docker network
Understanding docker network
Test ip addr view
We can test whether the container can ping between containers
# Run a tomcat docker run -d -P --name tomcat01 tomcat # Get ip ip addr # We can view the ip address of the container by viewing the metadata
# Then ping the container with the host linux ping 172.18.0.2 # Nengtong
principle
- Every time we start a docker container, docker will assign an ip address to each of our containers
- As long as we install docker, we will have a network card docker0 bridging mode, using evth pair technology
Our newly started container will have a new network card
We found that the network cards of these containers are one-to-one
# We found that the network card brought by this container is a pair # Veth pair is a pair of virtual device interfaces. They all appear in pairs. One end is connected to the protocol and the other end is connected to each other # Because of this feature, Veth pair acts as a bridge to connect various virtual network devices # The links between OpenStac, Docker containers and OVS all use Veth pair technology
Let's create a new tomcat and try to ping between containers
Conclusion: containers can ping each other!
Draw a network model diagram
Conclusion: tomcat01 and tomcat02 share the same router, docker0
When all containers do not specify a network, they are routed by docker0. doucker will assign a default available IP to our containers
Summary
Docker uses the Linux bridge, and the host is a docker container bridge docker0
All network interfaces in Docker are virtual, and virtual forwarding efficiency is high! (transfer files via intranet!)
As long as the container is deleted, there will be no corresponding bridge pair!
–link
Considering a scenario, we write a micro service, database url =ip; The project does not restart, but the data ip is replaced. We hope to solve this problem and access the container by name
[root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker exec -it tomcat02 ping tomcat01 ping: tomcat01: Name or service not known # How can it be solved? # The problem of network connectivity can be solved through -- link [root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker run -d -P --name tomcat03 --link tomcat02 tomcat 3a2bcaba804c5980d94d168457c436fbd139820be2ee77246888f1744e6bb473 [root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 3a2bcaba804c tomcat "catalina.sh run" 4 seconds ago Up 3 seconds 0.0.0.0:32772->8080/tcp tomcat03 f22ed47ed1be tomcat "catalina.sh run" 57 minutes ago Up 57 minutes 0.0.0.0:32771->8080/tcp tomcat02 9d97f93401a0 tomcat "catalina.sh run" About an hour ago Up About an hour 0.0.0.0:32770->8080/tcp tomcat01 [root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker exec -it tomcat03 ping tomcat02 PING tomcat02 (172.17.0.3) 56(84) bytes of data. 64 bytes from tomcat02 (172.17.0.3): icmp_seq=1 ttl=64 time=0.129 ms 64 bytes from tomcat02 (172.17.0.3): icmp_seq=2 ttl=64 time=0.100 ms 64 bytes from tomcat02 (172.17.0.3): icmp_seq=3 ttl=64 time=0.110 ms 64 bytes from tomcat02 (172.17.0.3): icmp_seq=4 ttl=64 time=0.107 ms # Can reverse ping pass? [root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker exec -it tomcat02 ping tomcat03 ping: tomcat03: Name or service not known
Explore: inspect!
In fact, this tomcat03 is configured with tomcat02 locally?
[root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker exec -it tomcat03 cat /etc/hosts 127.0.0.1 localhost ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters 172.17.0.3 tomcat02 f22ed47ed1be 172.17.0.4 3a2bcaba804c
Essence: the – link is that we added a 172.17.0.3 tomcat02 f22ed47ed1be in the hosts configuration
We don't recommend using – link now when we play Docker!
Custom network! Docker0 is not used!
Problem with Docker0: it does not support container name link access!
Custom network
View all docker networks
Network mode
Bridge: bridge mode. By default, bridge docker is created in brdge mode
none: do not configure the network
Host: share network with host
Container: the container is connected to the network! (less use, very limited)
test
# The command we start directly has a -- net bridge by default, and this is our docker0 docker run -d -P --name tomcat01 tomcat docker run -d -P --name tomcat01 --net bridge tomcat # docker0 feature. By default, the container name cannot be accessed, - link can open the connection! # We can customize a network! # --driver bridge # --subnet 192.168.0.0/16 can support 255 * 255 networks 192.168.0.2 ~ 192.168.255.254 # --gateway 192.168.0.1 [root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker network create --driver bridge --subnet 192.168.0.0/16 --gateway 192.168.0.1 mynet 26a5afdf4805d7ee0a660b82244929a4226470d99a179355558dca35a2b983ec [root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker network ls NETWORK ID NAME DRIVER SCOPE 30d601788862 bridge bridge local 226019b14d91 host host local 26a5afdf4805 mynet bridge local 7496c014f74b none null local
The network we created is ok!
