±à¼ÍƼö: |
µ¥»úʱ´úµÄÈÝÆ÷ͨÐŹý³Ì,È»ºó×öʵÑéÑéÖ¤ÕâÒ»¹ý³Ì
£¬Ï£Íû¶ÔÄúµÄѧϰÓÐËù°ïÖú¡£
±¾ÎÄÀ´×ÔÓÚCSDN
£¬ÓÉAlice±à¼¡¢ÍƼö¡£ |
|
ÈÝÆ÷µÄ±¾ÖÊÊÇÒ»¸ö±»¸ôÀëµÄ½ø³Ì£¬¶øÕâ¸ö½ø³ÌÓÖÓÐÆä¶ÀÁ¢µÄÍøÂçÕ»£¬¼´Íø¿¨£¨Network Interface£©¡¢»Ø»·É豸£¨Loopback Device£©¡¢Â·ÓÉ±í£¨Routing Table£©ºÍ iptables ¹æÔò¡£µ¥»úʱ´úµÄÈÝÆ÷ÍøÂçʵ¼ÊÉÏÓÐÈýÖÖͨÐÅÐèÇ󣬷ֱðÊÇ£º
ÈÝÆ÷Ö®¼äͨÐÅ
ÈÝÆ÷ÓëËÞÖ÷»úÖ®¼äͨÐÅ
ÈÝÆ÷ÓëÍⲿÖ÷»úͨÐÅ
ÔÚdockerÖÐʵÏÖµ¥»úʱ´úÈÝÆ÷µÄÍøÂ磬Ö÷ÒªÒÀ¿¿ÒÔÏÂÕ⼸¸ö¹¤¾ß¡£

¸ÅÄî×ÜÊdzéÏóµÄ£¬ºóÃæÎÒ½«»á×öʵÑéʹÓÃÕâÈýÖÖÉ豸ģÄâÖ÷»úÉϵÄÈÝÆ÷ͨÐÅÁ÷³Ì£¬ÔÚÕâ֮ǰ£¬ÈÃÎÒÃÇÏȸãÃ÷°×µ¥»úʱ´úµÄÈÝÆ÷ͨÐŹý³Ì,È»ºó×öʵÑéÑéÖ¤ÕâÒ»¹ý³Ì¡£
ÈÝÆ÷ͨÐÅÔÀí
ÈÝÆ÷Ö®¼äͨÐÅ
²»Í¬ÈÝÆ÷Ö®¼äµÄͨÐÅ£¬ÀàËÆÓÚ²»Í¬Ö÷»úÖ®¼äµÄͨÐÅ¡£Èç¹ûÄãÏëҪʵÏÖÁ½Ì¨Ö÷»úÖ®¼äµÄͨÐÅ£¬×îÖ±½ÓµÄ°ì·¨£¬¾ÍÊǰÑËüÃÇÓÃÒ»¸ùÍøÏßÁ¬½ÓÆðÀ´£»¶øÈç¹ûÄãÏëҪʵÏÖ¶ą̀Ö÷»úÖ®¼äµÄͨÐÅ£¬ÄǾÍÐèÒªÓÃÍøÏߣ¬°ÑËüÃÇÁ¬½ÓÔÚһ̨½»»»»úÉÏ¡£ÔÚ Linux ÖУ¬Äܹ»Æðµ½ÐéÄâ½»»»»ú×÷ÓõÄÍøÂçÉ豸£¬ÊÇÍøÇÅ£¨Bridge£©¡£Docker ÏîÄ¿»áĬÈÏÔÚËÞÖ÷»úÉÏ´´½¨Ò»¸öÃû½Ð docker0 µÄÍøÇÅ£¬·²ÊÇÁ¬½ÓÔÚ docker0 ÍøÇÅÉϵÄÈÝÆ÷£¬¾Í¿ÉÒÔͨ¹ýËüÀ´½øÐÐͨÐÅ¡£ÓÚÊÇ£¬ÎÊÌâµÄ¹Ø¼üÔÚÈçºÎ½«ÈÝÆ÷Á¬½Óµ½docker0ÍøÇÅÉÏ¡£Ê¹ÓÃÒ»ÖÖÃû½ÐVeth PairµÄÐéÄâÉ豸¡£
Veth Pair É豸µÄÌØµãÊÇ£ºËü±»´´½¨³öÀ´ºó£¬×ÜÊÇÒÔÁ½ÕÅÐéÄâÍø¿¨£¨Veth Peer£©µÄÐÎʽ³É¶Ô³öÏֵġ£²¢ÇÒ£¬´ÓÆäÖÐÒ»¸ö¡°Íø¿¨¡±·¢³öµÄÊý¾Ý°ü£¬¿ÉÒÔÖ±½Ó³öÏÖÔÚÓëËü¶ÔÓ¦µÄÁíÒ»ÕÅ¡°Íø ¿¨¡±ÉÏ£¬ÄÄÅÂÕâÁ½¸ö¡°Íø¿¨¡±ÔÚ²»Í¬µÄ Network Namespace Àï¡£
