前言
大量的互聯網應用服務包括多個服務組件，這往往需要多個容器之間通過網絡通信進行相互配合。
Docker目前提供了映射容器端口到宿主機和容器互聯機制來爲容器提供網絡服務。
本節內容：如何使用Docker的網絡功能。
- 【1】使用端口映射機制來講容器內應用服務提供給外部網絡；
- 【2】通過容器互聯繫讓多個容器之間進行快捷的網絡通信。
1、端口映射實現訪問容器
【1】從外部訪問容器應用
- 在啓動容器的時候，如果不指定對應參數，在容器外部是無法通過網絡來訪問容器內的網絡應用和服務的。
[root@master03 /]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
fbf1daabef9a ubuntu "/bin/bash" 18 hours ago Up 10 seconds db1
當容器中運行一個網絡應用，要讓外部訪問這些應用時，可以通過-P或-p參數來指定端口映射。
- 使用-P標記時，Docker會隨機映射一個49000~49900的端口至容器內部開放的網絡端口：
[root@master03 docker]# docker run -d -P --name docker_network_config1 training/webapp python app.py
78f80249ac41c96f5d25022d74f9b638500a1d5c7be89b14e484e4fa3ee7c7c8
[root@master03 docker]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
78f80249ac41 training/webapp "python app.py" 3 seconds ago Up 2 seconds 0.0.0.0:32771->5000/tcp docker_network_config1
這裏，可以使用docker ps看到，本地主機的32768端口被映射到了容器的5000端口。訪問宿主機的32768端口即可訪問容器內web應用提供的界面。
- 同樣的，可以通過docker logs來查看應用信息：
[root@master03 /]# docker logs -f 9b62ec43a588
* Running on http://0.0.0.0:5000/ (Press CTRL+C to quit)
使用-p標記時，則可以指定要映射的端口，並且在一個指定端口上只可以綁定一個容器。
支持格式有ip:hostPort:containerPort | ip:containerPort | hostPort:containerPort。
【2】映射所有接口地址
- 使用hostPort:containerPort格式將本地的5000端口映射到容器的5000端口，可以執行如下命令：
docker run -d -p 5000:5000 --name docker_network_config2 training/webapp python app.py
[root@master03 docker]# docker run -d -p 5000:5000 --name docker_network_config2 training/webapp python app.py
00557fc2a364c5b098faa13a13f49e50cae0b3af4999740590d13d00546e6103
[root@master03 docker]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
00557fc2a364 training/webapp "python app.py" 3 seconds ago Up 3 seconds 0.0.0.0:5000->5000/tcp docker_network_config2
78f80249ac41 training/webapp "python app.py" About a minute ago Exited (137) 19 seconds ago docker_network_config1
- 此時，默認會綁定本地所有端口上的所有地址。多次使用-p可以綁定多個端口。
例如：
docker run -d -p 5000:5000 -p 3000:80 --name docker_network_config3 training/webapp python app.py
[root@master03 docker]# docker run -d -p 5000:5000 -p 3000:80 --name docker_network_config3 training/webapp python app.py
c51cc14d04bc87a7880207b3e216bb712421515fb08ba57088e8de861e8d5c00
[root@master03 docker]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c51cc14d04bc training/webapp "python app.py" 6 seconds ago Up 5 seconds 0.0.0.0:5000->5000/tcp, 0.0.0.0:3000->80/tcp docker_network_config3
00557fc2a364 training/webapp "python app.py" 4 minutes ago Exited (137) 10 seconds ago docker_network_config2
78f80249ac41 training/webapp "python app.py" 5 minutes ago Exited (137) 4 minutes ago docker_network_config1
【3】映射到指定地址的指定端口
- 可以使用ip:hostPort:containerPort格式指定映射使用一個特定地址，比如localhost地址127.0.0.1：
[root@master03 docker]# docker run -d -p 127.0.0.1:5000:5000 --name docker_network_config4 training/webapp python app.py
