docker容器的网络配置

最新推荐文章于 2025-06-03 09:45:00 发布

原创最新推荐文章于 2025-06-03 09:45:00 发布 · 1.6k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#docker #容器

本文介绍了如何使用ipnetns创建和管理Linux Network Namespace，包括创建命名空间、配置IP和实现不同命名空间间的通信。此外，详细阐述了Docker的四种网络模式：bridge、none、container和host模式，展示了各自的特点和应用场景。在实践中，通过实例演示了容器间的网络配置和通信方式。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

一.利用ip netns创建名称空间并配置ip使其通信

可以借助ip netns命令来完成对 Network Namespace 的各种操作。ip netns命令来自于iproute安装包，一般系统会默认安装，如果没有的话，请自行安装

[root@localhost ~]# rpm -qa | grep iproute   //检查是否具有ip netns命令
iproute-5.3.0-1.el8.x86_64

创建Network Namespace

通过命令创建一个名为ns0的命名空间

[root@localhost ~]# systemctl stop docker    //停止容器服务
Warning: Stopping docker.service, but it can still be activated by:
  docker.socket
[root@localhost ~]# ip netns add ns0
[root@localhost ~]# ip netns list
ns0

新创建的 Network Namespace 会出现在/var/run/netns/目录下。如果相同名字的 namespace 已经存在，命令会报Cannot create namespace file "/var/run/netns/ns0": File exists的错误

root@localhost ~]# ls /var/run/netns/
ns0
[root@localhost ~]# ip netns add ns0     //不能重复创建命名空间
Cannot create namespace file "/var/run/netns/ns0": File exists

对于每个 Network Namespace 来说，它会有自己独立的网卡、路由表、ARP 表、iptables 等和网络相关的资源

操作Network Namespace

[root@localhost ~]# ip netns exec ns0 ping 127.0.0.1
connect: 网络不可达
[root@localhost ~]# ip netns exec ns0 ip link set lo up
[root@localhost ~]# ip netns exec ns0 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
[root@localhost ~]# ip netns exec ns0 ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.026 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.037 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.046 ms
^C
--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 60ms
rtt min/avg/max/mdev = 0.026/0.036/0.046/0.009 ms

转移设备

我们可以在不同的 Network Namespace 之间转移设备（如veth）。由于一个设备只能属于一个 Network Namespace ，所以转移后在这个 Network Namespace 内就看不到这个设备了。

其中，veth设备属于可转移设备，而很多其它设备（如lo、vxlan、ppp、bridge等）是不可以转移的

veth pair

veth pair 全称是 Virtual Ethernet Pair，是一个成对的端口，所有从这对端口一端进入的数据包都将从另一端出来，反之也是一样。
引入veth pair是为了在不同的 Network Namespace 直接进行通信，利用它可以直接将两个 Network Namespace 连接起来

创建veth pair

[root@localhost ~]# ip link add type veth
[root@localhost ~]# ip a
4: veth0@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 5e:b9:53:d0:dd:50 brd ff:ff:ff:ff:ff:ff
5: veth1@veth0: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 9a:3b:1d:3f:ed:a9 brd ff:ff:ff:ff:ff:ff

可以看到，此时系统中新增了一对veth pair，将veth0和veth1两个虚拟网卡连接了起来，此时这对 veth pair 处于”未启用“状态

实现Network Namespace间通信

下面我们利用veth pair实现两个不同的 Network Namespace 之间的通信。刚才我们已经创建了一个名为ns0的 Network Namespace，下面再创建一个信息Network Namespace，命名为ns1

[root@localhost ~]# ip netns add ns1
[root@localhost ~]# ip netns list
ns0
ns1

然后我们将veth0加入到ns0，将veth1加入到ns1

[root@localhost ~]# ip link set veth0 netns ns0
[root@localhost ~]# ip link set veth1 netns ns1

