七、【Docker笔记】Docker中网络基础配置
- 2020 年 4 月 11 日
- 筆記
一个系统一般都包含多个服务组件，这些大量的服务组件不可能放在同一个容器中，这就需要多个容器之间可以互相通信。Docker提供了两种方式来实现网络服务：映射容器端口到宿主主机、容器互联机制。
一、端口映射实现访问容器
1、从外部访问容器中的应用
在启动容器时，若我们不指定某些参数，则我们在容器外部是无法通过网络来访问容器中的应用和服务的。若想让容器中的应用可以被外部访问，则在启动容器时，需要加入 -P / -p 来指定端口的映射。若我们直接加上 -P 后面不指定端口，则Docker会随机映射一个 49000 ~ 49900 的端口到容器内部开放的网络端口：
# 启动一个web应用，让其在外部可访问 $ sudo docker run -d -P training/webapp python app.py 61d7b0ed72bd...... $ sudo docker run -d training/webapp python app.py 16ddce67f62a...... # 查看当前正在运行的容器 $ sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 16ddce67f62a training/webapp "python app.py" 5 seconds ago Up 3 seconds 5000/tcp cool_mestorf 61d7b0ed72bd training/webapp "python app.py" 16 seconds ago Up 14 seconds 0.0.0.0:32768->5000/tcp quizzical_cray # 访问 带有 -P 参数的容器如下，不带 -P 启动的容器我们无法访问。访问之后，我们来查看日志 $ sudo docker logs -f 61d7b0ed72bd * Running on http://0.0.0.0:5000/ (Press CTRL+C to quit) 192.168.0.1 - - [11/Apr/2020 03:29:53] "GET / HTTP/1.1" 200 - 192.168.0.1 - - [11/Apr/2020 03:29:53] "GET /favicon.ico HTTP/1.1" 404 - 
2、映射所有接口地址
使用 hostPort:containerPort 格式可将本地的端口映射到容器的端口。
# 将本地的 5000 端口映射到容器的 5000 端口 $ sudo docker run -d -p 5000:5000 training/webapp python app.py bc4f7d1a99bf5..... # 访问宿主机的5000端口 
当然 -p 参数可以多次使用。
# 在启动容器时绑定多个宿主机端口到容器端口 $ sudo docker run -d -p 5000:5000 -p 3000:80 training/webapp python app.py 3、映射到指定地址的指定端口
我们也可使用 ip:hostPort:containerPort 格式来指定映射一个特定地址的特定端口到容器中的端口。
$ sudo docker run -d -p 127.0.0.1:5000:5000 training/webapp python app.py #此时访问宿主机对应的5000端口 $ curl http://192.168.0.128:5000/ curl: (7) Failed connect to 192.168.0.128:5000; 拒绝连接 $ curl http://127.0.0.1:5000/ Hello world! 
4、映射到指定地址的任意端口
使用 ip::containerPort 来绑定宿主机的任意端口到容器的指定端口。
# 0. 运行容器 $ sudo docker run -d -p 127.0.0.1::5000 training/webapp python app.py c54763267e956fe15ab3aedd14893a4269c19995bf3d56f9519b68ddffccb9cd # 1. 查看运行容器信息 $ sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES c54763267e95 training/webapp "python app.py" 14 seconds ago Up 13 seconds 127.0.0.1:32768->5000/tcp angry_merkle # 2. 访问 127.0.0.1:32768 $ curl 127.0.0.1:32768 Hello world! 从上面通过 docker ps 我们可知，对应容器中的端口都是 tcp的，其实我们可以指定映射为udp端口。
$ sudo docker run -d -p 127.0.0.1:5000:5000/udp training/webapp python app.py docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 950a6d4c7f6c training/webapp "python app.py" 48 seconds ago Up 47 seconds 5000/tcp, 127.0.0.1:5000->5000/udp compassionate_ganguly 5、查看映射端口配置
使用 docker port 来查看当前映射的端口配置，也可查看绑定地址。
$ sudo docker port 705e17a35936 5000/tcp -> 127.0.0.1:5000 # 容器有自己的ip和网络信息，若想了解容器的网络信息 $ sudo docker inspect 705e17a35936 [ { "Id": "705e17a3593616ff5f4cd47057e5be83f5f344e69e9cb5665855f2acfe16cb54", "Created": "2020-04-11T03:44:34.703449795Z", "Path": "python", "Args": [ "app.py" ], "State": { "Status": "running", "Running": true, "Paused": false, "Restarting": false, "OOMKilled": false, "Dead": false, "Pid": 2659, "ExitCode": 