ÏÂͼËùʾµÄcontainer1ÖеÄeth0 Íø¿¨£¬ÊÇÒ»¸ö Veth Pair£¬ËüµÄÒ»¶ËÔÚÕâ¸öÈÝÆ÷µÄ Network Namespace À¶øÁíÒ»¶ËÔòλÓÚËÞÖ÷»úÉÏ£¨Host Namespace£©£¬²¢ÇÒ±»¡°²å¡±ÔÚ ÁËËÞÖ÷»úµÄ docker0 ÍøÇÅÉÏ¡£Ò»µ©Ò»ÕÅÐéÄâÍø¿¨±»¡°²å¡±ÔÚÍøÇÅÉÏ£¬Ëü¾Í»á±ä³É¸ÃÍøÇŵġ°´ÓÉ豸¡±¡£´ÓÉ豸»á±»¡°°þ¶á¡±µ÷ÓÃÍøÂçÐÒéÕ»´¦ÀíÊý¾Ý°üµÄ×ʸñ£¬´Ó¶ø¡°½µ¼¶¡±³ÉÎªÍøÇÅÉϵÄÒ»¸ö¶Ë¿Ú¡£¶øÕâ¸ö¶Ë¿ÚΨһµÄ×÷Ó㬾ÍÊǽÓÊÕÁ÷ÈëµÄÊý¾Ý°ü£¬È»ºó°ÑÕâЩÊý¾Ý°üµÄ¡°Éúɱ´óȨ¡±£¨±ÈÈçת·¢»òÕß¶ªÆú£©£¬È«²¿½»¸ø¶ÔÓ¦µÄÍøÇÅ¡£

container1Óëcontainer2µÄͨÐŹý³ÌÈçÏÂËùʾ£º
1.container 1²é¿´×Ô¼ºµÄ·ÓÉ±í£¬Æ¥Åäµ½ºÏÊʵÄ·ÓÉ¡£ÈçÏÂËùʾ£¬container 1½«»áÆ¥Åäµ½µÚ¶þÌõ·ÓÉ£¬¼´Ö±Á¬Â·ÓÉ£¨·²ÊÇÆ¥Åäµ½ÕâÌõ¹æÔòµÄ IP °ü£¬Ó¦¸Ã¾¹ý±¾»úµÄeth0Íø¿¨£¬Í¨¹ý¶þ²ãÍøÂçÖ±½Ó·¢ÍùÄ¿µÄÖ÷»ú£©,¼´ÎÞÐègatewayת·¢±ã¿ÉÒÔÖ±½Ó½«Êý¾Ý°üËÍ´ï¡£
route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 172.17.0.1 0.0.0.0 UG 0 0 0 eth0
172.17.0.0 * 255.255.0.0 U 0 0 0 eth0
|
2.·¢ÆðarpÇëÇ󣬲éѯĿ±êIPµØÖ·Îª172.17.0.3µÄÈÝÆ÷µÄmacµØÖ·¡£arp²éѯºó£¨ÒªÃ´´Óarp cacheÖÐÕÒµ½£¬ÒªÃ´ÔÚdocker0Õâ¸ö¶þ²ã½»»»»úÖзººé²éѯ£©»ñµÃ172.17.0.3µÄmacµØÖ·¡£
arp -n
(172.17.0.1) at 02:42:3e:c5:c8:5c [ether] on eth0
(172.17.0.3) at 02:42:ac:11:00:03 [ether] on eth0
|
3.µÃµ½¶ÔÓ¦macµØÖ·ºó£¬½«Êý¾Ý°üת·¢¸ø¸ÃmacµØÖ·¶ÔÓ¦µÄÍø¿¨¼´¿É¡£ÀàËÆ¾ÖÓòÍøÉÏÁ½Ì¨Ö÷»úÖ®¼äµÄͨÐŹý³Ì¡£´ËʱÁ½¸öcontainerÖ®¼äÁ¬Í¨£¬Ö÷Òª»¹ÊÇͨ¹ýÖ±Á¬ÍøÂ磬ʵÖÊÉÏÊÇdocker0ÔÚ¶þ²ãÆðµ½µÄ×÷Óá£
ÈÝÆ÷ÓëËÞÖ÷»úÖ®¼äͨÐÅ
µ±ÄãÔÚһ̨ËÞÖ÷»úÉÏ£¬·ÃÎʸÃËÞÖ÷»úÉϵÄÈÝÆ÷µÄ IP µØÖ·Ê±£¬Õâ¸öÇëÇóµÄÊý¾Ý°ü£¬ Ò²ÊÇÏȸù¾Ý·ÓɹæÔòµ½´ï docker0 ÍøÇÅ£¬È»ºó±»×ª·¢µ½¶ÔÓ¦µÄ Veth PairÉ豸£¬×îºó³öÏÖÔÚÈÝÆ÷Àï¡£Õâ¸ö¹ý³ÌµÄʾÒâͼ£¬ÈçÏÂËùʾ£º

