Äú¿ÉÒÔ¾èÖú£¬Ö§³ÖÎÒÃǵĹ«ÒæÊÂÒµ¡£

1Ôª 10Ôª 50Ôª





ÈÏÖ¤Â룺  ÑéÖ¤Âë,¿´²»Çå³þ?Çëµã»÷Ë¢ÐÂÑéÖ¤Âë ±ØÌî



  ÇóÖª ÎÄÕ ÎÄ¿â Lib ÊÓÆµ iPerson ¿Î³Ì ÈÏÖ¤ ×Éѯ ¹¤¾ß ½²×ù Model Center   Code  
»áÔ±   
   
 
     
   
 ¶©ÔÄ
  ¾èÖú
dockerÈÝÆ÷ÖеÄÍøÂçÔ­Àí£¨µ¥»úģʽϵÄÈÝÆ÷ÍøÂ磩
 
×÷ÕßêdzƣºÖàÖàͬѧ
  2006  次浏览      28
 2022-1-25
 
±à¼­ÍƼö:
µ¥»úʱ´úµÄÈÝÆ÷ͨÐŹý³Ì,È»ºó×öʵÑéÑéÖ¤ÕâÒ»¹ý³Ì £¬Ï£Íû¶ÔÄúµÄѧϰÓÐËù°ïÖú¡£
±¾ÎÄÀ´×ÔÓÚCSDN £¬ÓÉAlice±à¼­¡¢ÍƼö¡£

ÈÝÆ÷µÄ±¾ÖÊÊÇÒ»¸ö±»¸ôÀëµÄ½ø³Ì£¬¶øÕâ¸ö½ø³ÌÓÖÓÐÆä¶ÀÁ¢µÄÍøÂçÕ»£¬¼´Íø¿¨£¨Network Interface£©¡¢»Ø»·É豸£¨Loopback Device£©¡¢Â·ÓÉ±í£¨Routing Table£©ºÍ iptables ¹æÔò¡£µ¥»úʱ´úµÄÈÝÆ÷ÍøÂçʵ¼ÊÉÏÓÐÈýÖÖͨÐÅÐèÇ󣬷ֱðÊÇ£º

ÈÝÆ÷Ö®¼äͨÐÅ

ÈÝÆ÷ÓëËÞÖ÷»úÖ®¼äͨÐÅ

ÈÝÆ÷ÓëÍⲿÖ÷»úͨÐÅ

ÔÚdockerÖÐʵÏÖµ¥»úʱ´úÈÝÆ÷µÄÍøÂ磬Ö÷ÒªÒÀ¿¿ÒÔÏÂÕ⼸¸ö¹¤¾ß¡£

¸ÅÄî×ÜÊdzéÏóµÄ£¬ºóÃæÎÒ½«»á×öʵÑéʹÓÃÕâÈýÖÖÉ豸ģÄâÖ÷»úÉϵÄÈÝÆ÷ͨÐÅÁ÷³Ì£¬ÔÚÕâ֮ǰ£¬ÈÃÎÒÃÇÏȸãÃ÷°×µ¥»úʱ´úµÄÈÝÆ÷ͨÐŹý³Ì,È»ºó×öʵÑéÑéÖ¤ÕâÒ»¹ý³Ì¡£

ÈÝÆ÷ͨÐÅÔ­Àí

ÈÝÆ÷Ö®¼äͨÐÅ

²»Í¬ÈÝÆ÷Ö®¼äµÄͨÐÅ£¬ÀàËÆÓÚ²»Í¬Ö÷»úÖ®¼äµÄͨÐÅ¡£Èç¹ûÄãÏëҪʵÏÖÁ½Ì¨Ö÷»úÖ®¼äµÄͨÐÅ£¬×îÖ±½ÓµÄ°ì·¨£¬¾ÍÊǰÑËüÃÇÓÃÒ»¸ùÍøÏßÁ¬½ÓÆðÀ´£»¶øÈç¹ûÄãÏëҪʵÏÖ¶ą̀Ö÷»úÖ®¼äµÄͨÐÅ£¬ÄǾÍÐèÒªÓÃÍøÏߣ¬°ÑËüÃÇÁ¬½ÓÔÚһ̨½»»»»úÉÏ¡£ÔÚ Linux ÖУ¬Äܹ»Æðµ½ÐéÄâ½»»»»ú×÷ÓõÄÍøÂçÉ豸£¬ÊÇÍøÇÅ£¨Bridge£©¡£Docker ÏîÄ¿»áĬÈÏÔÚËÞÖ÷»úÉÏ´´½¨Ò»¸öÃû½Ð docker0 µÄÍøÇÅ£¬·²ÊÇÁ¬½ÓÔÚ docker0 ÍøÇÅÉϵÄÈÝÆ÷£¬¾Í¿ÉÒÔͨ¹ýËüÀ´½øÐÐͨÐÅ¡£ÓÚÊÇ£¬ÎÊÌâµÄ¹Ø¼üÔÚÈçºÎ½«ÈÝÆ÷Á¬½Óµ½docker0ÍøÇÅÉÏ¡£Ê¹ÓÃÒ»ÖÖÃû½ÐVeth PairµÄÐéÄâÉ豸¡£