83e9ff0bb2b7221ea02b155676518637545541977d78864da805a91928661bcf
[root@master03 docker]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
83e9ff0bb2b7 training/webapp "python app.py" 3 seconds ago Up 2 seconds 127.0.0.1:5000->5000/tcp docker_network_config4
c51cc14d04bc training/webapp "python app.py" 5 minutes ago Exited (137) 26 seconds ago docker_network_config3
00557fc2a364 training/webapp "python app.py" 9 minutes ago Exited (137) 5 minutes ago docker_network_config2
78f80249ac41 training/webapp "python app.py" 11 minutes ago Exited (137) 10 minutes ago docker_network_config1
【4】映射到指定地址的任意端口
- 使用ip::containerPort綁定localhost的任意端口到容器的5000端口，本地主機會自動分配一個端口：
[root@master03 docker]# docker run -d -p 127.0.0.1::5000 --name docker_network_config5 training/webapp python app.py
84095bf9d83e75637a830d773460974b8a67f40ea7a3909cc5fb2bd717620491
[root@master03 docker]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
84095bf9d83e training/webapp "python app.py" 4 seconds ago Up 4 seconds 127.0.0.1:32768->5000/tcp docker_network_config5
83e9ff0bb2b7 training/webapp "python app.py" 3 minutes ago Exited (137) About a minute ago docker_network_config4
c51cc14d04bc training/webapp "python app.py" 8 minutes ago Exited (137) 3 minutes ago docker_network_config3
00557fc2a364 training/webapp "python app.py" 13 minutes ago Exited (137) 8 minutes ago docker_network_config2
78f80249ac41 training/webapp "python app.py" 14 minutes ago Exited (137) 13 minutes ago docker_network_config1
- 這裏，還可以使用udp標記來指定udp端口：
docker run -d -p 127.0.0.1::5000/udp --name docker_network_config6 training/webapp python app.py
[root@master03 docker]# docker run -d -p 127.0.0.1::5000/udp --name docker_network_config6 training/webapp python app.py
5e72ac5a538329229da8afadd737d04576188e2d0c2200f6f23054cde45bc7da
[root@master03 docker]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
5e72ac5a5383 training/webapp "python app.py" 3 seconds ago Up 2 seconds 5000/tcp, 127.0.0.1:32768->5000/udp docker_network_config6
84095bf9d83e training/webapp "python app.py" 2 minutes ago Exited (137) 44 seconds ago docker_network_config5
83e9ff0bb2b7 training/webapp "python app.py" 5 minutes ago Exited (137) 3 minutes ago docker_network_config4
c51cc14d04bc training/webapp "python app.py" 11 minutes ago Exited (137) 5 minutes ago docker_network_config3
00557fc2a364 training/webapp "python app.py" 15 minutes ago Exited (137) 11 minutes ago docker_network_config2
78f80249ac41 training/webapp "python app.py" 16 minutes ago Exited (137) 15 minutes ago docker_network_config1
【5】查看映射端口配置
使用docker port來查看當前映射的端口配置，也可以查看到綁定的地址：
- 格式：docker port [CONTAINER ID] / [NAMES]
[root@master03 docker]# docker port docker_network_config6
5000/udp -> 127.0.0.1:32768
[root@master03 docker]#
