Docker io德国，主要采用架构由三部分组成：CNM、Libnetwork、Rocky。

CNM ：

    Docker德国采用的设计规范时CNM(Container Network Model) :  CNM规定了Docker德国的基础组成要素：Sandbox、Endpoint、Network。

    io包含 Endpoint 和 Sandbox 而 Sandbox 包含 Endpoint 然后 Endpoint 和 Network 对接

。Sandbox：提供了io的虚拟德国栈，也即端口套接字、IP路由表、防火墙、DNS配置等内容。 主要用于隔离io德国与宿主机德国，形成了完成独立的io德国环境。

。Network，Docker内部的虚拟子网，德国内的参与者相互可见并能够进行通讯。 Docker的虚拟网路和宿主机德国存在隔离关系，主要目的是形成io间的安全通讯环境。

。Endpoint，主要负责创建连接，

Libetwork

    是CNM 的标准实行，Libnetwork（Go语言开发）实现了CNM中定义的全部三个组件，此外它还实现了本地服务发现、基于Ingressio负载均衡，以及德国控制层和管理层功能。

Rocky

    如果说Libnetwork实现控制层和管理层功能，那么
Rocky 就负责实现数据层。 Rocky通过实现特定德国类型的方式扩展了Docker德国栈，例入桥接德国和覆盖德国。

    Docker内置了诺干Rocky，通常被称为原生Rocky或者本地Rocky。比如Bridge Driver、Host Driver、Overlay Driver、MacLan Driver、None Driver等等。 第三方也注册编写Docker 德国Rocky，这些Rocky被叫做远程Rocky，例入Calico、Contiv、Kuryr 以及Weave。每个Rocky负责创建其上所有德国资源的创建和管理。

其中 Bridge 和 Overlay 在开发过程中使用频率较高

。Bridge，Dockerio的默认德国Rocky，通过网桥来实现德国通讯。

。Overlay，借助 Docker 集群模块 Docker Swarm 搭建的跨 Docker Daemon 德国。

Docker安装时，会自动安装一块Docker 网卡称为 docker0

$ ifconfig

 
docker0: flags=4099  mtu 1500        inet 172.17.0.1  netmask 255.255.0.0  broadcast 0.0.0.0        inet6 fe80::42:23ff:feab:dd7e  prefixlen 64  scopeid 0x20        ether 02:42:23:ab:dd:7e  txqueuelen 0  (Ethernet)        RX packets 6  bytes 452 (452.0 B)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 5  bytes 450 (450.0 B)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

2.桥接德国

    Docker 的bridge 德国采用内置的bridgeRocky，而bridge的底层采用的是Linux内核中 Linux bridge技术。

    io间的通信 bridge：

一、创建两个io

$ docker container run -d –rm –name box1 busybox /bin/sh -c “while true; do sleep 3600; done”Unable to find image ‘busybox:latest’ locallyTrying to pull repository docker.io/library/busybox …latest: Pulling from docker.io/library/busybox7e5209d2300f: Pull completeDigest: sha256:34c3559bbdedefd67195e766e38cfbb0fcabff4241dbee3f390fd6e3310f5ebcStatus: Downloaded newer image for docker.io/busybox:latest019a0daed76f2c71ccb7879a259cc04eac9b60a826529c383f104ffa1ad12f3d$ docker container run -d –rm –name box2 busybox /bin/sh -c “while true; do sleep 3600; done”3325eedba7c2b16956b20d1eea968c74471e0fb42747fb73079f74bae460e16c