Veth Pair É豸µÄÌØµãÊÇ£ºËü±»´´½¨³öÀ´ºó£¬×ÜÊÇÒÔÁ½ÕÅÐéÄâÍø¿¨£¨Veth Peer£©µÄÐÎʽ³É¶Ô³öÏֵġ£²¢ÇÒ£¬´ÓÆäÖÐÒ»¸ö¡°Íø¿¨¡±·¢³öµÄÊý¾Ý°ü£¬¿ÉÒÔÖ±½Ó³öÏÖÔÚÓëËü¶ÔÓ¦µÄÁíÒ»ÕÅ¡°Íø ¿¨¡±ÉÏ£¬ÄÄÅÂÕâÁ½¸ö¡°Íø¿¨¡±ÔÚ²»Í¬µÄ Network Namespace Àï¡£

ÏÂͼËùʾµÄcontainer1ÖеÄeth0 Íø¿¨£¬ÊÇÒ»¸ö Veth Pair£¬ËüµÄÒ»¶ËÔÚÕâ¸öÈÝÆ÷µÄ Network Namespace À¶øÁíÒ»¶ËÔòλÓÚËÞÖ÷»úÉÏ£¨Host Namespace£©£¬²¢ÇÒ±»¡°²å¡±ÔÚ ÁËËÞÖ÷»úµÄ docker0 ÍøÇÅÉÏ¡£Ò»µ©Ò»ÕÅÐéÄâÍø¿¨±»¡°²å¡±ÔÚÍøÇÅÉÏ£¬Ëü¾Í»á±ä³É¸ÃÍøÇŵġ°´ÓÉ豸¡±¡£´ÓÉ豸»á±»¡°°þ¶á¡±µ÷ÓÃÍøÂçЭÒéÕ»´¦ÀíÊý¾Ý°üµÄ×ʸñ£¬´Ó¶ø¡°½µ¼¶¡±³ÉÎªÍøÇÅÉϵÄÒ»¸ö¶Ë¿Ú¡£¶øÕâ¸ö¶Ë¿ÚΨһµÄ×÷Ó㬾ÍÊǽÓÊÕÁ÷ÈëµÄÊý¾Ý°ü£¬È»ºó°ÑÕâЩÊý¾Ý°üµÄ¡°Éúɱ´óȨ¡±£¨±ÈÈçת·¢»òÕß¶ªÆú£©£¬È«²¿½»¸ø¶ÔÓ¦µÄÍøÇÅ¡£

container1Óëcontainer2µÄͨÐŹý³ÌÈçÏÂËùʾ£º

1.container 1²é¿´×Ô¼ºµÄ·ÓÉ±í£¬Æ¥Åäµ½ºÏÊʵÄ·ÓÉ¡£ÈçÏÂËùʾ£¬container 1½«»áÆ¥Åäµ½µÚ¶þÌõ·ÓÉ£¬¼´Ö±Á¬Â·ÓÉ£¨·²ÊÇÆ¥Åäµ½ÕâÌõ¹æÔòµÄ IP °ü£¬Ó¦¸Ã¾­¹ý±¾»úµÄeth0Íø¿¨£¬Í¨¹ý¶þ²ãÍøÂçÖ±½Ó·¢ÍùÄ¿µÄÖ÷»ú£©,¼´ÎÞÐègatewayת·¢±ã¿ÉÒÔÖ±½Ó½«Êý¾Ý°üËÍ´ï¡£

route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 172.17.0.1 0.0.0.0 UG 0 0 0 eth0
172.17.0.0 * 255.255.0.0 U 0 0 0 eth0

2.·¢ÆðarpÇëÇ󣬲éѯĿ±êIPµØÖ·Îª172.17.0.3µÄÈÝÆ÷µÄmacµØÖ·¡£arp²éѯºó£¨ÒªÃ´´Óarp cacheÖÐÕÒµ½£¬ÒªÃ´ÔÚdocker0Õâ¸ö¶þ²ã½»»»»úÖзººé²éѯ£©»ñµÃ172.17.0.3µÄmacµØÖ·¡£

arp -n
(172.17.0.1) at 02:42:3e:c5:c8:5c [ether] on eth0
(172.17.0.3) at 02:42:ac:11:00:03 [ether] on eth0