1.ËÞÖ÷»ú²é¿´×Ô¼ºµÄ·ÓÉÐÅÏ¢£¬Æ¥Åäµ½ºÏÊʵÄ·ÓÉ£¬ÔÚ±¾ÀýÖУ¬Æ¥Åäµ½ÁËÖ±Á¬Â·ÓÉ£¬ÎÞÐègatewayת·¢±ã¿ÉÒÔÖ±½Ó½«Êý¾Ý°üËÍ´ï¡£
[root@node2 ~]# ip route
...
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
... |
2.·¢ÆðarpÇëÇ󣬲éѯĿ±êIPµØÖ·Îª172.17.0.2µÄÈÝÆ÷µÄmacµØÖ·¡£arp²éѯºó£¨ÒªÃ´´Óarp cacheÖÐÕÒµ½£¬ÒªÃ´ÔÚdocker0Õâ¸ö¶þ²ã½»»»»úÖзººé²éѯ£©»ñµÃ172.17.0.2µÄmacµØÖ·¡£
[root@node2 ~]# ip neigh show dev docker0
172.17.0.2 lladdr 02:42:ac:11:00:02 STALE
172.17.0.3 lladdr 02:42:ac:11:00:03 STALE |
3.µÃµ½¶ÔÓ¦macµØÖ·ºó£¬½«Êý¾Ý°üת·¢¸ø¸ÃmacµØÖ·¶ÔÓ¦µÄÍø¿¨¼´¿É¡£
ÈÝÆ÷ÓëËÞÖ÷»úÍⲿͨÐÅ
µ±Ò»¸öÈÝÆ÷ÊÔͼÁ¬½Óµ½ÁíÍâÒ»¸öËÞÖ÷»úʱ£¬±ÈÈ磺ping 10.168.0.3£¬Ëü·¢³öµÄÇëÇóÊý¾Ý°ü£¬Ê×ÏȾ¹ý docker0 ÍøÇųöÏÖÔÚËÞÖ÷»úÉÏ¡£È»ºó¸ù¾ÝËÞÖ÷»úµÄ·ÓɱíÀïµÄÖ±Á¬Â·ÓɹæÔò £¨10.168.0.0/24 via eth0)£©£¬¶Ô 10.168.0.3 µÄ·ÃÎÊÇëÇó¾Í»á½»¸øËÞÖ÷»úµÄ eth0 ´¦Àí¡£ËùÒÔ½ÓÏÂÀ´£¬Õâ¸öÊý¾Ý°ü¾Í»á¾ËÞÖ÷»úµÄ eth0 Íø¿¨×ª·¢µ½ËÞÖ÷»úÍøÂçÉÏ£¬×îÖÕµ½´ï 10.168.0.3 ¶ÔÓ¦µÄËÞÖ÷»úÉÏ¡£µ±È»£¬Õâ¸ö¹ý³ÌµÄʵÏÖÒªÇóÕâÁ½Ì¨ËÞÖ÷»ú±¾ÉíÊÇÁ¬Í¨µÄ¡£Õâ¸ö¹ý³ÌµÄʾÒâͼÈçÏÂËùʾ¡£

1.Ê×ÏÈ£¬¸ù¾ÝÉÏÒ»¸öÀý×Ó£¬¿ÉÒÔÖªµÀ£¬ÈÝÆ÷µ½ËÞÖ÷»úÖ®¼äµÄͨÐÅÊÇͨµÄ£¬¼´Êý¾Ý°üÄܹ»·¢Ë͵½docker0Íø¿¨ÉÏ£¬½øÈëµ½ËÞÖ÷»úÄں˿ռ䡣ÄÇôÎÊÌâµÄ¹Ø¼ü¾ÍÔÚÓÚ£¬Ôõô°ÑÕâ¸öÊý¾Ý°ü·¢Ë͵½ËÞÖ÷»úÍⲿ¡£
2.ÒÑÖª172.17.0.0/16Íø¶Î£¬ÊÇdockerרÃÅÓÃÀ´¸øÈÝÆ÷ͨÐÅʹÓõÄ˽ÓÐÍø¶Î¡£ÏëÒªÈÃÊý¾Ý°üÍ»ÆÆËÞÖ÷»úµÄ¹Ø¼ü¾ÍÔÚÓÚʹÓÃnat¼¼Êõ£¬½«Ô´ipµØÖ·ÎªÈÝÆ÷ip£¬Ä¿µÄÊÇÒªÓëÈÝÆ÷ÍⲿͨÐŵĵÄÊý¾Ý°ü£¬ÐÞ¸ÄΪMASQURADEģʽ£¬¼´ÐÞ¸ÄΪËÞÖ÷»úÍø¿¨µÄipµØÖ·¡£²é¿´iptables¹æÔò£¬·¢ÏÖÈçÏÂÒ»Ìõ¹æÔò¡£