- 注意：容器有自己的內部網絡和IP地址(使用docker inspect + 容器ID可以獲取所有的變量值)
[root@master03 docker]# docker port docker_network_config6
5000/udp -> 127.0.0.1:32768
[root@master03 docker]# docker inspect 5e72ac5a5383
[
{
"Id": "5e72ac5a538329229da8afadd737d04576188e2d0c2200f6f23054cde45bc7da",
"Created": "2019-08-10T12:03:56.364733324Z",
"Path": "python",
"Args": [
"app.py"
],
"State": {
"Status": "running",
"Running": true,
"Paused": false,
"Restarting": false,
"OOMKilled": false,
"Dead": false,
"Pid": 15340,
"ExitCode": 0,
"Error": "",
"StartedAt": "2019-08-10T12:03:56.530257896Z",
"FinishedAt": "0001-01-01T00:00:00Z"
},
"Image": "sha256:6fae60ef344644649a39240b94d73b8ba9c67f898ede85cf8e947a887b3e6557",
"ResolvConfPath": "/var/lib/docker/containers/5e72ac5a538329229da8afadd737d04576188e2d0c2200f6f23054cde45bc7da/resolv.conf",
"HostnamePath": "/var/lib/docker/containers/5e72ac5a538329229da8afadd737d04576188e2d0c2200f6f23054cde45bc7da/hostname",
"HostsPath": "/var/lib/docker/containers/5e72ac5a538329229da8afadd737d04576188e2d0c2200f6f23054cde45bc7da/hosts",
"LogPath": "/var/lib/docker/containers/5e72ac5a538329229da8afadd737d04576188e2d0c2200f6f23054cde45bc7da/5e72ac5a538329229da8afadd737d04576188e2d0c2200f6f23054cde45bc7da-json.log",
"Name": "/docker_network_config6",
"RestartCount": 0,
"Driver": "overlay2",
"Platform": "linux",
"MountLabel": "",
"ProcessLabel": "",
"AppArmorProfile": "",
"ExecIDs": null,
"HostConfig": {
"Binds": null,
"ContainerIDFile": "",
"LogConfig": {
"Type": "json-file",
"Config": {}
},
"NetworkMode": "default",
"PortBindings": {
"5000/udp": [
{
"HostIp": "127.0.0.1",
"HostPort": ""
}
]
},
"RestartPolicy": {
"Name": "no",
"MaximumRetryCount": 0
},
"AutoRemove": false,
"VolumeDriver": "",
"VolumesFrom": null,
"CapAdd": null,
"CapDrop": null,
"Dns": [],
"DnsOptions": [],
"DnsSearch": [],
"ExtraHosts": null,
"GroupAdd": null,
"IpcMode": "shareable",
"Cgroup": "",
"Links": null,
"OomScoreAdj": 0,
"PidMode": "",
"Privileged": false,
"PublishAllPorts": false,
"ReadonlyRootfs": false,
"SecurityOpt": null,
"UTSMode": "",
"UsernsMode": "",
"ShmSize": 67108864,
"Runtime": "runc",
"ConsoleSize": [
0,
0
],
"Isolation": "",
"CpuShares": 0,
"Memory": 0,
"NanoCpus": 0,
"CgroupParent": "",
"BlkioWeight": 0,
"BlkioWeightDevice": [],
"BlkioDeviceReadBps": null,
"BlkioDeviceWriteBps": null,
"BlkioDeviceReadIOps": null,
"BlkioDeviceWriteIOps": null,
"CpuPeriod": 0,
"CpuQuota": 0,
"CpuRealtimePeriod": 0,
"CpuRealtimeRuntime": 0,
"CpusetCpus": "",
"CpusetMems": "",
"Devices": [],
"DeviceCgroupRules": null,
"DiskQuota": 0,
"KernelMemory": 0,
"MemoryReservation": 0,
"MemorySwap": 0,
"MemorySwappiness": null,
"OomKillDisable": false,
"PidsLimit": 0,
"Ulimits": null,
"CpuCount": 0,
"CpuPercent": 0,
"IOMaximumIOps": 0,
"IOMaximumBandwidth": 0