3.µÃµ½¶ÔÓ¦macµØÖ·ºó£¬½«Êý¾Ý°üת·¢¸ø¸ÃmacµØÖ·¶ÔÓ¦µÄÍø¿¨¼´¿É¡£ÀàËÆ¾ÖÓòÍøÉÏÁ½Ì¨Ö÷»úÖ®¼äµÄͨÐŹý³Ì¡£´ËʱÁ½¸öcontainerÖ®¼äÁ¬Í¨£¬Ö÷Òª»¹ÊÇͨ¹ýÖ±Á¬ÍøÂ磬ʵÖÊÉÏÊÇdocker0ÔÚ¶þ²ãÆðµ½µÄ×÷Óá£

ÈÝÆ÷ÓëËÞÖ÷»úÖ®¼äͨÐÅ

µ±ÄãÔÚһ̨ËÞÖ÷»úÉÏ£¬·ÃÎʸÃËÞÖ÷»úÉϵÄÈÝÆ÷µÄ IP µØÖ·Ê±£¬Õâ¸öÇëÇóµÄÊý¾Ý°ü£¬ Ò²ÊÇÏȸù¾Ý·ÓɹæÔòµ½´ï docker0 ÍøÇÅ£¬È»ºó±»×ª·¢µ½¶ÔÓ¦µÄ Veth PairÉ豸£¬×îºó³öÏÖÔÚÈÝÆ÷Àï¡£Õâ¸ö¹ý³ÌµÄʾÒâͼ£¬ÈçÏÂËùʾ£º

1.ËÞÖ÷»ú²é¿´×Ô¼ºµÄ·ÓÉÐÅÏ¢£¬Æ¥Åäµ½ºÏÊʵÄ·ÓÉ£¬ÔÚ±¾ÀýÖУ¬Æ¥Åäµ½ÁËÖ±Á¬Â·ÓÉ£¬ÎÞÐègatewayת·¢±ã¿ÉÒÔÖ±½Ó½«Êý¾Ý°üËÍ´ï¡£

[root@node2 ~]# ip route
...
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
...

2.·¢ÆðarpÇëÇ󣬲éѯĿ±êIPµØÖ·Îª172.17.0.2µÄÈÝÆ÷µÄmacµØÖ·¡£arp²éѯºó£¨ÒªÃ´´Óarp cacheÖÐÕÒµ½£¬ÒªÃ´ÔÚdocker0Õâ¸ö¶þ²ã½»»»»úÖзººé²éѯ£©»ñµÃ172.17.0.2µÄmacµØÖ·¡£

[root@node2 ~]# ip neigh show dev docker0
172.17.0.2 lladdr 02:42:ac:11:00:02 STALE
172.17.0.3 lladdr 02:42:ac:11:00:03 STALE

3.µÃµ½¶ÔÓ¦macµØÖ·ºó£¬½«Êý¾Ý°üת·¢¸ø¸ÃmacµØÖ·¶ÔÓ¦µÄÍø¿¨¼´¿É¡£

ÈÝÆ÷ÓëËÞÖ÷»úÍⲿͨÐÅ

µ±Ò»¸öÈÝÆ÷ÊÔͼÁ¬½Óµ½ÁíÍâÒ»¸öËÞÖ÷»úʱ£¬±ÈÈ磺ping 10.168.0.3£¬Ëü·¢³öµÄÇëÇóÊý¾Ý°ü£¬Ê×ÏȾ­¹ý docker0 ÍøÇųöÏÖÔÚËÞÖ÷»úÉÏ¡£È»ºó¸ù¾ÝËÞÖ÷»úµÄ·ÓɱíÀïµÄÖ±Á¬Â·ÓɹæÔò £¨10.168.0.0/24 via eth0)£©£¬¶Ô 10.168.0.3 µÄ·ÃÎÊÇëÇó¾Í»á½»¸øËÞÖ÷»úµÄ eth0 ´¦Àí¡£ËùÒÔ½ÓÏÂÀ´£¬Õâ¸öÊý¾Ý°ü¾Í»á¾­ËÞÖ÷»úµÄ eth0 Íø¿¨×ª·¢µ½ËÞÖ÷»úÍøÂçÉÏ£¬×îÖÕµ½´ï 10.168.0.3 ¶ÔÓ¦µÄËÞÖ÷»úÉÏ¡£µ±È»£¬Õâ¸ö¹ý³ÌµÄʵÏÖÒªÇóÕâÁ½Ì¨ËÞÖ÷»ú±¾ÉíÊÇÁ¬Í¨µÄ¡£Õâ¸ö¹ý³ÌµÄʾÒâͼÈçÏÂËùʾ¡£