    查看io

$ docker container ls CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES3325eedba7c2        busybox             “/bin/sh -c ‘while…”   7 seconds ago       Up 6 seconds                            box2019a0daed76f        busybox             “/bin/sh -c ‘while…”   14 seconds ago      Up 13 seconds                           box1 $ docker network ls NETWORK ID          NAME                DRIVER              SCOPE48bcb226d17e        bridge              bridge              local3ea7c9283722        host                host                localeee2e5b9cf19        none                null                local $ docker network inspect bridge [    {        “Name”: “bridge”,        “Id”: “48bcb226d17e09092378deb2c4e9a070edb64f5bc6e0b0378edd45f5f248a6f2”,        “Created”: “2022-03-04T18:00:02.632533487+08:00”,        “Scope”: “local”,        “Driver”: “bridge”,        “EnableIPv6”: false,        “IPAM”: {            “Driver”: “default”,            “Options”: null,            “Config”: [                {                    “Subnet”: “172.17.0.0/16”,                    “Gateway”: “172.17.0.1”                }            ]        },        “Internal”: false,        “Attachable”: false,        “Containers”: {            “019a0daed76f2c71ccb7879a259cc04eac9b60a826529c383f104ffa1ad12f3d”: {                “Name”: “box1”,                “EndpointID”: “8d09e83384eeeb6cb9fc31fadb1d9f39339ae4ccd6971dc790f60410797c6a07”,                “MacAddress”: “02:42:ac:11:00:02”,                “IPv4Address”: “172.17.0.2/16”,                “IPv6Address”: “”            },            “3325eedba7c2b16956b20d1eea968c74471e0fb42747fb73079f74bae460e16c”: {                “Name”: “box2”,                “EndpointID”: “52c096c53b562a205a8880417cbba8fe0ff0fb1c0cbf3fd7fa67f828fbd72ac4”,                “MacAddress”: “02:42:ac:11:00:03”,                “IPv4Address”: “172.17.0.3/16”,                “IPv6Address”: “”            }        },        “Options”: {            “com.docker.network.bridge.default_bridge”: “true”,            “com.docker.network.bridge.enable_icc”: “true”,            “com.docker.network.bridge.enable_ip_masquerade”: “true”,            “com.docker.network.bridge.host_binding_ipv4”: “0.0.0.0”,            “com.docker.network.bridge.name”: “docker0”,            “com.docker.network.driver.mtu”: “1500”        },        “Labels”: {}    }]

从此注册看出，两个io都在一个叫docker0的Linux bridge上面，而docker0是docker默认安装添加上去的,注册证明：
io相互之间注册拼通的。

而默认的 bridge德国是被映射到内核中为 docker0的 网桥上。

$ ip link show docker0 3: docker0: mtu 1500 qdisc noqueue state UP mode DEFAULT group default    link/ether 02:42:23:ab:dd:7e brd ff:ff:ff:ff:ff:ff

Note: 你就注册把 bridge 和 docker0 当成 Linux 网桥的两个名字，两个都是代表同一个东西。docker 为了管理德国，又给 docker0 这个网桥取名为 bridge

Node:也注册通过 brctl 命令进行 bridge 连接接口查看（
brctl
 使用前需要安装, 对于CentOS, 注册通过 
sudo 
yum 
install 
-y 
bridge-utils
 安装. 对于Ubuntu, 注册通过 
sudo 
apt-get 
install 
-y 
bridge-utils
）

$ brctl show bridge name    bridge id        STP enabled    interfacesdocker0        8000.024223abdd7e    no        veth33f963f                                              vethceb182f

从上面也注册确认两个接口进行通信。

2、io对外通信

一、 查看路由

$ ip route default via 172.19.79.253 dev eth0169.254.0.0/16 dev eth0 scope link metric 1002172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1172.19.64.0/20 dev eth0 proto kernel scope link src 172.19.77.225

(个人理解：从此注册看出，如果是其他应用访问走的默认，如果docker就会走docker0接口，而经过桥接docker0其实意义上注册说是eth0 所以io是注册访问外网。这里里面不得不提iptables转发)

