docker网络通信

1. 探讨docker容器之间的通信原理 1.1 linux 中veth-pair对实现两个namespace间的通信

查看本机网卡信息

ip a

1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0:  mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:4d:77:d3 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global noprefixroute dynamic eth0
       valid_lft 85796sec preferred_lft 85796sec
    inet6 fe80::5054:ff:fe4d:77d3/64 scope link
       valid_lft forever preferred_lft forever
3: eth1:  mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:f8:15:97 brd ff:ff:ff:ff:ff:ff
    inet 192.168.31.10/24 brd 192.168.31.255 scope global noprefixroute eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fef8:1597/64 scope link
       valid_lft forever preferred_lft forever
4: docker0:  mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:a1:29:e6:bc brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever

1、网卡：lo
	本地回环网卡
2、网卡：eth0
	连接外网的网卡
3、网卡：eth1
	本机网卡，我们内网使用的网卡
3、网卡：docker0
	docker服务创建的一块网卡，用来连接所有docker容器的网卡

linux中的namespace，网卡隔离

1、创建network namespace
	ip netns add ns1
	ip netns add ns2
2、查看network namespace
	ip netns list
3、查看网卡信息
	ip netns exec ns1 ip a
4、启动ns1中lo网卡
	ip netns exec ns1 ifup lo
	ip netns exec ns2 ifup lo
5、创建veth peer	
	ip link add veth-ns1 type veth peer name veth-ns2
	
	ip a 查看网卡，发现多出两块网卡
> 5: veth-ns2@veth-ns1:  mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether d2:3d:81:78:af:07 brd ff:ff:ff:ff:ff:ff
> 6: veth-ns1@veth-ns2:  mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether fa:53:71:19:15:24 brd ff:ff:ff:ff:ff:ff
6、将网卡veth-ns1派送到ns1中，网卡veth-ns2派送到ns2中
	ip link set veth-ns1 netns ns1
	ip link set veth-ns2 netns ns2
7、给ns1的veth-ns1网卡添加ip并启动
	ip netns exec ns1 ip addr add 192.168.31.100/24 dev veth-ns1
	ip netns exec ns1 ip link set veth-ns1 up
	ip netns exec ns2 ip addr add 192.168.31.101/24 dev veth-ns2
	ip netns exec ns2 ip link set veth-ns2 up
8、测试两个ns是否能ping
	ip netns exec ns2 ping 192.168.31.100
	ip netns exec ns1 ping 192.168.31.101

1.2 docker容器间的通信

查看网卡信息

ip a
1: lo: ...
2: eth0: ...
3: eth1:...
4: docker0: ...

启动一个容器，再次查看网卡信息，多出一快网卡

docker run -d --name mytomcat01 -p 8081:8080 mytomcat:latest
ip a
1: lo: ...
2: eth0: ...
3: eth1:...
4: docker0: ...
8: veth3b7f162@if7: ...

到容器中查看ip信息

docker exec -it mytomcat01 bash
ip a
1: lo: ...
9: eth0@if8: ...

2. docker网段 2.1 network bridge网络

docker network查看

docker network ls

NETWORK ID     NAME      DRIVER    SCOPE
954a03611500   bridge    bridge    local
10026b758c68   host      host      local
3acaa519bee5   none      null      local
# docker0 是bridge类型的网络
docker network inspect bridge

[
    {
        "Name": "bridge",
        "Id": "954a0361150060f30b78cade74a7def02f7ba3fafebfcb2088f35e93d6a3dfab",
        "Created": "2022-05-16T13:32:32.481177347Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "8463cff4911f203b6aabcab112cc1a933b0f0c9b691b1717e4e5e0701ac6fe8f": {
                "Name": "tomcat02",
                "EndpointID": "a4268cc429006012805192f829628c78503d376f4cf8acd578aa8b2218701d8f",
                "MacAddress": "02:42:ac:11:00:03",
                "IPv4Address": "172.17.0.3/16",
                "IPv6Address": ""
            },
            "ad53091c02c2969358a2e8e0d45ecaf72e95d66fef68ac8a353b263561866fce": {
                "Name": "tomcat01",
                "EndpointID": "8d32566987a59af9c8aa63b191c54e7cce176871ece2a7a4ea3215dd7812c19b",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

添加bridge类型的网络

docker network create tomcat-net
docker network inspect tomcat-net
[
    {
        "Name": "tomcat-net",
        "Id": "c34787f40d7ac3f4a03641b16514248a0ec713e59e3700bd4139aeb757843937",
        "Created": "2022-05-16T14:19:34.703491431Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {},
        "Labels": {}
    }
]

指定network创建容器

docker run -d --name custom-net-tomcat -p 8088:8080 --network tomcat-net tomcat
#网段变成172.18.0.2
#在容器tomcat01中不能访问容器custom-net-tomcat

指定容器，添加到指定的网段

docker network connect tomcat-net tomcat01
## 将tomcat01容器添加到指定的网段

# 对比查看
docker network tomcat-net
 "Containers": {
            "3bb4becc5554352a9edb5f60efee02b7a93c7b4d3f74e7152172ae8825ba972b": {
                "Name": "custom-net-tomcat",
                "EndpointID": "0050c099c781864642e9b682d4dcf66cf3e2d3cae9949c2b30f367d1e80f6924",
                "MacAddress": "02:42:ac:12:00:02",
                "IPv4Address": "172.18.0.2/16",
                "IPv6Address": ""
            },
            "81d289ce7062ac6e2b59afecd975de15e53045eafb1a6cc2c0777a601b267cc5": {
                "Name": "tomcat01",
                "EndpointID": "11a8199030782c6bcf44e08e43c4b734b24511e2924809da5ce38f727ae7770d",
                "MacAddress": "02:42:ac:12:00:03",
                "IPv4Address": "172.18.0.3/16",
                "IPv6Address": ""
            }
        }

# 多出了tomcat01信息

tomcat01容器可以访问custom-net-tomcat信息

删除网段

docker network rm tomcat-net

2.2 network host网络

容器中的ip信息完全复制宿主机上的ip信息

2.3 network none网络

docker run -d --name my-tomcat-none --network none tomcat
除了本地回环地址，没有其他的ip信息，和外界完全不能通信

3. 通过容器之间使用名称来相互访问？

当多个服务之间有ip之间的关联，但是都是通过docker容器部署的服务，ip是未知的。这个时候，如何配置ip信息呢？如配置mysql、redis、es等的ip地址。
尝试使用容器名称来访问彼此
很遗憾，不能访问

docker exec -it tomcat01 bash
curl tomcat02:8080

使用自定义网卡，不使用默认network
很完美，可以访问

docker run -d --name tomcat11 -p 8011:8080 --network tomcat-net tomcat
docker run -d --name tomcat22 -p 8022:8080 --network tomcat-net tomcat

docker exec -it tomcat01 bash
curl tomcat02:8080

如何让默认的network，但是依旧可以让容器与容器之间可以使用名称访问？

docker run -d --name tomcat04 --link tomcat01 tomcat
# tomcat04 可以访问tomcat01 ，不建议使用

建议使用自定义网络

docker网络通信

Linux相关栏目本月热门文章