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
#½«Êý¾Ý°üÔ´µØÖ·ÊôÓÚdockerÍø¶ÎµÄ£¬²¢ÇÒ³ö¿ÚÍø¿¨²»ÊÇdocker0µÄ£¨¼´£©£¬¶¼×önat¼¼ÊõαװΪÆä³ö¿ÚÍø¿¨µØÖ·¡£ |
3.±»nat¼¼ÊõÐ޸ĹýµÄ±¨ÎĽ«»á±»·¢Ë͵½Ö÷»úÍⲿÓëÖ÷»ú½øÐÐͨÐÅ¡£
[root@node2 ~]# docker exec -it busybox3 sh
/ # ping www.baidu.com
PING www.baidu.com (220.181.112.244): 56 data bytes
64 bytes from 220.181.112.244: seq=0 ttl=50 time=36.401 ms
64 bytes from 220.181.112.244: seq=1 ttl=50 time=38.166 ms |
docker0µÄ¶àÖØÉí·Ý
Àí½âdockerµ¥»úģʽϵÄͨÐÅÔÀí£¬ÆäºËÐÄÔÚÓÚÀí½âdocker0ÍøÇÅÔÚÕû¸öÈÝÆ÷ͨÐŹý³ÌÖге£µÄ×÷Óá£
ÏÂͼÖÐÎÒÃǸø³öÁËDocker0µÄË«ÖØÉí·Ý£¬²¢¶Ô±ÈÎïÀí½»»»»ú£¬ÎÒÃÇÀ´Àí½âÒ»ÏÂDocker0Õâ¸öÈíÍøÇÅ¡£

ͼ2 docker0µÄ¶àÖØÉí·Ý
1¡¢´ÓÈÝÆ÷Êӽǣ¬ÍøÇÅ£¨½»»»»ú£©Éí·Ý
docker0¶ÔÓÚͨ¹ýveth pair¡°²åÔÚ¡±ÍøÇÅÉϵÄcontainer1ºÍcontainer2À´Ëµ£¬Ê×ÏȾÍÊÇÒ»¸ö¶þ²ãµÄ½»»»»úµÄ½ÇÉ«£º·ººé¡¢Î¬»¤cam±í£¬ÔÚ¶þ²ãת·¢Êý¾Ý°ü£»Í¬Ê±ÓÉÓÚdocker0×ÔÉíÒ²¾ßÓÐmacµØÖ·£¨Õâ¸öÓë´¿¶þ²ã½»»»»ú²»Í¬£©£¬²¢ÇÒ°ó¶¨ÁËip(ÕâÀïÊÇ172.17.0.1)£¬Òò´ËÔÚ containerÖл¹×÷Ϊcontainer default·ÓɵÄĬÈÏGateway¶ø´æÔÚ¡£
2¡¢´ÓËÞÖ÷»úÊӽǣ¬Íø¿¨Éí·Ý
ÎïÀí½»»»»úÌṩÁËÓÉÓ²¼þʵÏֵĸßЧµÄ±³°åͨµÀ£¬¹©Á¬½ÓÔÚ½»»»»úÉϵÄÖ÷»ú¸ßЧʵÏÖ¶þ²ãͨÐÅ£»¶ÔÓÚ¿ªÆôÁËÈý²ãÐÒéµÄÎïÀí½»»»»ú¶øÑÔ£¬Æäip·ÓɵĴ¦Àí Ò²ÊÇÓÉÎïÀí½»»»»ú¹ÜÀí³ÌÐòÌṩµÄ¡£¶ÔÓÚdocker0¶øÑÔ£¬Æä¸ºÔð´¦Àí¶þ²ã½»»»»úÂß¼ÒÔ¼°Èý²ãµÄ´¦Àí³ÌÐòÆäʵ¾ÍÊÇËÞÖ÷»úÉϵÄLinuxÄÚºË