1.Ê×ÏÈ£¬¸ù¾ÝÉÏÒ»¸öÀý×Ó£¬¿ÉÒÔÖªµÀ£¬ÈÝÆ÷µ½ËÞÖ÷»úÖ®¼äµÄͨÐÅÊÇͨµÄ£¬¼´Êý¾Ý°üÄܹ»·¢Ë͵½docker0Íø¿¨ÉÏ£¬½øÈëµ½ËÞÖ÷»úÄں˿ռ䡣ÄÇôÎÊÌâµÄ¹Ø¼ü¾ÍÔÚÓÚ£¬Ôõô°ÑÕâ¸öÊý¾Ý°ü·¢Ë͵½ËÞÖ÷»úÍⲿ¡£

2.ÒÑÖª172.17.0.0/16Íø¶Î£¬ÊÇdockerרÃÅÓÃÀ´¸øÈÝÆ÷ͨÐÅʹÓõÄ˽ÓÐÍø¶Î¡£ÏëÒªÈÃÊý¾Ý°üÍ»ÆÆËÞÖ÷»úµÄ¹Ø¼ü¾ÍÔÚÓÚʹÓÃnat¼¼Êõ£¬½«Ô´ipµØÖ·ÎªÈÝÆ÷ip£¬Ä¿µÄÊÇÒªÓëÈÝÆ÷ÍⲿͨÐŵĵÄÊý¾Ý°ü£¬ÐÞ¸ÄΪMASQURADEģʽ£¬¼´ÐÞ¸ÄΪËÞÖ÷»úÍø¿¨µÄipµØÖ·¡£²é¿´iptables¹æÔò£¬·¢ÏÖÈçÏÂÒ»Ìõ¹æÔò¡£

-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
#½«Êý¾Ý°üÔ´µØÖ·ÊôÓÚdockerÍø¶ÎµÄ£¬²¢ÇÒ³ö¿ÚÍø¿¨²»ÊÇdocker0µÄ£¨¼´£©£¬¶¼×önat¼¼ÊõαװΪÆä³ö¿ÚÍø¿¨µØÖ·¡£

3.±»nat¼¼ÊõÐ޸ĹýµÄ±¨ÎĽ«»á±»·¢Ë͵½Ö÷»úÍⲿÓëÖ÷»ú½øÐÐͨÐÅ¡£

[root@node2 ~]# docker exec -it busybox3 sh
/ # ping www.baidu.com
PING www.baidu.com (220.181.112.244): 56 data bytes
64 bytes from 220.181.112.244: seq=0 ttl=50 time=36.401 ms
64 bytes from 220.181.112.244: seq=1 ttl=50 time=38.166 ms

docker0µÄ¶àÖØÉí·Ý

Àí½âdockerµ¥»úģʽϵÄͨÐÅÔ­Àí£¬ÆäºËÐÄÔÚÓÚÀí½âdocker0ÍøÇÅÔÚÕû¸öÈÝÆ÷ͨÐŹý³ÌÖге£µÄ×÷Óá£

ÏÂͼÖÐÎÒÃǸø³öÁËDocker0µÄË«ÖØÉí·Ý£¬²¢¶Ô±ÈÎïÀí½»»»»ú£¬ÎÒÃÇÀ´Àí½âÒ»ÏÂDocker0Õâ¸öÈíÍøÇÅ¡£

ͼ2 docker0µÄ¶àÖØÉí·Ý

1¡¢´ÓÈÝÆ÷Êӽǣ¬ÍøÇÅ£¨½»»»»ú£©Éí·Ý

docker0¶ÔÓÚͨ¹ýveth pair¡°²åÔÚ¡±ÍøÇÅÉϵÄcontainer1ºÍcontainer2À´Ëµ£¬Ê×ÏȾÍÊÇÒ»¸ö¶þ²ãµÄ½»»»»úµÄ½ÇÉ«£º·ººé¡¢Î¬»¤cam±í£¬ÔÚ¶þ²ãת·¢Êý¾Ý°ü£»Í¬Ê±ÓÉÓÚdocker0×ÔÉíÒ²¾ßÓÐmacµØÖ·£¨Õâ¸öÓë´¿¶þ²ã½»»»»ú²»Í¬£©£¬²¢ÇÒ°ó¶¨ÁËip(ÕâÀïÊÇ172.17.0.1)£¬Òò´ËÔÚ containerÖл¹×÷Ϊcontainer default·ÓɵÄĬÈÏGateway¶ø´æÔÚ¡£