0, "Error": "", "StartedAt": "2020-04-11T04:01:25.917279404Z", "FinishedAt": "2020-04-11T03:55:26.502040545Z" }, "Image": "sha256:6fae60ef344644649a39240b94d73b8ba9c67f898ede85cf8e947a887b3e6557", "ResolvConfPath": "/var/lib/docker/containers/705e17a3593616ff5f4cd47057e5be83f5f344e69e9cb5665855f2acfe16cb54/resolv.conf", "HostnamePath": "/var/lib/docker/containers/705e17a3593616ff5f4cd47057e5be83f5f344e69e9cb5665855f2acfe16cb54/hostname", "HostsPath": "/var/lib/docker/containers/705e17a3593616ff5f4cd47057e5be83f5f344e69e9cb5665855f2acfe16cb54/hosts", "LogPath": "/var/lib/docker/containers/705e17a3593616ff5f4cd47057e5be83f5f344e69e9cb5665855f2acfe16cb54/705e17a3593616ff5f4cd47057e5be83f5f344e69e9cb5665855f2acfe16cb54-json.log", "Name": "/sleepy_pike", "RestartCount": 0, "Driver": "devicemapper", "Platform": "linux", "MountLabel": "", "ProcessLabel": "", "AppArmorProfile": "", "ExecIDs": null, "HostConfig": { "Binds": null, "ContainerIDFile": "", "LogConfig": { "Type": "json-file", "Config": {} }, "NetworkMode": "default", "PortBindings": { "5000/tcp": [ { "HostIp": "127.0.0.1", "HostPort": "5000" } ] }, "RestartPolicy": { "Name": "no", "MaximumRetryCount": 0 }, "AutoRemove": false, "VolumeDriver": "", "VolumesFrom": null, "CapAdd": null, "CapDrop": null, "Capabilities": null, "Dns": [], "DnsOptions": [], "DnsSearch": [], "ExtraHosts": null, "GroupAdd": null, "IpcMode": "private", "Cgroup": "", "Links": null, "OomScoreAdj": 0, "PidMode": "", "Privileged": false, "PublishAllPorts": false, "ReadonlyRootfs": false, "SecurityOpt": null, "UTSMode": "", "UsernsMode": "", "ShmSize": 67108864, "Runtime": "runc", "ConsoleSize": [ 0, 0 ], "Isolation": "", "CpuShares": 0, "Memory": 0, "NanoCpus": 0, "CgroupParent": "", "BlkioWeight": 0, "BlkioWeightDevice": [], "BlkioDeviceReadBps": null, "BlkioDeviceWriteBps": null, "BlkioDeviceReadIOps": null, "BlkioDeviceWriteIOps": null, "CpuPeriod": 0, "CpuQuota": 0, "CpuRealtimePeriod": 0, "CpuRealtimeRuntime": 0, "CpusetCpus": "", "CpusetMems": "", "Devices": [], "DeviceCgroupRules": null, "DeviceRequests": null, "KernelMemory": 0, "KernelMemoryTCP": 0, "MemoryReservation": 0, "MemorySwap": 0, "MemorySwappiness": null, "OomKillDisable": false, "PidsLimit": null, "Ulimits": null, "CpuCount": 0, "CpuPercent": 0, "IOMaximumIOps": 0, "IOMaximumBandwidth": 0, "MaskedPaths": [ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "ReadonlyPaths": [ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ] }, "GraphDriver": { "Data": { "DeviceId": "129", "DeviceName": "docker-253:0-67518837-48c42a21a8b771836053ba03b954ab6a882146ed580b81bd2c540459127e6655", "DeviceSize": "10737418240" }, "Name": "devicemapper" }, "Mounts": [], "Config": { "Hostname": "705e17a35936", "Domainname": "", "User": "", "AttachStdin": false, "AttachStdout": false, "AttachStderr": false, "ExposedPorts": { "5000/tcp": {} }, "Tty": false, "OpenStdin": false, "StdinOnce": false, "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ], "Cmd": [ "python", "app.py" ], "Image": "training/webapp", "Volumes": null, "WorkingDir": "/opt/webapp", "Entrypoint": null, "OnBuild": null, "Labels": {} }, "NetworkSettings": { "Bridge": "", "SandboxID": "6ec9b1986ffaa317d9d962b615025b8f94c926f4a83eb68c929d964655b74022", "HairpinMode": false, "LinkLocalIPv6Address": "", "LinkLocalIPv6PrefixLen": 0, "Ports": { "5000/tcp": [ { "HostIp": "127.0.0.1", "HostPort": "5000" } ] }, "SandboxKey": "/var/run/docker/netns/6ec9b1986ffa", "SecondaryIPAddresses": null, "SecondaryIPv6Addresses": null, "EndpointID": "8e70e95f6e5a4d9d6164d61c2d0807430bdaaa2342ac6175dd22964d8bc74cbd", "Gateway": "172.17.0.1", "GlobalIPv6Address": "", "GlobalIPv6PrefixLen": 0, "IPAddress": "172.17.0.2", "IPPrefixLen": 16, "IPv6Gateway": "", "MacAddress": "02:42:ac:11:00:02", "Networks": { "bridge": { "IPAMConfig": null, "Links": null, "Aliases": null, "NetworkID": "6dffe521ab44a55127f8f43c5a542dc7969cfbfc85a17e5692bf58472261e6cf", "EndpointID": "8e70e95f6e5a4d9d6164d61c2d0807430bdaaa2342ac6175dd22964d8bc74cbd", "Gateway": "172.17.0.1", "IPAddress": "172.17.0.2", "IPPrefixLen": 16, "IPv6Gateway": "", "GlobalIPv6Address": "", "GlobalIPv6PrefixLen": 0, "MacAddress": "02:42:ac:11:00:02", "DriverOpts": null } } } } ] 二、容器互联实现容器间通信
容器的连接系统是除了端口映射以外的另一种可以与容器中应用交互的方式。它会在源与接收容器之间创建一个隧道，接收容器可以看到源容器指定的信息。
1、自定义容器命名
连接系统是依据容器的名称来执行，这就要求我们在创建容器的时候自定义一个容器名称，系统自动生成的名称不利于理解。自定义的容器命名比较好记，且在连接其他容器的时候，可以根据名称来作为很好的参考。可使用 –name 来标记容器名称。
$ sudo docker run -d -P --name web training/webapp python app.py 7abf01b7507d46e88412206d0cdd26d38248a4bbd5fca9ba0e7c68070b1f6d73 # 可使用以下两种方式来查看容器的名称 $ sudo docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 7abf01b7507d training/webapp "python app.py" 41 seconds ago Up 41 seconds 0.0.0.0:32769->5000/tcp web # 或 $ sudo docker inspect -f "{{.Name}}" 7abf01b7507d /web 2、容器互联
使用 –link 参数可让容器之间安全的交互。语法格式为：–link name:alias 即需要连接的容器名称:连接别名
# 0. 创建数据库容器 $ sudo docker run -d --name db training/postgres 26690fc69651a03dbcc1e8674c0258f8b2e54ddf22fcf5c5bf7f6d267543df04 # 1. 删除之前的 web 容器，可使用 -f 来强制删除 $ sudo docker rm -f 7abf01b7507d 7abf01b7507d # 2. 创建新的web容器，并让其连接到刚才创建的数据库容器 $ sudo docker run -d -P --name web --link db:db training/webapp python app.py 699cd56b6b5444e34a83bfe363bd448711150c020a116dd8200f042296690ed4 # 3. 查看容器的连接信息 $ sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 699cd56b6b54 training/webapp "python app.py" 10 seconds ago Up 9 seconds 0.0.0.0:32770->5000/tcp web 26690fc69651 training/postgres "su postgres -c '/us…" 5 minutes ago Up 5 minutes 5432/tcp db,web/db Docker可以通过两种方式来为容器公开连接信息：环境变量、更新 /etc/hosts 文件。
# 使用 env 命令来查看web容器的环境 $ sudo docker run --rm --name tmp_web --link db:db training/webapp env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ffb7ed25135e DB_PORT=tcp://172.17.0.3:5432 DB_PORT_5432_TCP=tcp://172.17.0.3:5432 DB_PORT_5432_TCP_ADDR=172.17.0.3 DB_PORT_5432_TCP_PORT=5432 DB_PORT_5432_TCP_PROTO=tcp DB_NAME=/tmp_web/db DB_ENV_PG_VERSION=9.3 HOME=/root # 查看父容器web的hosts文件 $ sudo docker run -ti --rm --link db:db training/webapp /bin/bash root@d78ad4411828:/opt/webapp# cat /etc/hosts 127.0.0.1 localhost ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters 172.17.0.3 db 26690fc69651 # db容器的ip和主机 172.17.0.4 d78ad4411828 # web容器的ip和主机 # 此时我们处于web容器内部，可以使用 ping 来查看与db容器网络是否畅通 root@d78ad4411828:/opt/webapp# ping db PING db (172.17.0.3) 56(84) bytes of data. 64 bytes from db (172.17.0.3): icmp_seq=1 ttl=64 time=0.060 ms 64 bytes from db (172.17.0.3): icmp_seq=2 ttl=64 time=0.042 ms 64 bytes from db (172.17.0.3): icmp_seq=3 ttl=64 time=0.093 ms 64 bytes from db (172.17.0.3): icmp_seq=4 ttl=64 time=0.055 ms # 若web容器中没有 ping 命令可使用以下命令来安装 root@d78ad4411828:/opt/webapp# apt-get install -yqq inetutils-ping 