tcp/ipÐÒéÕ»³ÌÐò¡£¶ø´ÓËÞÖ÷»úÀ´¿´£¬ËùÓÐdocker0´Óveth£¨Ö»ÊǸö¶þ²ãµÄ´æÔÚ£¬Ã»Óаó¶¨ipv4µØÖ·£©½ÓÊÕµ½µÄÊý¾Ý°ü¶¼»á±»ËÞÖ÷»ú ¿´³É´Ódocker0Õâ¿éÍø¿¨£¨µÚ¶þ¸öÉí·Ý£¬°ó¶¨172.17.0.1)½ÓÊÕ½øÀ´µÄÊý¾Ý°ü£¬ÓÈÆäÊÇÔÚ½øÈëÈý²ãʱ£¬ËÞÖ÷»úÉϵÄiptables¾Í»á ¶Ôdocker0½øÀ´µÄÊý¾Ý°ü°´ÕÕrules½øÐÐÏàÓ¦´¦Àí£¨Í¨¹ýһЩÄÚºËÍøÂçÉèÖÃÒ²¿ÉÒÔºöÂÔdocker0 brigdeÊý¾ÝµÄ´¦Àí£©¡£
ÔÚDockerÈÝÆ÷ÍøÂçͨÐÅÁ÷³Ì·ÖÎöÖУ¬docker0ÔÚÕâÁ½ÖÖÉí·Ý¼äÀ´»ØÇл»¡£
ʵÑ飺ʹÓÃnamespaceÄ£ÄâÈÝÆ÷ͨÐÅ
ΪÁ˽øÒ»²½Á˽ânetwork namespace¡¢bridgeºÍvethÔÚdockerÈÝÆ÷ÍøÂçÖеĽÇÉ«ºÍ×÷Óã¬ÎÒÃÇÀ´×öÒ»¸ödemo£ºÓÃnetwork namespaceÄ£ÄâDockerÈÝÆ÷ÍøÂç¡£
ʵÑé»·¾³£º
centos7
ÍØÆË
ÒÑÖª£¬dockerÒýÇæÖеÄÈÝÆ÷ÍøÂçÈçͼ1Ëùʾ£¬Òò´Ë£¬ÎÒÃÇ¿ÉÒÔÓÃnetwork namespaceÀ´Ä£Äâ³öͬÑùµÄЧ¹û£¬ÊµÑéÍØÆËÈçͼ3Ëùʾ¡£

ͼ3 ʵÑéÄ£ÄâÍØÆË½á¹¹
ʵÑé²½Ö裺
1.´´½¨Á½¸ö¶ÀÁ¢µÄns
[root@node2 ~]# ip netns add ns1
[root@node2 ~]# ip netns add ns2
#²é¿´´´½¨µÄns
[root@node2 ~]# ip netns list
ns2
ns1
#ͨ¹ýip netns execÃüÁî¿ÉÒÔÔÚÌØ¶¨nsµÄÄÚ²¿Ö´ÐÐÏà¹Ø³ÌÐò£¨ÐéÄâÍøÂç¿Õ¼ä³ýÁËÍøÂçÊÇÐéµÄÒÔÍ⣬ÎļþϵͳÍêÈ«ºÍµ±Ç°ÏµÍ³¹²Ïí£¬Ò²¾ÍÊÇ˵ËùÓб¾µØ¿ÉÒÔʹÓõÄÃüÁî¶¼¿ÉÒÔÔÚÐéÄâÍøÂçÖÐʹÓã©£¬Õâ¸öexecÃüÁîÊÇÖÁ¹ØÖØÒªµÄ£¬ºóÐø»¹»á·¢»Ó¸ü´ó×÷ÓÃ
[root@node2 ~]# ip netns exec ns1 ip a s
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
[root@node2 ~]# ip netns exec ns1 route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
[root@node2 ~]# ip netns exec ns2 ip a s
