0@if13:  mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
/ #

此时我们在b2容器上创建一个目录

/ # ls
bin   dev   etc   home  proc  root  sys   tmp   usr   var
/ # mkdir data
/ # ls
bin   data  dev   etc   home  proc  root  sys   tmp   usr   var
/ #

到b1容器上检查/tmp目录会发现并没有这个目录，因为文件系统是处于隔离状态，仅仅是共享了网络而已。

/ # ls
bin   dev   etc   home  proc  root  sys   tmp   usr   var
/ #

在b2容器上部署一个站点

/ # echo 'hello world' > data/index.html
/ # /bin/httpd  -h /data
/ # netstat -antl
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 :::80                   :::*                    LISTEN      
                   :::*                    LISTEN

在b1容器上用本地地址去访问此站点

/ # wget -O - -q 127.0.0.1
hello world

由此可见，container模式下的容器间关系就相当于一台主机上的两个不同进程

host模式配置

启动容器时直接指明模式为host

[root@localhost ~]# docker run -it --rm --network host busybox
/ # ip a
1: lo:  mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens160:  mtu 1500 qdisc mq qlen 1000
    link/ether 00:0c:29:70:bc:8f brd ff:ff:ff:ff:ff:ff
    inet 192.168.50.128/24 brd 192.168.50.255 scope global noprefixroute ens160
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe70:bc8f/64 scope link 
       valid_lft forever preferred_lft forever
3: docker0:  mtu 1500 qdisc noqueue 
    link/ether 02:42:5b:9b:57:e5 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:5bff:fe9b:57e5/64 scope link 
       valid_lft forever preferred_lft forever
/ #exit

此时如果我们在这个容器中启动一个http站点，我们就可以直接用宿主机的IP直接在浏览器中访问这个容器中的站点了。

容器的常用操作查看容器的主机名

[root@localhost ~]# docker run -it --rm  busybox
/ # hostname   //查看主机名，一般和容器ip是一个
562b7e077a79
/ # echo 'yyqx' >/etc/hostname  //修改名字
/ # cat /etc/hostname
yyqx
/ # hostname   //因为镜像是只读的，所以修改不成功
562b7e077a79

在容器启动时注入主机名

[root@localhost ~]# docker run -it --rm --hostname yyqx busybox
/ # hostname
yyqx
/ # cat /etc/hostname
yyqx
/ # cat /etc/hosts
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::0	ip6-localnet
ff00::0	ip6-mcastprefix
ff02::1	ip6-allnodes
ff02::2	ip6-allrouters
172.17.0.2	yyqx      # 注入主机名时会自动创建主机名到IP的映射关系
 
/ # ping www.baidu.com
PING www.baidu.com (36.152.44.96): 56 data bytes
64 bytes from 36.152.44.96: seq=0 ttl=127 time=21.128 ms
64 bytes from 36.152.44.96: seq=1 ttl=127 time=21.252 ms
64 bytes from 36.152.44.96: seq=2 ttl=127 time=21.317 m

手动指定容器要使用的DNS

/# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 114.114.114.114  
[root@localhost ~]# docker run -it --rm --hostname yyqx --dns 8.8.8.8 busybox
/ # cat /etc/resolv.conf
nameserver 8.8.8.8

手动往/etc/hosts文件中注入主机名到IP地址的映射

[root@localhost ~]# docker run -it --rm --hostname yyqx1 --add-host yyqx:172.17.0.2 busybox
/ # cat /etc/hosts
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::0	ip6-localnet
ff00::0	ip6-mcastprefix
ff02::1	ip6-allnodes
ff02::2	ip6-allrouters
172.17.0.2	yyqx
172.17.0.3	yyqx1
/ # ping yyqx
PING yyqx (172.17.0.2): 56 data bytes
64 bytes from 172.17.0.2: seq=0 ttl=64 time=0.219 ms
64 bytes from 172.17.0.2: seq=1 ttl=64 time=0.134 ms
64 bytes from 172.17.0.2: seq=2 ttl=64 time=0.136 ms
64 bytes from 172.17.0.2: seq=3 ttl=64 time=0.137 ms