2¡¢´ÓËÞÖ÷»úÊӽǣ¬Íø¿¨Éí·Ý

ÎïÀí½»»»»úÌṩÁËÓÉÓ²¼þʵÏֵĸßЧµÄ±³°åͨµÀ£¬¹©Á¬½ÓÔÚ½»»»»úÉϵÄÖ÷»ú¸ßЧʵÏÖ¶þ²ãͨÐÅ£»¶ÔÓÚ¿ªÆôÁËÈý²ãЭÒéµÄÎïÀí½»»»»ú¶øÑÔ£¬Æäip·ÓɵĴ¦Àí Ò²ÊÇÓÉÎïÀí½»»»»ú¹ÜÀí³ÌÐòÌṩµÄ¡£¶ÔÓÚdocker0¶øÑÔ£¬Æä¸ºÔð´¦Àí¶þ²ã½»»»»úÂß¼­ÒÔ¼°Èý²ãµÄ´¦Àí³ÌÐòÆäʵ¾ÍÊÇËÞÖ÷»úÉϵÄLinuxÄÚºË tcp/ipЭÒéÕ»³ÌÐò¡£¶ø´ÓËÞÖ÷»úÀ´¿´£¬ËùÓÐdocker0´Óveth£¨Ö»ÊǸö¶þ²ãµÄ´æÔÚ£¬Ã»Óаó¶¨ipv4µØÖ·£©½ÓÊÕµ½µÄÊý¾Ý°ü¶¼»á±»ËÞÖ÷»ú ¿´³É´Ódocker0Õâ¿éÍø¿¨£¨µÚ¶þ¸öÉí·Ý£¬°ó¶¨172.17.0.1)½ÓÊÕ½øÀ´µÄÊý¾Ý°ü£¬ÓÈÆäÊÇÔÚ½øÈëÈý²ãʱ£¬ËÞÖ÷»úÉϵÄiptables¾Í»á ¶Ôdocker0½øÀ´µÄÊý¾Ý°ü°´ÕÕrules½øÐÐÏàÓ¦´¦Àí£¨Í¨¹ýһЩÄÚºËÍøÂçÉèÖÃÒ²¿ÉÒÔºöÂÔdocker0 brigdeÊý¾ÝµÄ´¦Àí£©¡£

ÔÚDockerÈÝÆ÷ÍøÂçͨÐÅÁ÷³Ì·ÖÎöÖУ¬docker0ÔÚÕâÁ½ÖÖÉí·Ý¼äÀ´»ØÇл»¡£

ʵÑ飺ʹÓÃnamespaceÄ£ÄâÈÝÆ÷ͨÐÅ

ΪÁ˽øÒ»²½Á˽ânetwork namespace¡¢bridgeºÍvethÔÚdockerÈÝÆ÷ÍøÂçÖеĽÇÉ«ºÍ×÷Óã¬ÎÒÃÇÀ´×öÒ»¸ödemo£ºÓÃnetwork namespaceÄ£ÄâDockerÈÝÆ÷ÍøÂç¡£

ʵÑé»·¾³£º

centos7

ÍØÆË

ÒÑÖª£¬dockerÒýÇæÖеÄÈÝÆ÷ÍøÂçÈçͼ1Ëùʾ£¬Òò´Ë£¬ÎÒÃÇ¿ÉÒÔÓÃnetwork namespaceÀ´Ä£Äâ³öͬÑùµÄЧ¹û£¬ÊµÑéÍØÆËÈçͼ3Ëùʾ¡£

ͼ3 ʵÑéÄ£ÄâÍØÆË½á¹¹

ʵÑé²½Ö裺

1.´´½¨Á½¸ö¶ÀÁ¢µÄns

[root@node2 ~]# ip netns add ns1
[root@node2 ~]# ip netns add ns2 #²é¿´´´½¨µÄns
[root@node2 ~]# ip netns list
ns2
ns1
#ͨ¹ýip netns execÃüÁî¿ÉÒÔÔÚÌØ¶¨nsµÄÄÚ²¿Ö´ÐÐÏà¹Ø³ÌÐò£¨ÐéÄâÍøÂç¿Õ¼ä³ýÁËÍøÂçÊÇÐéµÄÒÔÍ⣬ÎļþϵͳÍêÈ«ºÍµ±Ç°ÏµÍ³¹²Ïí£¬Ò²¾ÍÊÇ˵ËùÓб¾µØ¿ÉÒÔʹÓõÄÃüÁî¶¼¿ÉÒÔÔÚÐéÄâÍøÂçÖÐʹÓã©£¬Õâ¸öexecÃüÁîÊÇÖÁ¹ØÖØÒªµÄ£¬ºóÐø»¹»á·¢»Ó¸ü´ó×÷ÓÃ


[root@node2 ~]# ip netns exec ns1 ip a s
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
[root@node2 ~]# ip netns exec ns1 route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
[root@node2 ~]# ip netns exec ns2 ip a s
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
#¿ÉÒÔ¿´µ½£¬Ð½¨µÄnsµÄÍøÂçÉ豸ֻÓÐÒ»¸öloopback¿Ú£¬²¢ÇÒ·ÓɱíΪ¿Õ¡£

