docker网络系统文章用于讲解docker几种网络模型和通信方式。

实验环境为下面的组网,2台VM连接在一台交换机上，在一个2层网络中。分别在2台VM上启动容器，通过不同网络模型使容器间互通。

 

macvlan是一种网卡虚拟化技术,在现有网卡上虚拟出一块子网卡,子网卡有自己 的MAC地址,共享底层物理网卡

更详细的macvlan介绍,可以参考这篇文章:https://www.jianshu.com/p/2b8b6c738bf6

 

1. 分别在VM1,VM2上创建macvlan网络,都属于172.16.86.0/24子网,并分配2个不同的ip网段.

VM1:

docker network create -d macvlan \
>   --subnet=172.16.86.0/24 \
>   --gateway=172.16.86.1 \
>   --ip-range=172.16.86.128/25 -o parent=ens38 macvlan_net1

VM2:

docker network create -d macvlan --subnet=172.16.86.0/24  --gateway=172.16.86.1  --ip-range=172.16.86.0/25 -o parent=ens38 macvlan_net2

在VM1,VM2上分别启动1个容器，并加入刚才创建的macvlan网络

VM1:

docker run -td --name c1 --network macvlan_net1 --privileged busybox /bin/sh

docker exec -it c1 ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
6: eth0@if3: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:10:56:80 brd ff:ff:ff:ff:ff:ff
    inet 172.16.86.128/24 brd 172.16.86.255 scope global eth0
       valid_lft forever preferred_lft forever

 

VM2:

docker run -td --name c2 --network macvlan_net2 --privileged busybox /bin/sh

docker exec -it c2 ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
6: eth0@if3: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:10:56:02 brd ff:ff:ff:ff:ff:ff
    inet 172.16.86.2/24 brd 172.16.86.255 scope global eth0
       valid_lft forever preferred_lft forever

分别在2个容器中ping对方,可以ping通:

VM1:

docker exec -it c1 ping 172.16.86.2
PING 172.16.86.2 (172.16.86.2): 56 data bytes
64 bytes from 172.16.86.2: seq=0 ttl=64 time=1.078 ms
64 bytes from 172.16.86.2: seq=1 ttl=64 time=1.334 ms
64 bytes from 172.16.86.2: seq=2 ttl=64 time=0.518 ms

VM2:

# docker exec -it c2 ping 172.16.86.128
PING 172.16.86.128 (172.16.86.128): 56 data bytes
64 bytes from 172.16.86.128: seq=0 ttl=64 time=0.462 ms
64 bytes from 172.16.86.128: seq=1 ttl=64 time=1.778 ms
64 bytes from 172.16.86.128: seq=2 ttl=64 time=0.490 ms
64 bytes from 172.16.86.128: seq=3 ttl=64 time=1.366 ms

 

macvlan会独占物理网卡,如果我们想创建多个macvlan网络,可以使用子接口。

VM1:

docker network create -d macvlan   --subnet=172.17.86.0/24   --gateway=172.17.86.1   --ip-range=172.17.86.128/25 -o parent=ens38.10 macvlan10

VM2:

docker network create -d macvlan   --subnet=172.17.86.0/24   --gateway=172.17.86.1   --ip-range=172.17.86.0/25 -o parent=ens38.10 macvlan10

 

可以看到自动创建了ens38.10子网卡

7: ens38.10@ens38: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 00:0c:29:0f:d1:e1 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::20c:29ff:fe0f:d1e1/64 scope link 
       valid_lft forever preferred_lft forever

 

分别创建2个容器连接各自的macvlan10

VM1:

docker run -td --name c10 --network macvlan10 --privileged busybox /bin/sh
0843e2e9cb6541f7c3996c4d6b2f5322084a18bd39c8402585fd4e0f0eb7cc10
root@k8s-slave1:~# docker exec -it c10 ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
8: eth0@if7: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:11:56:80 brd ff:ff:ff:ff:ff:ff
    inet 172.17.86.128/24 brd 172.17.86.255 scope global eth0
       valid_lft forever preferred_lft forever

VM2:

docker run -td --name c10 --network macvlan10 --privileged busybox /bin/sh
ea8d0b5c500bd8f64821b15b664ec1e3cb5c15330a399265c7e877a884c6673d
docroot@ubuntu:~# docker exec -it c10 ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
9: eth0@if7: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether 02:42:ac:11:56:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.86.2/24 brd 172.17.86.255 scope global eth0
       valid_lft forever preferred_lft forever

互相ping:

VM1:

# docker exec -it c10 ping 172.17.86.2
PING 172.17.86.2 (172.17.86.2): 56 data bytes
64 bytes from 172.17.86.2: seq=0 ttl=64 time=0.714 ms
64 bytes from 172.17.86.2: seq=1 ttl=64 time=0.615 ms

VM2:

docker exec -it c10 ping 172.17.86.128
PING 172.17.86.128 (172.17.86.128): 56 data bytes
64 bytes from 172.17.86.128: seq=0 ttl=64 time=1.144 ms
64 bytes from 172.17.86.128: seq=1 ttl=64 time=0.533 ms