网络命名空间

Linux的Namespace(命名空间)技术是一种隔离技术,常用的Namespace有 user namespace, process namespace, network namespace等

在Docker容器中,不同的容器通过Network namespace进行了隔离,也就是不同的容器有各自的IP地址,路由表等,互不影响。

Note

准备一台Linux机器,这一节会用到一个叫 brtcl 的命令,这个命令需要安装,如果是Ubuntu的系统,可以通过 apt-get install bridge-utils 安装;如果是Centos系统,可以通过 sudo yum install bridge-utils 来安装

docker-volume

创建bridge

  1. [vagrant@docker-host1 ~]$ sudo brctl addbr mydocker0
  2. [vagrant@docker-host1 ~]$ brctl show
  3. bridge name bridge id STP enabled interfaces
  4. mydocker0 8000.000000000000 no
  5. [vagrant@docker-host1 ~]$

准备一个shell脚本

Note

https://twitter.com/xiaopeng163/status/1531022226933391362?s=20&t=LuWDZHV3TCLmLsI1nCb1FQ

脚本名字叫 add-ns-to-br.sh

  1. #!/bin/bash
  2. bridge=$1
  3. namespace=$2
  4. addr=$3
  5. vethA=veth-$namespace
  6. vethB=eth00-$namespace
  7. sudo ip netns add $namespace
  8. sudo ip link add $vethA type veth peer name $vethB
  9. sudo ip link set $vethB netns $namespace
  10. sudo ip netns exec $namespace ip addr add $addr dev $vethB
  11. sudo ip netns exec $namespace ip link set $vethB up
  12. sudo ip link set $vethA up
  13. sudo brctl addif $bridge $vethA

脚本执行

  1. [vagrant@docker-host1 ~]$ sh add-ns-to-br.sh mydocker0 ns1 172.16.1.1/16
  2. [vagrant@docker-host1 ~]$ sh add-ns-to-br.sh mydocker0 ns2 172.16.1.2/16

把mydocker0这个bridge up起来

  1. [vagrant@docker-host1 ~]$ sudo ip link set dev mydocker0 up

验证

  1. [vagrant@docker-host1 ~]$ sudo ip netns exec ns1 bash
  2. [root@docker-host1 vagrant]# ip a
  3. 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
  4. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  5. 5: eth00@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
  6. link/ether f2:59:19:34:73:70 brd ff:ff:ff:ff:ff:ff link-netnsid 0
  7. inet 172.16.1.1/16 scope global eth00
  8. valid_lft forever preferred_lft forever
  9. inet6 fe80::f059:19ff:fe34:7370/64 scope link
  10. valid_lft forever preferred_lft forever
  11. [root@docker-host1 vagrant]# ping 172.16.1.2
  12. PING 172.16.1.2 (172.16.1.2) 56(84) bytes of data.
  13. 64 bytes from 172.16.1.2: icmp_seq=1 ttl=64 time=0.029 ms
  14. 64 bytes from 172.16.1.2: icmp_seq=2 ttl=64 time=0.080 ms
  15. ^C
  16. --- 172.16.1.2 ping statistics ---
  17. 2 packets transmitted, 2 received, 0% packet loss, time 1000ms
  18. rtt min/avg/max/mdev = 0.029/0.054/0.080/0.026 ms
  19. [root@docker-host1 vagrant]#

对外通信

https://www.karlrupp.net/en/computer/nat_tutorial