2.´´½¨ÍøÇÅMyDocker0

[root@node2 ~]# brctl addbr MyDocker0
[root@node2 ~]# brctl show
bridge name bridge id STP enabled interfaces
MyDocker0 8000.000000000000 no
...
[root@node2 ~]# ip addr add 172.16.0.1/16 dev MyDocker0
#ΪMyDocker0ÍøÇÅ·ÖÅäipµØÖ·¡£
[root@node2 ~]# ip link set MyDocker0 up
#ÆôÓÃÍøÇÅÉ豸
[root@node2 ~]# ip route show
...
172.16.0.0/16 dev MyDocker0 proto kernel scope link src 172.16.0.1
...
#²é¿´ÏàÓ¦µÄ·ÓÉÐÅÏ¢

3.´´½¨²¢Á¬½ÓVeth PairÉ豸

µ½Ä¿Ç°ÎªÖ¹£¬default nsÓëns1¡¢ns2Ö®¼ä»¹Ã»ÓÐÈκÎÁªÏµ£¬½ÓÏÂÀ´£¬½«Ê¹ÓÃveth pair½«¶þÕßÁªÏµÆðÀ´¡£½ÓÏÂÀ´´´½¨ns1ºÍdefaultÖ®¼äµÄveth pair£¬veth1ºÍveth1p£¬²¢½«¶þÕß·Ö±ðÁ¬½Óµ½MyDocker0ÍøÇÅÉϺÍns1ÖС£

#´´½¨Á¬½Ódefault nsÓëns1Ö®¼äµÄveth pair¡£ veth1ºÍveth1p
[root@node2 ~]# ip link add veth1 type veth peer name veth1p
[root@node2 ~]# ip link show
...
20: veth1p@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether fa:06:c6:d6:53:bb brd ff:ff:ff:ff:ff:ff
21: veth1@veth1p: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 56:76:1d:19:69:77 brd ff:ff:ff:ff:ff:ff
...

#½«Íø¿¨²åµ½MyDocker0ÍøÇÅÉÏ,²¢¿ªÆô´ËÍø¿¨
[root@node2 ~]# brctl addif MyDocker0 veth1
[root@node2 ~]# ip link set veth1 up
[root@node2 ~]# brctl show
bridge name bridge id STP enabled interfaces
MyDocker0 8000.56761d196977 no veth1
...
#½«veth1p·ÅÈëns1ÖУº
[root@node2 ~]# ip link set veth1p netns ns1
[root@node2 ~]# ip netns exec ns1 ip a s
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
20: veth1p@if21: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether fa:06:c6:d6:53:bb brd ff:ff:ff:ff:ff:ff link-netnsid 0

#Õâʱ£¬ÄãÔÚdefault nsÖн«¿´²»µ½veth1pÕâ¸öÐéÄâÍøÂçÉ豸ÁË¡£°´ÕÕͼ3ÖеÄÍØÆË£¬Î»ÓÚns1ÖеÄveth1pÓ¦¸Ã¸üÃûΪeth0
#ÐÞ¸ÄÍø¿¨Ãû×Ö
[root@node2 ~]# ip netns exec ns1 ip link set veth1p name eth0
[root@node2 ~]# ip netns exec ns1 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
20: eth0@if21: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether fa:06:c6:d6:53:bb brd ff:ff:ff:ff:ff:ff link-netnsid 0
#½«ns1ÖеÄeth0ÉúЧ²¢ÅäÖÃIPµØÖ·£º
[root@node2 ~]# ip netns exec ns1 ip link set eth0 up
[root@node2 ~]# ip netns exec ns1 ip addr add 172.16.0.2/16 dev eth0
[root@node2 ~]# ip netns exec ns1 ip route add default via 172.16.0.1
#Ìí¼ÓĬÈÏ·ÓÉ£¬Ê¹µÃnsÓëÖ÷»úÉÏµÄÆäËûnsÄܹ»Á¬Í¨¡£

¶Ôns2½øÐÐÏàͬµÄ²½Öè

ip link add veth2 type veth peer name veth2p
#н¨veth pairÉ豸
brctl addif MyDocker0 veth2
#½«veth pairÒ»¶Ë²åÈëÍøÇÅ
ip link set veth2 up
#¿ªÆôÍø¿¨
ip link set veth2p netns ns2
#½«vethpairÒ»¶Ë·Åµ½Ö¸¶¨nsÖÐ
ip netns exec ns2 ip link set veth2p name eth0
ip netns exec ns2 ip link set eth0 up
#ÐÞ¸Äns2ÖеÄÍø¿¨Ãû×Ö£¬²¢ÖØÆô¡£
ip netns exec ns2 ip addr add 172.16.0.3/16 dev eth0
#¸øns2ÖеÄÍø¿¨Ìí¼ÓµØÖ·
ip netns exec ns2 ip route add default via 172.16.0.1
#Ìí¼ÓĬÈÏ·ÓÉ£¬Ê¹µÃnsÓëÖ÷»úÉÏµÄÆäËûnsÄܹ»Á¬Í¨¡£