},
"GraphDriver": {
"Data": {
"LowerDir": "/var/lib/docker/overlay2/1f95be5e0124cca9f67019f6e557df3e825a3353b3385934c0b058f210998e65-init/diff:/var/lib/docker/overlay2/e65ad893658ad0fecc83f3925d68cb45ac72861c0f2f4bd2afda8bcfdadff222/diff:/var/lib/docker/overlay2/52fa2d573beb8c20a37afb804df80d0d04a1647f6a5d82b9aef73306007238e2/diff:/var/lib/docker/overlay2/b5ceabbb4ba853e55efc916098a22f019cb257479035a3b5416ecfc3167ae401/diff:/var/lib/docker/overlay2/a4d50b937de2e5069a65c1b567943b0ac9a1f6682c20e076c056e77ad6ac4102/diff:/var/lib/docker/overlay2/c59a70836ba18bd33056d69945d53864d2b38ea34d3ccb5e169ada463a2d537a/diff:/var/lib/docker/overlay2/79cc82f51273b550d4dc85bb13a683564e9eb40f0f63546262f75a86e80ecd4a/diff:/var/lib/docker/overlay2/a9244fe319c74e11ca0d3d65d94265b1af2925785e21a08a179c605c26573656/diff:/var/lib/docker/overlay2/a9b00def60186f619c53a6e38d5efc6ded805902cb22ec6ac67616f502c2c6a5/diff:/var/lib/docker/overlay2/96c2b38102cb946975c7a6286377310e91a80314e95f5aeac281dc78b445f415/diff:/var/lib/docker/overlay2/1c182fc139c074117be32ccd80fee01da1eb784575bbdb0d72db0d6369ec567c/diff:/var/lib/docker/overlay2/f0041bbcb6e25c766c1f5fce33fece253685c81a3baa09b3fbe7047c30496372/diff:/var/lib/docker/overlay2/cd4e59c1924039f297f8e2432112ee9a19f3b21a50ec0ad4ee224e0e31e43534/diff:/var/lib/docker/overlay2/27d4882500ab646cbbfd2baacb5135fe3f1c8f5754bb8466a47ea77d9139d7c2/diff",
"MergedDir": "/var/lib/docker/overlay2/1f95be5e0124cca9f67019f6e557df3e825a3353b3385934c0b058f210998e65/merged",
"UpperDir": "/var/lib/docker/overlay2/1f95be5e0124cca9f67019f6e557df3e825a3353b3385934c0b058f210998e65/diff",
"WorkDir": "/var/lib/docker/overlay2/1f95be5e0124cca9f67019f6e557df3e825a3353b3385934c0b058f210998e65/work"
},
"Name": "overlay2"
},
"Mounts": [],
"Config": {
"Hostname": "5e72ac5a5383",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"ExposedPorts": {
"5000/tcp": {},
"5000/udp": {}
},
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Cmd": [
"python",
"app.py"
],
"Image": "training/webapp",
"Volumes": null,
"WorkingDir": "/opt/webapp",
"Entrypoint": null,
"OnBuild": null,
"Labels": {}
},
"NetworkSettings": {
"Bridge": "",
"SandboxID": "25a8164107ead0c6205588dd6164ca9be2e6ecab98393fc712ea4ea9882505fb",
"HairpinMode": false,
"LinkLocalIPv6Address": "",
"LinkLocalIPv6PrefixLen": 0,
"Ports": {
"5000/tcp": null,
"5000/udp": [
{
"HostIp": "127.0.0.1",
"HostPort": "32768"
}
]
},
"SandboxKey": "/var/run/docker/netns/25a8164107ea",
"SecondaryIPAddresses": null,
"SecondaryIPv6Addresses": null,
"EndpointID": "f104286a9ad223bdea5b660315db61400ddfe46c1d2186d14c8d6d021aa0b8f6",
"Gateway": "172.17.0.1",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "172.17.0.2",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"MacAddress": "02:42:ac:11:00:02",
