第一次上传
This commit is contained in:
363
00.基础阶段/02.Linux基础/15.Docker/06.Docker网络管理.md
Normal file
363
00.基础阶段/02.Linux基础/15.Docker/06.Docker网络管理.md
Normal file
@@ -0,0 +1,363 @@
|
||||
# 06.Docker网络管理
|
||||
|
||||
## 06.Docker网络管理
|
||||
|
||||
### 1. 容器之间的互联
|
||||
|
||||
在同一个宿主机上的容器之间可以通过端口映射的方式，经过宿主机中转进行互相访问，也可以通过docker0网桥互相访问
|
||||
|
||||
#### 1.1 直接互联
|
||||
|
||||
- 启动两个容器
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker run -d -it nginx
|
||||
[root@localhost ~]# docker run -d -it nginx
|
||||
```
|
||||
|
||||
- 安装相关工具包
|
||||
|
||||
```bash
|
||||
root@855ab8d0bd74:/# apt update
|
||||
root@855ab8d0bd74:/# apt install net-tools -y
|
||||
root@855ab8d0bd74:/# apt install iputils-ping -y
|
||||
root@855ab8d0bd74:/# apt install procps -y
|
||||
|
||||
```
|
||||
|
||||
- 检测网络连通性
|
||||
|
||||
```bash
|
||||
root@855ab8d0bd74:/# ping 172.17.0.3 -c 2
|
||||
PING 172.17.0.3 (172.17.0.3) 56(84) bytes of data.
|
||||
64 bytes from 172.17.0.3: icmp_seq=1 ttl=64 time=0.052 ms
|
||||
64 bytes from 172.17.0.3: icmp_seq=2 ttl=64 time=0.081 ms
|
||||
|
||||
--- 172.17.0.3 ping statistics ---
|
||||
2 packets transmitted, 2 received, 0% packet loss, time 1ms
|
||||
rtt min/avg/max/mdev = 0.052/0.066/0.081/0.016 ms
|
||||
```
|
||||
|
||||
#### 1.2 使用名称互联
|
||||
|
||||
- 启动两个容器
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker run -d -it --name web1 nginx:1.8
|
||||
[root@localhost ~]# docker run -d -it --name web2 --link web1 nginx:1.8
|
||||
```
|
||||
|
||||
- 查看web2容器的hosts文件，发现已经实现名称解析
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker exec -it web2 bash
|
||||
root@8a3e9cee9e37:/# cat /etc/hosts
|
||||
127.0.0.1 localhost
|
||||
::1 localhost ip6-localhost ip6-loopback
|
||||
fe00::0 ip6-localnet
|
||||
ff00::0 ip6-mcastprefix
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
172.17.0.2 web1 622eff54876f
|
||||
172.17.0.3 8a3e9cee9e37
|
||||
```
|
||||
|
||||
- 连通性测试
|
||||
|
||||
```bash
|
||||
root@8a3e9cee9e37:/# ping web1 -c 2
|
||||
PING web1 (172.17.0.2) 56(84) bytes of data.
|
||||
64 bytes from web1 (172.17.0.2): icmp_seq=1 ttl=64 time=0.068 ms
|
||||
64 bytes from web1 (172.17.0.2): icmp_seq=2 ttl=64 time=0.045 ms
|
||||
|
||||
--- web1 ping statistics ---
|
||||
2 packets transmitted, 2 received, 0% packet loss, time 1ms
|
||||
rtt min/avg/max/mdev = 0.045/0.056/0.068/0.013 ms
|
||||
```
|
||||
|
||||
#### 1.3 使用别名互联
|
||||
|
||||
自定义的容器名称可能后期会发生变化，那么一旦发生变化也会带来一些影响，这个时候如果每次都更改名称又比较麻烦，这个时候可以使用定义别名的方式解决，即容器名称可以随意更改，只要不更改别名即可。
|
||||
|
||||
- 启动一个容器
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker run -d -it --name web3 --link web1:nginx-web1 nginx:1.8
|
||||
```
|
||||
|
||||
- 查看容器web3的hosts文件
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker exec -it web3 bash
|
||||
root@c85c73ebf00b:/# cat /etc/hosts
|
||||
127.0.0.1 localhost
|
||||
::1 localhost ip6-localhost ip6-loopback
|
||||
fe00::0 ip6-localnet
|
||||
ff00::0 ip6-mcastprefix
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
172.17.0.2 nginx-web1 622eff54876f web1
|
||||
172.17.0.4 c85c73ebf00b
|
||||
```
|
||||
|
||||
- 连通性测试
|
||||
|
||||
```bash
|
||||
root@c85c73ebf00b:/# ping nginx-web1 -c2
|
||||
PING nginx-web1 (172.17.0.2) 56(84) bytes of data.