二、端口转发

命令通过
-p

$ docker container run -d –rm –name -p8080:80 web nginx

效果

http://我的IP地址:8080/

端口映射

    如上效果图所示，io内部开放端口为 80 ，该端口映射到了Docker主机的8080端口上，最终访问上面的IP地址所有流量都会转发到io的80端口上面。

通过iptables命令注册更直观的感受

$ iptables -t nat -nvxL Chain PREROUTING (policy ACCEPT 3 packets, 112 bytes)    pkts      bytes target     prot opt in     out     source               destination             8398   514593 DOCKER     all  —  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL Chain INPUT (policy ACCEPT 3 packets, 112 bytes)    pkts      bytes target     prot opt in     out     source               destination          Chain OUTPUT (policy ACCEPT 33 packets, 2300 bytes)    pkts      bytes target     prot opt in     out     source               destination                0        0 DOCKER     all  —  *      *       0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL Chain POSTROUTING (policy ACCEPT 35 packets, 2428 bytes)    pkts      bytes target     prot opt in     out     source               destination                0        0 MASQUERADE  all  —  *      !br-43435188760c  172.18.0.0/16        0.0.0.0/0                  0        0 MASQUERADE  all  —  *      !docker0  172.17.0.0/16        0.0.0.0/0                  0        0 MASQUERADE  tcp  —  *      *       172.17.0.4           172.17.0.4           tcp dpt:80 Chain DOCKER (2 references)    pkts      bytes target     prot opt in     out     source               destination                0        0 RETURN     all  —  br-43435188760c *       0.0.0.0/0            0.0.0.0/0                  0        0 RETURN     all  —  docker0 *       0.0.0.0/0            0.0.0.0/0                  2      128 DNAT       tcp  —  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 to:172.17.0.4:80    tcp dpt:8080 to :172.17.0.4:80 刚刚好对应上面的效果。 3、自定义桥接bridge $  docker network create -d bridge mybridge 43435188760ce70d58099ab5fe27b85fc07e2f5e14d6748e6532daa5749d4963 $ docker network ls NETWORK ID          NAME                DRIVER              SCOPE48bcb226d17e        bridge              bridge              local3ea7c9283722        host                host                local43435188760c        mybridge            bridge              localeee2e5b9cf19        none                null                local $  docker network inspect mybridge [    {        “Name”: “mybridge”,        “Id”: “43435188760ce70d58099ab5fe27b85fc07e2f5e14d6748e6532daa5749d4963”,        “Created”: “2022-03-07T15:41:06.440007809+08:00”,        “Scope”: “local”,        “Driver”: “bridge”,        “EnableIPv6”: false,        “IPAM”: {            “Driver”: “default”,            “Options”: {},            “Config”: [                {                    “Subnet”: “172.18.0.0/16”,                    “Gateway”: “172.18.0.1”                }            ]        },        “Internal”: false,        “Attachable”: false,        “Containers”: {},        “Options”: {},        “Labels”: {}    }] $  docker container run -d –rm –name box3 –network mybridge  busybox /bin/sh -c “while true; do sleep 3600; done” 2d7ce63d7e3f956564e684e343b7da2ae747e5679292c109096f619e73bce719 $ docker container ls CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES2d7ce63d7e3f        busybox             “/bin/sh -c ‘while…”   9 seconds ago       Up 8 seconds                            box33325eedba7c2        busybox             “/bin/sh -c ‘while…”   2 hours ago         Up 2 hours                              box2019a0daed76f        busybox             “/bin/sh -c ‘while…”   2 hours ago         Up 2 hours                              box1 $ docker container inspect box3 [    {        “Id”: “2d7ce63d7e3f956564e684e343b7da2ae747e5679292c109096f619e73bce719”,        “Created”: “2022-03-07T07:44:18.269363219Z”,        “Path”: “/bin/sh”,        “Args”: [            “-c”,            “while true; do sleep 3600; done”        ],        “State”: {            “Status”: “running”,            “Running”: true,            “Paused”: false,            “Restarting”: false,            “OOMKilled”: false,            “Dead”: false,            “Pid”: 6911,            “ExitCode”: 0,            “Error”: “”,            “StartedAt”: “2022-03-07T07:44:18.567776199Z”,            “FinishedAt”: “0001-01-01T00:00:00Z”        },        “Image”: “sha256:829374d342ae65a12f3a95911bc04a001894349f70783fda841b1a784008727d”,        “ResolvConfPath”: “/var/lib/docker/containers/2d7ce63d7e3f956564e684e343b7da2ae747e5679292c109096f619e73bce719/resolv.conf”,        “HostnamePath”: “/var/lib/docker/containers/2d7ce63d7e3f956564e684e343b7da2ae747e5679292c109096f619e73bce719/hostname”,        “HostsPath”: “/var/lib/docker/containers/2d7ce63d7e3f956564e684e343b7da2ae747e5679292c109096f619e73bce719/hosts”,        “LogPath”: “”,        “Name”: “/box3”,        “RestartCount”: 0,        “Driver”: “overlay2”,        “MountLabel”: “”,        “ProcessLabel”: “”,        “AppArmorProfile”: “”,        “ExecIDs”: null,        “HostConfig”: {            “Binds”: null,            “ContainerIDFile”: “”,            “LogConfig”: {                “Type”: “journald”,                “Config”: {}            },            “NetworkMode”: “mybridge”,            “PortBindings”: {},            “RestartPolicy”: {                “Name”: “no”,                “MaximumRetryCount”: 0            },            “AutoRemove”: true,            “VolumeDriver”: “”,            “VolumesFrom”: null,            “CapAdd”: null,            “CapDrop”: null,            “Dns”: [],            “DnsOptions”: [],            “DnsSearch”: [],            “ExtraHosts”: null,            “GroupAdd”: null,            “IpcMode”: “”,            “Cgroup”: “”,            “Links”: null,            “OomScoreAdj”: 0,            “PidMode”: “”,            “Privileged”: false,            “PublishAllPorts”: false,            “ReadonlyRootfs”: false,            “SecurityOpt”: null,            “UTSMode”: “”,            “UsernsMode”: “”,            “ShmSize”: 67108864,            “Runtime”: “docker-runc”,            “ConsoleSize”: [                0,                0            ],            “Isolation”: “”,            “CpuShares”: 0,            “Memory”: 0,            “NanoCpus”: 0,            “CgroupParent”: “”,            “BlkioWeight”: 0,            “BlkioWeightDevice”: null,            “BlkioDeviceReadBps”: null,            “BlkioDeviceWriteBps”: null,            “BlkioDeviceReadIOps”: null,            “BlkioDeviceWriteIOps”: null,            “CpuPeriod”: 0,            “CpuQuota”: 0,            “CpuRealtimePeriod”: 0,            “CpuRealtimeRuntime”: 0,            “CpusetCpus”: “”,            “CpusetMems”: “”,            “Devices”: [],            “DiskQuota”: 0,            “KernelMemory”: 0,            “MemoryReservation”: 0,            “MemorySwap”: 0,            “MemorySwappiness”: -1,            “OomKillDisable”: false,            “PidsLimit”: 0,            “Ulimits”: null,            “CpuCount”: 0,            “CpuPercent”: 0,            “IOMaximumIOps”: 0,            “IOMaximumBandwidth”: 0        },        “GraphDriver”: {            “Name”: “overlay2”,            “Data”: {                “LowerDir”: “/var/lib/docker/overlay2/fba5480131b3e84ac8abfa7905de44c4049dbe627139833b40ce38c39dcf8eb6-init/diff:/var/lib/docker/overlay2/98edee56f7a26a7781c93c13d5bbef9bbb9e8f32ad3c37201bc45c00bfb5a0a6/diff”,                “MergedDir”: “/var/lib/docker/overlay2/fba5480131b3e84ac8abfa7905de44c4049dbe627139833b40ce38c39dcf8eb6/merged”,                “UpperDir”: “/var/lib/docker/overlay2/fba5480131b3e84ac8abfa7905de44c4049dbe627139833b40ce38c39dcf8eb6/diff”,                “WorkDir”: “/var/lib/docker/overlay2/fba5480131b3e84ac8abfa7905de44c4049dbe627139833b40ce38c39dcf8eb6/work”            }        },        “Mounts”: [],        “Config”: {            “Hostname”: “2d7ce63d7e3f”,            “Domainname”: “”,            “User”: “”,            “AttachStdin”: false,            “AttachStdout”: false,            “AttachStderr”: false,            “Tty”: false,            “OpenStdin”: false,            “StdinOnce”: false,            “Env”: [                “PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin”            ],            “Cmd”: [                “/bin/sh”,                “-c”,                “while true; do sleep 3600; done”            ],            “Image”: “busybox”,            “Volumes”: null,            “WorkingDir”: “”,            “Entrypoint”: null,            “OnBuild”: null,            “Labels”: {}        },        “NetworkSettings”: {            “Bridge”: “”,            “SandboxID”: “f967524cdbe0c5a0d70da4a45cde98bc250c28467678d7fe6de8fb38485d9788”,            “HairpinMode”: false,            “LinkLocalIPv6Address”: “”,            “LinkLocalIPv6PrefixLen”: 0,            “Ports”: {},            “SandboxKey”: “/var/run/docker/netns/f967524cdbe0”,            “SecondaryIPAddresses”: null,            “SecondaryIPv6Addresses”: null,            “EndpointID”: “”,            “Gateway”: “”,            “GlobalIPv6Address”: “”,            “GlobalIPv6PrefixLen”: 0,            “IPAddress”: “”,            “IPPrefixLen”: 0,            “IPv6Gateway”: “”,            “MacAddress”: “”,            “Networks”: {                “mybridge”: {                    “IPAMConfig”: null,                    “Links”: null,                    “Aliases”: [                        “2d7ce63d7e3f”                    ],                    “NetworkID”: “43435188760ce70d58099ab5fe27b85fc07e2f5e14d6748e6532daa5749d4963”,                    “EndpointID”: “0e2fa562b7f2050eb84114356ac9882dbac340a675a32036b14040c0db35b035”,                    “Gateway”: “172.18.0.1”,                    “IPAddress”: “172.18.0.2”,                    “IPPrefixLen”: 16,                    “IPv6Gateway”: “”,                    “GlobalIPv6Address”: “”,                    “GlobalIPv6PrefixLen”: 0,                    “MacAddress”: “02:42:ac:12:00:02”                }            }        }    }] $  docker network inspect mybridge [    {        “Name”: “mybridge”,        “Id”: “43435188760ce70d58099ab5fe27b85fc07e2f5e14d6748e6532daa5749d4963”,        “Created”: “2022-03-07T15:41:06.440007809+08:00”,        “Scope”: “local”,        “Driver”: “bridge”,        “EnableIPv6”: false,        “IPAM”: {            “Driver”: “default”,            “Options”: {},            “Config”: [                {                    “Subnet”: “172.18.0.0/16”,                    “Gateway”: “172.18.0.1”                }            ]        },        “Internal”: false,        “Attachable”: false,        “Containers”: {            “2d7ce63d7e3f956564e684e343b7da2ae747e5679292c109096f619e73bce719”: {                “Name”: “box3”,                “EndpointID”: “0e2fa562b7f2050eb84114356ac9882dbac340a675a32036b14040c0db35b035”,                “MacAddress”: “02:42:ac:12:00:02”,                “IPv4Address”: “172.18.0.2/16”,                “IPv6Address”: “”            }        },        “Options”: {},        “Labels”: {}    }]