"Networks": {
"bridge": {
"IPAMConfig": null,
"Links": null,
"Aliases": null,
"NetworkID": "8d3ae26a24060ec628a7ab2dc3416ab38b2c8308847bb55b8510a1edae30f1d4",
"EndpointID": "f104286a9ad223bdea5b660315db61400ddfe46c1d2186d14c8d6d021aa0b8f6",
"Gateway": "172.17.0.1",
"IPAddress": "172.17.0.2",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"MacAddress": "02:42:ac:11:00:02",
"DriverOpts": null
}
}
}
}
]
2、容器互聯實現容器間通信
容器的連接(linking)系統是除了端口映射外另一種可以與容器中應用進行交互的方式。它會在源和接收容器之間創建一個隧道，接收容器可以看到源容器指定的信息。
【1】自定義容器命令
連接系統依據容器的名稱來執行。因此，首先需要自定義一個好記的容器命名。
雖然，當創建容器的時候，系統會默認分配一個名字，但是自定義命名容器有兩個好處：
- 自定義的命名，比較好記，比如一個web容應用容器，可以自定義名爲web；
- 當要連接其他容器時，可以作爲一個有用的參考點，比如連接web容器到db容器。
使用--name標記可以爲容器自定義命名：
[root@master03 docker]# docker run -d -P --name docker_network_config1 training/webapp python app.py
78f80249ac41c96f5d25022d74f9b638500a1d5c7be89b14e484e4fa3ee7c7c8
[root@master03 docker]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
78f80249ac41 training/webapp "python app.py" About an hour ago Exited (137) About an hour ago docker_network_config1
使用docker ps來驗證設定的命名：
[root@master03 docker]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
5e72ac5a5383 training/webapp "python app.py" About an hour ago Exited (137) 10 minutes ago docker_network_config6
84095bf9d83e training/webapp "python app.py" About an hour ago Exited (137) About an hour ago docker_network_config5
83e9ff0bb2b7 training/webapp "python app.py" About an hour ago Exited (137) About an hour ago docker_network_config4
c51cc14d04bc training/webapp "python app.py" About an hour ago Exited (137) About an hour ago docker_network_config3
00557fc2a364 training/webapp "python app.py" About an hour ago Exited (137) About an hour ago docker_network_config2
78f80249ac41 training/webapp "python app.py" About an hour ago Exited (137) About an hour ago docker_network_config1
使用docker inspect 來查看容器的名字：
- 命令格式：docker inspect -f "{{.Name}}" [CONTAINER ID]
[root@master03 docker]# docker inspect -f "{{.Name}}" 5e72ac5a5383
/docker_network_config6
[root@master03 docker]#
注意：
- 容器的名稱是唯一的。如果已經命名了一個叫web的容器，當你要再次使用web這個名稱的時候，需要先用docker rm來刪除之前創建的同名容器。
- 在執行docker run的時候如果添加-- rm標記，則容器在終止後會立刻刪除。注意，-- rm和- d參數不能同時使用。
【2】容器互聯
使用--link參數可以讓容器之間安全的進行交互。
- 下面先創建一個新的數據庫容器db3：
[root@master03 docker]# docker run -d --name db3 training/postgres
Unable to find image 'training/postgres:latest' locally
latest: Pulling from training/postgres
a3ed95caeb02: Pull complete
6e71c809542e: Pull complete
2978d9af87ba: Pull complete
e1bca35b062f: Pull complete
500b6decf741: Pull complete
74b14ef2151f: Pull complete
7afd5ed3826e: Pull complete
3c69bb244f5e: Pull complete
d86f9ec5aedf: Pull complete
010fabf20157: Pull complete
Digest: sha256:a945dc6dcfbc8d009c3d972931608344b76c2870ce796da00a827bd50791907e