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 #¿ÉÒÔ¿´µ½£¬Ð½¨µÄnsµÄÍøÂçÉ豸ֻÓÐÒ»¸öloopback¿Ú£¬²¢ÇÒ·ÓɱíΪ¿Õ¡£
|
2.´´½¨ÍøÇÅMyDocker0
[root@node2 ~]# brctl addbr MyDocker0
[root@node2 ~]# brctl show
bridge name bridge id STP enabled interfaces
MyDocker0 8000.000000000000 no
...
[root@node2 ~]# ip addr add 172.16.0.1/16 dev MyDocker0
#ΪMyDocker0ÍøÇÅ·ÖÅäipµØÖ·¡£
[root@node2 ~]# ip link set MyDocker0 up
#ÆôÓÃÍøÇÅÉ豸
[root@node2 ~]# ip route show
...
172.16.0.0/16 dev MyDocker0 proto kernel scope link src 172.16.0.1
...
#²é¿´ÏàÓ¦µÄ·ÓÉÐÅÏ¢
|
3.´´½¨²¢Á¬½ÓVeth PairÉ豸
µ½Ä¿Ç°ÎªÖ¹£¬default nsÓëns1¡¢ns2Ö®¼ä»¹Ã»ÓÐÈκÎÁªÏµ£¬½ÓÏÂÀ´£¬½«Ê¹ÓÃveth pair½«¶þÕßÁªÏµÆðÀ´¡£½ÓÏÂÀ´´´½¨ns1ºÍdefaultÖ®¼äµÄveth pair£¬veth1ºÍveth1p£¬²¢½«¶þÕß·Ö±ðÁ¬½Óµ½MyDocker0ÍøÇÅÉϺÍns1ÖС£
#´´½¨Á¬½Ódefault nsÓëns1Ö®¼äµÄveth pair¡£ veth1ºÍveth1p
[root@node2 ~]# ip link add veth1 type veth peer name veth1p
[root@node2 ~]# ip link show
...
20: veth1p@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether fa:06:c6:d6:53:bb brd ff:ff:ff:ff:ff:ff
21: veth1@veth1p: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 56:76:1d:19:69:77 brd ff:ff:ff:ff:ff:ff
...
#½«Íø¿¨²åµ½MyDocker0ÍøÇÅÉÏ,²¢¿ªÆô´ËÍø¿¨
[root@node2 ~]# brctl addif MyDocker0 veth1
[root@node2 ~]# ip link set veth1 up
[root@node2 ~]# brctl show
bridge name bridge id STP enabled interfaces
MyDocker0 8000.56761d196977 no veth1
...