²âÊÔÁ¬Í¨ÐÔ£º

  • ns1ºÍMyDocker0ÊÇ·ñ»¥Í¨,
  • ns1Óëns2ÊÇ·ñ»¥Í¨£¬
  • ns1ÓëËÞÖ÷»úµÄÆäËûÍø¿¨£¨±ÈÈçdockerÖеÄdocker0ÍøÇÅÊÇ·ñÏàͨ£©
  • ns1ÓëËÞÖ÷»úÍâµÄÆäËûÖ÷»úÊÇ·ñ»¥Í¨
[root@node2 ~]# ip netns exec ns1 ping -c 3 172.16.0.1
PING 172.16.0.1 (172.16.0.1) 56(84) bytes of data.
64 bytes from 172.16.0.1: icmp_seq=1 ttl=64 time=0.236 ms
64 bytes from 172.16.0.1: icmp_seq=2 ttl=64 time=0.152 ms
64 bytes from 172.16.0.1: icmp_seq=3 ttl=64 time=0.238 ms
--- 172.16.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, t
#ns1ºÍMyDocker0Á¬Í¨

[root@node2 ~]# ip netns exec ns1 ping -c 3 172.17.0.1
PING 172.17.0.1 (172.17.0.1) 56(84) bytes of data.
64 bytes from 172.17.0.1: icmp_seq=1 ttl=64 time=0.104 ms
64 bytes from 172.17.0.1: icmp_seq=2 ttl=64 time=0.117 ms
#ns1Óëdocker0Á¬Í¨

[root@node2 ~]# ip netns exec ns1 ping -c 3 172.16.0.3
PING 172.16.0.3 (172.16.0.3) 56(84) bytes of data.
64 bytes from 172.16.0.3: icmp_seq=1 ttl=64 time=0.153 ms
64 bytes from 172.16.0.3: icmp_seq=2 ttl=64 time=0.146 ms
#ns1Óëns2Á¬Í¨

#ʵÏÖ×ÔÖÆµÄnsÓëÍâÍø½øÐÐͨÐÅ¡£
[root@node2 ~]# iptables -t nat -A POSTROUTING -s 172.16.0.0/16 ! -o mydocker0 -j MASQUERADE
#Ôö¼ÓÒ»Ìõ
[root@node2 ~]# ip netns exec ns1 ping www.baidu.com
PING www.wshifen.com (103.235.46.39) 56(84) bytes of data.
64 bytes from 103.235.46.39 (103.235.46.39): icmp_seq=1 ttl=42 time=247 ms
64 bytes from 103.235.46.39 (103.235.46.39): icmp_seq=2 ttl=42 time=235 ms

×ÔÖÆnsÓëdockerÈÝÆ÷Ö®¼äµÄͨÐÅÁ÷³Ì

Èç¹ûÊÇÔÚns1ÖÐpingij¸ödocker containerµÄµØÖ·£¬±ÈÈç172.17.0.2£¬ÄÇôÆäÁ÷³ÌÈçÏÂËùʾ¡£

1.µ±pingÖ´Ðк󣬸ù¾Ýns1ϵķÓÉ±í£¬Ã»ÓÐÆ¥Åäµ½Ö±Á¬ÍøÂ磬ֻÄÜͨ¹ýdefault·Óɽ«Êý¾Ý°üת·¢¸øGateway: 172.16.0.1¡£

2.MyDocker0½ÓÊÕµ½Êý¾Ý£¬Êý¾Ý½øÈëµ½ËÞÖ÷»úµÄÄں˿ռ䡣ËäÈ»¶¼ÊÇMyDocker0½ÓÊÕÊý¾Ý£¬µ«Õâ´Î¸üÀàËÆÓÚ¡°Êý¾Ý±»Ö±½Ó·¢µ½ Bridge ÉÏ£¬¶ø²»ÊÇBridge´ÓÒ»¸ö¶Ë¿Ú½ÓÊÕ¡£¶þ²ãµÄÄ¿µÄmacµØÖ·ÌîдµÄÊÇgateway 172.16.0.1×Ô¼ºµÄmacµØÖ·£¨BridgeµÄmacµØÖ·£©£¬´ËʱµÄMyDocker0¸üÏñÊÇÒ»¿éÆÕÍ¨Íø¿¨µÄ½ÇÉ«£¬¹¤×÷ÔÚÈý²ã(¶ø²»ÊÇ֮ǰµÄ¶þ²ãÍøÇŵĽÇÉ«)¡£