然后我们分别为这对veth pair配置上ip地址，并启用它们

[root@localhost ~]# ip netns exec ns0 ip link set veth0 up
[root@localhost ~]# ip netns exec ns0 ip addr add 1.1.1.1/24 dev veth0
[root@localhost ~]# ip netns exec ns1 ip link set lo up
[root@localhost ~]# ip netns  exec ns1 ip link set veth1 up
[root@localhost ~]# ip netns exec ns1 ip addr add 1.1.1.10/24 dev veth1

查看这对veth pair的状态

[root@localhost ~]# ip netns exec ns0 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
4: veth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 5e:b9:53:d0:dd:50 brd ff:ff:ff:ff:ff:ff link-netns ns1
    inet 1.1.1.1/24 scope global veth0
       valid_lft forever preferred_lft forever
    inet6 fe80::5cb9:53ff:fed0:dd50/64 scope link 
       valid_lft forever preferred_lft forever
[root@localhost ~]# ip netns exec ns1 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
5: veth1@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 9a:3b:1d:3f:ed:a9 brd ff:ff:ff:ff:ff:ff link-netns ns0
    inet 1.1.1.10/24 scope global veth1
       valid_lft forever preferred_lft forever
    inet6 fe80::983b:1dff:fe3f:eda9/64 scope link 
       valid_lft forever preferred_lft forever

从上面可以看出，我们已经成功启用了这个veth pair，并为每个veth设备分配了对应的ip地址。我们尝试在ns1中访问ns0中的ip地址

[root@localhost ~]# ip netns exec ns1 ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
64 bytes from 1.1.1.1: icmp_seq=1 ttl=64 time=0.044 ms
64 bytes from 1.1.1.1: icmp_seq=2 ttl=64 time=0.077 ms
^C
--- 1.1.1.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 60ms
rtt min/avg/max/mdev = 0.044/0.060/0.077/0.018 ms

可以看到，veth pair成功实现了两个不同Network Namespace之间的网络交互

veth设备重命名

[root@localhost ~]# ip netns exec ns0 ip link set veth0 down
[root@localhost ~]# ip netns exec ns0 ip link set dev veth0 name eth0
[root@localhost ~]# ip netns exec ns0 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
4: eth0@if5: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 5e:b9:53:d0:dd:50 brd ff:ff:ff:ff:ff:ff link-netns ns1
    inet 1.1.1.1/24 scope global eth0
       valid_lft forever preferred_lft forever
[root@localhost ~]# ip netns exec ns0 ip link set eth0 up

二.四种网络模式配置

1.bridge模式配置

[root@localhost ~]# docker pull busybox
Using default tag: latest
latest: Pulling from library/busybox
5cc84ad355aa: Pull complete 
Digest: sha256:5acba83a746c7608ed544dc1533b87c737a0b0fb730301639a0179f9344b1678
Status: Downloaded newer image for busybox:latest
docker.io/library/busybox:latest
[root@localhost ~]# docker run -it --name b1 --rm busybox
/ # ifconfig 
eth0      Link encap:Ethernet  HWaddr 02:42:AC:11:00:02  
          inet addr:172.17.0.2  Bcast:172.17.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:11 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:962 (962.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

/ # exit
[root@localhost ~]# docker container ls -a
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
[root@localhost ~]# docker ps -a
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

在创建容器时添加--network bridge与不加--network选项效果是一致的  默认就是桥接模式
[root@localhost ~]# docker run -it --name c1 --network bridge  --rm busybox
/ # ifconfig
eth0      Link encap:Ethernet  HWaddr 02:42:AC:11:00:02  
          inet addr:172.17.0.2  Bcast:172.17.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:696 (696.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

2.none模式配置

[root@localhost ~]# docker run -it --network none --rm busybox
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever

3.container模式配置

启动第一个容器

[root@localhost ~]# docker run -it --name a1 --rm busybox
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
14: eth0@if15: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