|
||||
64 bytes from nginx-web1 (172.17.0.2): icmp_seq=1 ttl=64 time=0.112 ms
|
||||
64 bytes from nginx-web1 (172.17.0.2): icmp_seq=2 ttl=64 time=0.055 ms
|
||||
|
||||
--- nginx-web1 ping statistics ---
|
||||
2 packets transmitted, 2 received, 0% packet loss, time 2ms
|
||||
rtt min/avg/max/mdev = 0.055/0.083/0.112/0.029 ms
|
||||
|
||||
```
|
||||
|
||||
### 2. Docker网络
|
||||
|
||||
#### 2.1 四类网络模式
|
||||
|
||||
| Docker网络模式 | 配置 | 说明 |
|
||||
| -------------- | ------------------------- | ------------------------------------------------------------ |
|
||||
| host模式 | –net=host | 容器和宿主机共享Network namespace。 |
|
||||
| container模式 | –net=container:NAME_or_ID | 容器和另外一个容器共享Network namespace。 kubernetes中的pod就是多个容器共享一个Network namespace。 |
|
||||
| none模式 | –net=none | 容器有独立的Network namespace，但并没有对其进行任何网络设置，如分配veth pair 和网桥连接，配置IP等。 |
|
||||
| bridge模式 | –net=bridge | （默认为该模式） |
|
||||
|
||||
Docker服务安装完成之后，默认在每个宿主机会生成一个名称为docker0的网卡，其ip地址都是172.17.0.1/16，并且会生成三种不同类型的网络
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# ifconfig
|
||||
docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
|
||||
inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
|
||||
ether 02:42:14:75:bf:4c txqueuelen 0 (Ethernet)
|
||||
RX packets 0 bytes 0 (0.0 B)
|
||||
RX errors 0 dropped 0 overruns 0 frame 0
|
||||
TX packets 0 bytes 0 (0.0 B)
|
||||
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
|
||||
|
||||
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
|
||||
inet 192.168.80.10 netmask 255.255.255.0 broadcast 192.168.80.255
|
||||
inet6 fe80::eaf3:dc40:2bf:6da2 prefixlen 64 scopeid 0x20<link>
|
||||
ether 00:0c:29:f4:79:06 txqueuelen 1000 (Ethernet)
|
||||
RX packets 13079 bytes 18637594 (17.7 MiB)
|
||||
RX errors 0 dropped 0 overruns 0 frame 0
|
||||
TX packets 1747 bytes 124995 (122.0 KiB)
|
||||
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
|
||||
|
||||
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
|
||||
inet 127.0.0.1 netmask 255.0.0.0
|
||||
inet6 ::1 prefixlen 128 scopeid 0x10<host>
|
||||
loop txqueuelen 1 (Local Loopback)
|
||||
RX packets 72 bytes 5776 (5.6 KiB)
|
||||
RX errors 0 dropped 0 overruns 0 frame 0
|
||||
TX packets 72 bytes 5776 (5.6 KiB)
|
||||
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
|
||||
|
||||
[root@localhost ~]# docker network list
|
||||
NETWORK ID NAME DRIVER SCOPE
|
||||
787342a0d883 bridge bridge local
|
||||
9a6d7244e807 host host local
|
||||
beace8354cca none null local
|
||||
```
|
||||
|
||||
在启动容器的时候可以使用--network参数去指定网络类型，默认使用的是bridge网络类型
|
||||
|
||||
#### 2.2 none网络类型
|
||||
|
||||
在使用none模式后，docker容器**不会进行任何网络配置**，其没有网卡、没有ip也没有路由，因此默认无法与外界进行通信，需要手动添加网卡配置ip等，所以**极少使用**
|
||||
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker run -d -it --name web4 --network none nginx:1.8
|
||||
```
|
||||
|
||||
#### 2.3 container网络类型
|
||||
|
||||
这个模式指定新创建的容器和**已经存在的一个容器共享**一个 Network Namespace，而不是和宿主机共享。新创建的容器不会创建自己的网卡，配置自己的 IP，而是和一个指定的容器共享 IP、端口范围等。同样，两个容器除了网络方面，其他的如文件系统、进程列表等还是隔离的。两个容器的进程可以通过 lo 网卡（环回接口）设备通信。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker run -d -it --name web5 --network container:web1 nginx
|
||||