#½«veth1p·ÅÈëns1ÖУº
[root@node2 ~]# ip link set veth1p netns ns1
[root@node2 ~]# ip netns exec ns1 ip a s
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
20: veth1p@if21: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether fa:06:c6:d6:53:bb brd ff:ff:ff:ff:ff:ff link-netnsid 0
#Õâʱ£¬ÄãÔÚdefault nsÖн«¿´²»µ½veth1pÕâ¸öÐéÄâÍøÂçÉ豸ÁË¡£°´ÕÕͼ3ÖеÄÍØÆË£¬Î»ÓÚns1ÖеÄveth1pÓ¦¸Ã¸üÃûΪeth0
#ÐÞ¸ÄÍø¿¨Ãû×Ö
[root@node2 ~]# ip netns exec ns1 ip link set veth1p name eth0
[root@node2 ~]# ip netns exec ns1 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
20: eth0@if21: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether fa:06:c6:d6:53:bb brd ff:ff:ff:ff:ff:ff link-netnsid 0
#½«ns1ÖеÄeth0ÉúЧ²¢ÅäÖÃIPµØÖ·£º
[root@node2 ~]# ip netns exec ns1 ip link set eth0 up
[root@node2 ~]# ip netns exec ns1 ip addr add 172.16.0.2/16 dev eth0
[root@node2 ~]# ip netns exec ns1 ip route add default via 172.16.0.1
#Ìí¼ÓĬÈÏ·ÓÉ£¬Ê¹µÃnsÓëÖ÷»úÉÏµÄÆäËûnsÄܹ»Á¬Í¨¡£ |
¶Ôns2½øÐÐÏàͬµÄ²½Öè
ip link add veth2 type veth peer name veth2p
#н¨veth pairÉ豸
brctl addif MyDocker0 veth2
#½«veth pairÒ»¶Ë²åÈëÍøÇÅ
ip link set veth2 up
#¿ªÆôÍø¿¨
ip link set veth2p netns ns2
#½«vethpairÒ»¶Ë·Åµ½Ö¸¶¨nsÖÐ
ip netns exec ns2 ip link set veth2p name eth0
ip netns exec ns2 ip link set eth0 up
#ÐÞ¸Äns2ÖеÄÍø¿¨Ãû×Ö£¬²¢ÖØÆô¡£
ip netns exec ns2 ip addr add 172.16.0.3/16 dev eth0
#¸øns2ÖеÄÍø¿¨Ìí¼ÓµØÖ·
ip netns exec ns2 ip route add default via 172.16.0.1
#Ìí¼ÓĬÈÏ·ÓÉ£¬Ê¹µÃnsÓëÖ÷»úÉÏµÄÆäËûnsÄܹ»Á¬Í¨¡£ |
²âÊÔÁ¬Í¨ÐÔ£º
- ns1ºÍMyDocker0ÊÇ·ñ»¥Í¨,
- ns1Óëns2ÊÇ·ñ»¥Í¨£¬
- ns1ÓëËÞÖ÷»úµÄÆäËûÍø¿¨£¨±ÈÈçdockerÖеÄdocker0ÍøÇÅÊÇ·ñÏàͨ£©
- ns1ÓëËÞÖ÷»úÍâµÄÆäËûÖ÷»úÊÇ·ñ»¥Í¨
[root@node2 ~]# ip netns exec ns1 ping -c 3 172.16.0.1
PING 172.16.0.1 (172.16.0.1) 56(84) bytes of data.
64 bytes from 172.16.0.1: icmp_seq=1 ttl=64 time=0.236 ms
64 bytes from 172.16.0.1: icmp_seq=2 ttl=64 time=0.152 ms
64 bytes from 172.16.0.1: icmp_seq=3 ttl=64 time=0.238 ms
--- 172.16.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, t
#ns1ºÍMyDocker0Á¬Í¨
[root@node2 ~]# ip netns exec ns1 ping -c 3 172.17.0.1
PING 172.17.0.1 (172.17.0.1) 56(84) bytes of data.
64 bytes from 172.17.0.1: icmp_seq=1 ttl=64 time=0.104 ms
64 bytes from 172.17.0.1: icmp_seq=2 ttl=64 time=0.117 ms
#ns1Óëdocker0Á¬Í¨
[root@node2 ~]# ip netns exec ns1 ping -c 3 172.16.0.3
PING 172.16.0.3 (172.16.0.3) 56(84) bytes of data.