Start two containers in the network you created
[root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker run -d -P --name tomcat-net-01 --net mynet tomcat
0e85ebe6279fd23379d39b27b5f47c1e18f23ba7838637802973bf6449e22f5c
[root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker run -d -P --name tomcat-net-02 --net mynet tomcat
c6e462809ccdcebb51a4078b1ac8fdec33f1112e9e416406b606d0c9fb6f21b5
[root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker network inspect mynet
[
{
"Name": "mynet",
"Id": "26a5afdf4805d7ee0a660b82244929a4226470d99a179355558dca35a2b983ec",
"Created": "2020-08-14T11:12:40.553433163+08:00",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": {},
"Config": [
{
"Subnet": "192.168.0.0/16",
"Gateway": "192.168.0.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {
"0e85ebe6279fd23379d39b27b5f47c1e18f23ba7838637802973bf6449e22f5c": {
"Name": "tomcat-net-01",
"EndpointID": "576ce5c0f5860a5aab5e487a805da9d72f41a409c460f983c0bd341dd75d83ac",
"MacAddress": "02:42:c0:a8:00:02",
"IPv4Address": "192.168.0.2/16",
"IPv6Address": ""
},
"c6e462809ccdcebb51a4078b1ac8fdec33f1112e9e416406b606d0c9fb6f21b5": {
"Name": "tomcat-net-02",
"EndpointID": "81ecbc4fe26e49855fe374f2d7c00d517b11107cc91a174d383ff6be37d25a30",
"MacAddress": "02:42:c0:a8:00:03",
"IPv4Address": "192.168.0.3/16",
"IPv6Address": ""
}
},
"Options": {},
"Labels": {}
}
]
# Join again
[root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker exec -it tomcat-net-01 ping 192.168.0.3
PING 192.168.0.3 (192.168.0.3) 56(84) bytes of data.
64 bytes from 192.168.0.3: icmp_seq=1 ttl=64 time=0.113 ms
64 bytes from 192.168.0.3: icmp_seq=2 ttl=64 time=0.093 ms
^C
--- 192.168.0.3 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.093/0.103/0.113/0.010 ms
# Now you can ping the name without -- link!
[root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker exec -it tomcat-net-01 ping tomcat-net-02
PING tomcat-net-02 (192.168.0.3) 56(84) bytes of data.
64 bytes from tomcat-net-02.mynet (192.168.0.3): icmp_seq=1 ttl=64 time=0.068 ms
64 bytes from tomcat-net-02.mynet (192.168.0.3): icmp_seq=2 ttl=64 time=0.096 ms
64 bytes from tomcat-net-02.mynet (192.168.0.3): icmp_seq=3 ttl=64 time=0.094 ms
Our custom network docker They have helped us maintain the corresponding relationship. It is recommended that we use the network in this way
Benefits:
redis - Different clusters use different networks to ensure the safety and health of the cluster
mysql - Different clusters use different networks to ensure the safety and health of the cluster
Network connectivity
Test to get through tomcat01 and mynet
# Connected ok [root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker exec -it tomcat01 ping tomcat-net-01 PING tomcat-net-01 (192.168.0.2) 56(84) bytes of data. 64 bytes from tomcat-net-01.mynet (192.168.0.2): icmp_seq=1 ttl=64 time=0.100 ms 64 bytes from tomcat-net-01.mynet (192.168.0.2): icmp_seq=2 ttl=64 time=0.085 ms ^C --- tomcat-net-01 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1000ms rtt min/avg/max/mdev = 0.085/0.092/0.100/0.012 ms # Still unable to connect, no connect [root@iZ2zeg4ytp0whqtmxbsqiiZ ~]# docker exec -it tomcat02 ping tomcat-net-01 ping: tomcat-net-01: Name or service not known
Conclusion: if you want to operate others across the network, you should use docker network connect to connect!