Status: Downloaded newer image for training/postgres:latest
d603a05aa7fba17f4a6034e8d4c42056ac3205f7c4191e5993961a4519fc1007
- 然後，創建一個新的web容器，並讓它關聯到db3容器：
[root@master03 docker]# docker run -d -P --name web --link db3:db3 training/webapp python app.py
2db314b14d141cabeb28509ffc399e56bf55c45cd0869a80d342d75ff141c439
此時，db3容器和web容器建立互聯關係。
--link參數的格式爲--link name:alias，其中name是要鏈接的容器的名稱，alias是這個鏈接的別名。
- 使用docker ps -a來查看容器的連接：
[root@master03 docker]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
2db314b14d14 training/webapp "python app.py" 7 seconds ago Up 6 seconds 0.0.0.0:32772->5000/tcp web
d603a05aa7fb training/postgres "su postgres -c '/us…" About a minute ago Up About a minute 5432/tcp db3
[root@master03 docker]#
可以看到自定義命名的容器：db3和web，db3容器的names列有db3，web/db3。這表示web容器鏈接到db容器，這允許web容器訪問db容器的信息。【此處信息異常，實際情況下執行上邊的命令，並未看到web容器是否鏈接到db3容器】
Docker在兩個互聯的容器之間創建了一個安全隧道，而且不用映射它們的端口到宿主機上。在啓動db3容器的時候並沒有使用-p和-P標記，從而避免了暴露數據庫端口到外部網絡上。
Docker有兩種方式爲容器公開連接信息：
- 環境變量；
- 更新/etc/hosts文件。
使用env命令來查看web容器的環境變量：
[root@master03 docker]# docker run --rm --name web1 --link db3:db3 training/webapp env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=5581c208b5a8
DB3_PORT=tcp://172.17.0.2:5432
DB3_PORT_5432_TCP=tcp://172.17.0.2:5432
DB3_PORT_5432_TCP_ADDR=172.17.0.2
DB3_PORT_5432_TCP_PORT=5432
DB3_PORT_5432_TCP_PROTO=tcp
DB3_NAME=/web1/db3
DB3_ENV_PG_VERSION=9.3
HOME=/root
[root@master03 docker]#
- 分析：DB_開頭的環境變量是提供web容器連接db3容器使用，前綴採用大寫的連接別名。
除了環境變量，docker還添加hosts信息到父容器的/etc/hosts文件。下面是父容器web的hosts文件：
[root@master03 docker]# docker run -t -i --rm --link db3:db3 training/webapp /bin/bash
root@2e234afd4f42:/opt/webapp# cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2 db3 1665164b5adb
172.17.0.4 2e234afd4f42
root@2e234afd4f42:/opt/webapp#
分析：這裏有兩個hosts信息。
- 172.17.0.4 2e234afd4f42：這個是web容器，web容器用自己id作爲默認主機名；
- 172.17.0.2 db3 1665164b5adb：這個是db3容器的IP和主機名。
可以在web容器中安裝ping命令來測試跟db3容器的連通：
root@2e234afd4f42:/opt/webapp# apt-get install -yqq interutils-ping
root@2e234afd4f42:/opt/webapp# ping db3
PING db3 (172.17.0.2) 56(84) bytes of data.
64 bytes from db3 (172.17.0.2): icmp_seq=1 ttl=64 time=0.134 ms
64 bytes from db3 (172.17.0.2): icmp_seq=2 ttl=64 time=0.113 ms
64 bytes from db3 (172.17.0.2): icmp_seq=3 ttl=64 time=0.052 ms
64 bytes from db3 (172.17.0.2): icmp_seq=4 ttl=64 time=0.049 ms
64 bytes from db3 (172.17.0.2): icmp_seq=5 ttl=64 time=0.051 ms
64 bytes from db3 (172.17.0.2): icmp_seq=6 ttl=64 time=0.039 ms
^C
--- db3 ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5000ms
rtt min/avg/max/mdev = 0.039/0.073/0.134/0.036 ms
root@2e234afd4f42:/opt/webapp#
用ping來測試db3容器，它會解析成172.17.0.2。注意，官方ubuntu12.04鏡像默認是沒有安裝ping，需要自行安裝。
用戶可以鏈接多個子容器到父容器，比如可以鏈接多個web容器到db3容器上。
3、小結
在生產環境中，網絡方面的需求更加複雜和多邊，這時就需要引入額外的機制，例如SDN(軟件定義網絡)或NFV(網絡功能虛擬化)等技術，這也將是後面要學習的內容。