64 bytes from 172.16.0.3: icmp_seq=1 ttl=64 time=0.153 ms
64 bytes from 172.16.0.3: icmp_seq=2 ttl=64 time=0.146 ms
#ns1Óëns2Á¬Í¨
#ʵÏÖ×ÔÖÆµÄnsÓëÍâÍø½øÐÐͨÐÅ¡£
[root@node2 ~]# iptables -t nat -A POSTROUTING -s 172.16.0.0/16 ! -o mydocker0 -j MASQUERADE
#Ôö¼ÓÒ»Ìõ
[root@node2 ~]# ip netns exec ns1 ping www.baidu.com
PING www.wshifen.com (103.235.46.39) 56(84) bytes of data.
64 bytes from 103.235.46.39 (103.235.46.39): icmp_seq=1 ttl=42 time=247 ms
64 bytes from 103.235.46.39 (103.235.46.39): icmp_seq=2 ttl=42 time=235 ms
|
×ÔÖÆnsÓëdockerÈÝÆ÷Ö®¼äµÄͨÐÅÁ÷³Ì
Èç¹ûÊÇÔÚns1ÖÐpingij¸ödocker containerµÄµØÖ·£¬±ÈÈç172.17.0.2£¬ÄÇôÆäÁ÷³ÌÈçÏÂËùʾ¡£
1.µ±pingÖ´Ðк󣬸ù¾Ýns1ϵķÓÉ±í£¬Ã»ÓÐÆ¥Åäµ½Ö±Á¬ÍøÂ磬ֻÄÜͨ¹ýdefault·Óɽ«Êý¾Ý°üת·¢¸øGateway: 172.16.0.1¡£
2.MyDocker0½ÓÊÕµ½Êý¾Ý£¬Êý¾Ý½øÈëµ½ËÞÖ÷»úµÄÄں˿ռ䡣ËäÈ»¶¼ÊÇMyDocker0½ÓÊÕÊý¾Ý£¬µ«Õâ´Î¸üÀàËÆÓÚ¡°Êý¾Ý±»Ö±½Ó·¢µ½ Bridge ÉÏ£¬¶ø²»ÊÇBridge´ÓÒ»¸ö¶Ë¿Ú½ÓÊÕ¡£¶þ²ãµÄÄ¿µÄmacµØÖ·ÌîдµÄÊÇgateway 172.16.0.1×Ô¼ºµÄmacµØÖ·£¨BridgeµÄmacµØÖ·£©£¬´ËʱµÄMyDocker0¸üÏñÊÇÒ»¿éÆÕÍ¨Íø¿¨µÄ½ÇÉ«£¬¹¤×÷ÔÚÈý²ã(¶ø²»ÊÇ֮ǰµÄ¶þ²ãÍøÇŵĽÇÉ«)¡£
3.MyDocker0ÊÕµ½Êý¾Ý°üºó£¬·¢ÏÖ²¢·ÇÊÇ·¢¸ø×Ô¼ºµÄip°ü£¬Í¨¹ýÖ÷»ú·ÓɱíÕÒµ½Ö±Á¬Â·ÓÉ£¨·²ÊÇÆ¥Åäµ½ÕâÌõ¹æÔòµÄ IP °ü£¬Í¨¹ý¶þ²ãÍøÂçÖ±½Ó·¢ÍùÄ¿µÄÖ÷»ú£©£¬Í¨¹ýarp²éѯ£¬²éѯµ½IPµØÖ·Îª172.17.0.2µÄmacµØÖ·¡£È»ºóͨ¹ý¶þ²ãÍøÂ罫Êý¾Ý°üת·¢µ½docker containerÖС£
[root@node2 ~]# ip neigh show dev docker0
172.17.0.2 lladdr 02:42:ac:11:00:02 STALE |
MyDocker0½«Êý¾Ý°üForwardµ½Í¨¹ýtraceroute¿ÉÒÔÓ¡Ö¤ÕâÒ»¹ý³Ì£º
[root@node2 ~]# ip netns exec ns1 traceroute -n 172.17.0.2
traceroute to 172.17.0.2 (172.17.0.2), 30 hops max, 60 byte packets
1 172.16.0.1 0.100 ms 0.052 ms 0.050 ms
2 172.17.0.2 0.138 ms 0.117 ms 0.119 ms |
|