83db4f9af6f3d9d42bbd57691fcf82ef06cbf1a5874750effa314a4ec242aaaa
|
||||
```
|
||||
|
||||
|
||||
|
||||
#### 2.4 host网络类型
|
||||
|
||||
如果启动容器的时候使用host模式，那么这个容器将不会获得一个独立的Network Namespace，而是和宿主机共用一个Network Namespace。容器将不会虚拟出自己的网卡，配置自己的IP等，而是**使用宿主机的IP和端口。**
|
||||
|
||||
使用host模式的容器可以直接使用宿主机的IP地址与外界通信**，容器内部的服务端口也可以使用宿主机的端口**，不需要进行NAT，host最大的优势就是**网络性能比较好**，但是docker host上已经使用的端口就不能再用了，**网络的隔离性不好。**
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker run -d -it --name web7 --network host nginx
|
||||
e90cb3bfc1a3fbd187319ac3b995b116feb37422534b03662d624680e35eb2bb
|
||||
[root@localhost ~]# docker exec -it web7 bash
|
||||
root@localhost:/# ifconfig
|
||||
docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
|
||||
inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
|
||||
inet6 fe80::42:14ff:fe75:bf4c prefixlen 64 scopeid 0x20<link>
|
||||
ether 02:42:14:75:bf:4c txqueuelen 0 (Ethernet)
|
||||
RX packets 9647 bytes 394222 (384.9 KiB)
|
||||
RX errors 0 dropped 0 overruns 0 frame 0
|
||||
TX packets 10932 bytes 43303360 (41.2 MiB)
|
||||
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
|
||||
|
||||
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
|
||||
inet 192.168.175.10 netmask 255.255.255.0 broadcast 192.168.175.255
|
||||
inet6 fe80::eaf3:dc40:2bf:6da2 prefixlen 64 scopeid 0x20<link>
|
||||
ether 00:0c:29:f4:79:06 txqueuelen 1000 (Ethernet)
|
||||
RX packets 60855 bytes 81177548 (77.4 MiB)
|
||||
RX errors 0 dropped 0 overruns 0 frame 0
|
||||
TX packets 17770 bytes 1472014 (1.4 MiB)
|
||||
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
|
||||
|
||||
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
|
||||
inet 127.0.0.1 netmask 255.0.0.0
|
||||
inet6 ::1 prefixlen 128 scopeid 0x10<host>
|
||||
loop txqueuelen 1 (Local Loopback)
|
||||
RX packets 72 bytes 5776 (5.6 KiB)
|
||||
RX errors 0 dropped 0 overruns 0 frame 0
|
||||
TX packets 72 bytes 5776 (5.6 KiB)
|
||||
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
|
||||
```
|
||||
|
||||
|
||||
|
||||
#### 2.5 bridge网络类型(默认)
|
||||
|
||||
当Docker进程启动时，会在主机上创建一个名为**docker0的虚拟网桥**，此主机上启动的Docker容器会连接到这个虚拟网桥上。虚拟网桥的工作方式和物理交换机类似，这样主机上的所有容器就通过交换机连在了一个二层网络中。
|
||||
|
||||
从docker0子网中分配一个IP给容器使用，并设置docker0的IP地址为容器的默认网关。在主机上创建一对虚拟网卡veth pair设备，Docker将veth pair设备的一端放在新创建的容器中，并命名为eth0（容器的网卡），另一端放在主机中，以vethxxx这样类似的名字命名，并将这个网络设备加入到docker0网桥中。可以通过brctl show命令查看。
|
||||
|
||||
bridge模式是docker的**默认网络模式**，不写--network参数，就是bridge模式。**使用docker run -p时，docker实际是在iptables做了DNAT规则，实现端口转发功能。可以使用iptables -t nat -vnL查看。**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### 3. 创建自定义网络
|
||||
|
||||
可以基于docker命令创建自定义网络，自定义网络可以自定义ip地址范围和网关等信息。
|
||||
|
||||
- 创建一个网络
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker network create -d bridge --subnet 10.10.0.0/16 --gateway 10.10.0.1 eagleslab-net
|
||||
74ee6ecdfc0382ac0abb1b46a3c90e3c6a39f0b7388aa9ba99fddc6bac72e8ce
|
||||
[root@localhost ~]# docker network list
|
||||
NETWORK ID NAME DRIVER SCOPE
|
||||
787342a0d883 bridge bridge local
|
||||
74ee6ecdfc03 eagleslab-net bridge local
|
||||
9a6d7244e807 host host local
|
||||
beace8354cca none null local
|
||||
```