3.MyDocker0ÊÕµ½Êý¾Ý°üºó£¬·¢ÏÖ²¢·ÇÊÇ·¢¸ø×Ô¼ºµÄip°ü£¬Í¨¹ýÖ÷»ú·ÓɱíÕÒµ½Ö±Á¬Â·ÓÉ£¨·²ÊÇÆ¥Åäµ½ÕâÌõ¹æÔòµÄ IP °ü£¬Í¨¹ý¶þ²ãÍøÂçÖ±½Ó·¢ÍùÄ¿µÄÖ÷»ú£©£¬Í¨¹ýarp²éѯ£¬²éѯµ½IPµØÖ·Îª172.17.0.2µÄmacµØÖ·¡£È»ºóͨ¹ý¶þ²ãÍøÂ罫Êý¾Ý°üת·¢µ½docker containerÖС£

[root@node2 ~]# ip neigh show dev docker0
172.17.0.2 lladdr 02:42:ac:11:00:02 STALE

MyDocker0½«Êý¾Ý°üForwardµ½Í¨¹ýtraceroute¿ÉÒÔÓ¡Ö¤ÕâÒ»¹ý³Ì£º

[root@node2 ~]# ip netns exec ns1 traceroute -n 172.17.0.2
traceroute to 172.17.0.2 (172.17.0.2), 30 hops max, 60 byte packets
1 172.16.0.1 0.100 ms 0.052 ms 0.050 ms
2 172.17.0.2 0.138 ms 0.117 ms 0.119 ms
   
2006 ´Îä¯ÀÀ       28
Ïà¹ØÎÄÕÂ

ÔÆ¼ÆËãµÄ¼Ü¹¹
¶ÔÔÆ¼ÆËã·þÎñÄ£ÐÍ
ÔÆ¼ÆËãºËÐļ¼ÊõÆÊÎö
Á˽âÔÆ¼ÆËãµÄ©¶´
Ïà¹ØÎĵµ

ÔÆ¼ÆËã¼ò½é
ÔÆ¼ÆËã¼ò½éÓëÔÆ°²È«
ÏÂÒ»´úÍøÂç¼ÆËã--ÔÆ¼ÆËã
ÈídzÎöÔÆ¼ÆËã
Ïà¹Ø¿Î³Ì

ÔÆ¼ÆËãÔ­ÀíÓëÓ¦ÓÃ
ÔÆ¼ÆËãÓ¦ÓÃÓ뿪·¢
CMMIÌåϵÓëʵ¼ù
»ùÓÚCMMI±ê×¼µÄÈí¼þÖÊÁ¿±£Ö¤
×îл¼Æ»®
DeepSeek´óÄ£ÐÍÓ¦Óÿª·¢ 6-12[ÏÃÃÅ]
È˹¤ÖÇÄÜ.»úÆ÷ѧϰTensorFlow 6-22[Ö±²¥]
»ùÓÚ UML ºÍEA½øÐзÖÎöÉè¼Æ 6-30[±±¾©]
ǶÈëʽÈí¼þ¼Ü¹¹-¸ß¼¶Êµ¼ù 7-9[±±¾©]
Óû§ÌåÑé¡¢Ò×ÓÃÐÔ²âÊÔÓëÆÀ¹À 7-25[Î÷°²]
ͼÊý¾Ý¿âÓë֪ʶͼÆ× 8-23[±±¾©]
 
×îÐÂÎÄÕÂ
ÔÆÔ­Éú¼Ü¹¹¸ÅÊö
K8S¸ß¿ÉÓü¯Èº¼Ü¹¹ÊµÏÖ
ÈÝÆ÷ÔÆ¹ÜÀíÖ®K8S¼¯Èº¸ÅÊö
k8s-ÕûÌå¸ÅÊöºÍ¼Ü¹¹
Ê®·ÖÖÓѧ»áÓÃdocker²¿Êð΢·þÎñ
×îпγÌ
ÔÆ¼ÆË㡢΢·þÎñÓë·Ö²¼Ê½¼Ü¹¹
Æóҵ˽ÓÐÔÆÔ­ÀíÓë¹¹½¨
»ùÓÚKubernetesµÄDevOpsʵ¼ù
ÔÆÆ½Ì¨¼Ü¹¹ÓëÓ¦Ó㨰¢ÀïÔÆ£©
Docker²¿Êð±»²âϵͳÓë×Ô¶¯»¯¿ò¼Üʵ¼ù
³É¹¦°¸Àý
±±¾© ÔÆÆ½Ì¨Óë΢·þÎñ¼Ü¹¹Éè¼Æ
ͨÓù«Ë¾GE DockerÔ­ÀíÓëʵ¼ùÅàѵ
ij¾ü¹¤Ñо¿µ¥Î» MDA£¨Ä£ÐÍÇý¶¯¼Ü¹¹£©
ÖªÃûÏû·Ñ½ðÈÚ¹«Ë¾ ÁìÓòÇý¶¯Éè¼Æ
ÉîÛÚijÆû³µÆóÒµ Ä£ÐÍÇý¶¯µÄ·ÖÎöÉè¼Æ