启动第二个容器

[root@localhost ~]# docker run  -it --name a2 --rm busybox
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
16: eth0@if17: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

可以看到名为a2的容器IP地址是172.17.0.3，与第一个容器的IP地址不是一样的，也就是说并没有共享网络，此时如果我们将第二个容器的启动方式改变一下，就可以使名为a2的容器IP与a1容器IP一致，也即共享IP，但不共享文件系统

[root@localhost ~]# docker run -it --name a2 --rm --network container:a1 busybox
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
14: eth0@if15: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

此时我们在a1容器上创建一个目录

/ # mkdir /tmp/data
/ # ls /tmp/
data

到a2容器上检查/tmp目录会发现并没有这个目录，因为文件系统是处于隔离状态，仅仅是共享了网络而已。

在a2容器上部署一个站点

/ # echo 'hello world' > /tmp/index.html
/ # ls /tmp/
index.html
/ # netstat -antl
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
/ # /bin/httpd -h /tmp/
/ # netstat -antl
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 :::80                   :::*                    LISTEN

在a1容器上用本地地址去访问此站点

/ # wget -O - -q 127.0.0.1:80
hello world

由此可见，container模式下的容器间关系就相当于一台主机上的两个不同进程

4.host模式配置

启动容器时直接指明模式为host

[root@localhost ~]# docker run -it --name a1 --rm --network host busybox
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel qlen 1000
    link/ether 00:0c:29:be:22:87 brd ff:ff:ff:ff:ff:ff
    inet 192.168.12.130/24 brd 192.168.12.255 scope global dynamic noprefixroute ens160
       valid_lft 1021sec preferred_lft 1021sec
    inet6 fe80::548d:cfb8:97e:668c/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue 
    link/ether 02:42:ef:a5:66:03 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:efff:fea5:6603/64 scope link 
       valid_lft forever preferred_lft forever

此时如果我们在这个容器中启动一个http站点，我们就可以直接用宿主机的IP直接在浏览器中访问这个容器中的站点了

[root@localhost ~]# docker run -it --name a1 --rm --network host busybox
/ # mkdir test
/ # echo "hhhhhh" > /test/index.html
/ # /bin/httpd -h /test/
/ # netstat  -antl
tcp        0      0 :::80                   :::*                    LISTEN

//开启另一个终端关闭防火墙
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# setenforce 0

效果图

三.容器的常用操作

1.查看容器的主机名

[root@localhost ~]# docker run -it --name a1 --network bridge --rm busybox
/ # hostname
e516130fb6e4

[root@localhost ~]# docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED         STATUS         PORTS     NAMES
e516130fb6e4   busybox   "sh"      2 minutes ago   Up 2 minutes

2.在容器启动时注入主机名

[root@localhost ~]# docker run -it --name t1 --network bridge --hostname youkun --rm busybox
/ # hostname 
youkun
/ # cat /etc/hosts
127.0.0.1       localhost
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2      youkun    注入主机名时会自动创建主机名到IP的映射关系

配置一个站点
/ # mkdir data
/ # echo 'yyds' > /data/index.html
/ # /bin/httpd -h /data/
/ # netstat -antl
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 :::80                   :::*                    LISTEN      
/ # wget -O - -q youkun     //因为主机名与ip有映射关系，所以主机名也可访问站点
yyds

3.手动指定容器要使用的DNS

[root@localhost ~]# docker run -it --name a1 --network bridge --hostname wangqing --dns 11.11.11.11 --rm busybox
/ # cat /etc/resolv.conf
search localdomain
nameserver 11.11.11.11

4.手动往/etc/hosts文件中注入主机名到IP地址的映射

[root@localhost ~]# docker run -it --rm --hostname youkun2 --add-host youkun1:172.17.0.2 busybox 
/ # cat /etc/hosts 
127.0.0.1       localhost
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2      youkun
172.17.0.2      youkun1