|
||||
|
||||
- 使用自定义网络创建容器
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker run -d -it --name web8 --network eagleslab-net nginx
|
||||
```
|
||||
|
||||
- 检查网络
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker exec -it web8 bash
|
||||
root@a7edddb4114e:/# ifconfig
|
||||
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
|
||||
inet 10.10.0.2 netmask 255.255.0.0 broadcast 10.10.255.255
|
||||
ether 02:42:0a:0a:00:02 txqueuelen 0 (Ethernet)
|
||||
RX packets 1064 bytes 8764484 (8.3 MiB)
|
||||
RX errors 0 dropped 0 overruns 0 frame 0
|
||||
TX packets 738 bytes 41361 (40.3 KiB)
|
||||
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
|
||||
root@a7edddb4114e:/# ping www.baidu.com -c2
|
||||
PING www.a.shifen.com (112.34.112.83) 56(84) bytes of data.
|
||||
64 bytes from 112.34.112.83 (112.34.112.83): icmp_seq=1 ttl=127 time=37.8 ms
|
||||
64 bytes from 112.34.112.83 (112.34.112.83): icmp_seq=2 ttl=127 time=36.9 ms
|
||||
|
||||
--- www.a.shifen.com ping statistics ---
|
||||
2 packets transmitted, 2 received, 0% packet loss, time 3ms
|
||||
rtt min/avg/max/mdev = 36.865/37.320/37.776/0.494 ms
|
||||
|
||||
```
|
||||
|
||||
- iptables会生成nat的相应规则
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# iptables -t nat -vnL
|
||||
Chain PREROUTING (policy ACCEPT 12 packets, 759 bytes)
|
||||
pkts bytes target prot opt in out source destination
|
||||
2 136 DOCKER all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
|
||||
|
||||
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
|
||||
pkts bytes target prot opt in out source destination
|
||||
|
||||
Chain OUTPUT (policy ACCEPT 1 packets, 76 bytes)
|
||||
pkts bytes target prot opt in out source destination
|
||||
0 0 DOCKER all -- * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
|
||||
|
||||
Chain POSTROUTING (policy ACCEPT 1 packets, 76 bytes)
|
||||
pkts bytes target prot opt in out source destination
|
||||
12 759 MASQUERADE all -- * !br-74ee6ecdfc03 10.10.0.0/16 0.0.0.0/0
|
||||
32 1940 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0
|
||||
|
||||
Chain DOCKER (2 references)
|
||||
pkts bytes target prot opt in out source destination
|
||||
0 0 RETURN all -- br-74ee6ecdfc03 * 0.0.0.0/0 0.0.0.0/0
|
||||
1 84 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0
|
||||
```
|
||||
|
||||
### 4. Docker一键搭建typecho博客
|
||||
|
||||
镜像选择：**80x86/typecho:latest**
|
||||
|
||||
一、部署容器
|
||||
|
||||
```bash
|
||||
[root@localhost ~]# docker run -d \
|
||||
--name=typecho \
|
||||
--restart always \
|
||||
-e PHP_TZ=Asia/Shanghai \
|
||||
-e PHP_MAX_EXECUTION_TIME=600 \
|
||||
-p 80:80 80x86/typecho:latest
|
||||
|
||||
[root@localhost ~]# ss -nlt
|
||||
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
|
||||
LISTEN 0 4096 0.0.0.0:80 0.0.0.0:*
|
||||
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
|
||||
LISTEN 0 4096 [::]:80 [::]:*
|
||||
LISTEN 0 128 [::]:22 [::]:*
|
||||
```
|
||||
|
||||
二、浏览器访问初始化博客
|
||||
|
||||
|
||||
|
||||
三、完善信息，数据库选择内置的SQL Lite方便一点
|
||||
|
||||
|
||||
|
||||
四、安装完成
|
||||
|
||||
|
||||
|
||||
五、更改主题，默认带了几个主题
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user