开放容器端口

执行docker run的时候有个-p选项，可以将容器中的应用端口映射到宿主机中，从而实现让外部主机可以通过访问宿主机的某端口来访问容器内应用的目的。

-p选项能够使用多次，其所能够暴露的端口必须是容器确实在监听的端口。

-p选项的使用格式：

-p
- 将指定的容器端口映射至主机所有地址的一个动态端口

[root@localhost ~]# docker run -d --rm --name web -p 80 httpd   //指定暴露容器端口号，这时映射的主机端口号是随机的
e4cd0997d0048d7620a823d25783332474e23d74464b2527aadd8a67fcdc58c9
[root@localhost ~]# docker ps
CONTAINER ID   IMAGE     COMMAND              CREATED         STATUS         PORTS                                     NAMES
e4cd0997d004   httpd     "httpd-foreground"   5 seconds ago   Up 4 seconds   0.0.0.0:49153->80/tcp, :::49153->80/tcp   web

-p :
- 将容器端口映射至指定的主机端口

[root@localhost ~]# docker run -d --rm --name web -p 80:80 httpd
518433627bcb7df3063f4c6fce2cef53e5ee278d5e46b7d0ec90d865912e1097
[root@localhost ~]# docker ps
CONTAINER ID   IMAGE     COMMAND              CREATED         STATUS         PORTS                               NAMES
518433627bcb   httpd     "httpd-foreground"   9 seconds ago   Up 8 seconds   0.0.0.0:80->80/tcp, :::80->80/tcp   web

-p ::
- 将指定的容器端口映射至主机指定的动态端口

[root@localhost ~]# ip addr add 192.168.50.129/24 dev ens160   //添加ip地址
[root@localhost ~]# ip a 
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens160:  mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:70:bc:8f brd ff:ff:ff:ff:ff:ff
    inet 192.168.50.128/24 brd 192.168.50.255 scope global noprefixroute ens160
       valid_lft forever preferred_lft forever
    inet 192.168.50.129/24 scope global secondary ens160
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe70:bc8f/64 scope link 
       valid_lft forever preferred_lft forever
3: docker0:  mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:5b:9b:57:e5 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:5bff:fe9b:57e5/64 scope link 
       valid_lft forever preferred_lft forever
[root@localhost ~]# docker run -d --rm --name web -p 192.168.50.128::80 httpd
c56d836c91b39c56c3dfa2fa887d83c1aab52abb3f9a9e1fde2323aa5646e52f
[root@localhost ~]# ss -antl
State  Recv-Q Send-Q  Local Address:Port  Peer Address:Port Process 
LISTEN 0      128           0.0.0.0:22         0.0.0.0:*            
LISTEN 0      128    192.168.50.128:49153      0.0.0.0:*            
LISTEN 0      128              [::]:22            [::]:*

因为他只监听在192.168.50128上所以用192.168.50.129不能访问

-p ::
- 将指定的容器端口映射至主机指定的端口

[root@localhost ~]# docker run -d --rm --name web -p 192.168.50.128:80:80 httpd
1850ac9ee558dfcffb9a977980d9629aabbdb78ab72ba64e24d1fecb00a62f29
[root@localhost ~]# ss -antl
State  Recv-Q Send-Q  Local Address:Port  Peer Address:Port Process 
LISTEN 0      128    192.168.50.128:80         0.0.0.0:*            
LISTEN 0      128           0.0.0.0:22         0.0.0.0:*            
LISTEN 0      128              [::]:22            [::]:*  
[root@localhost ~]# docker port web   //查看容器的80端口被映射到了宿主机的什么端口上
80/tcp -> 192.168.50.128:80

docker容器网络配置

Linux相关栏目本月热门文章