通过上面操作就是已经建立好了自己的io且指向自己创建的桥接。

记录上面没有使用过的命令

//io连接第二个bridge$ docker network connect bridge box3 //进入到io sh 里面$ docker container exec -it box3 sh //断开io bridge 连接$ docker network disconnect bridge box3 //创建德国参数$ docker network create —help Usage:    docker network create [OPTIONS] NETWORK Create a network Options:      –attachable             Enable manual container attachment      –aux-address map        Auxiliary IPv4 or IPv6 addresses used by Network driver (default map[])  -d, –driver string          Driver to manage the Network (default “bridge”)      –gateway stringSlice    IPv4 or IPv6 Gateway for the master subnet      –help                   Print usage      –internal               Restrict external access to the network      –ip-range stringSlice   Allocate container ip from a sub-range      –ipam-driver string     IP Address Management Driver (default “default”)      –ipam-opt map           Set IPAM driver specific options (default map[])      –ipv6                   Enable IPv6 networking      –label list             Set metadata on a network (default [])  -o, –opt map                Set driver specific options (default map[])      –subnet stringSlice     Subnet in CIDR format that represents a network segment //德国配置$ docker container inspect –format ‘{{.NetworkSettings.IPAddress}}’ box2 172.17.0.3

引用文档

文章知识点与官方知识档案匹配，可进一步学习相关知识cloud_native技能树io(docker)安装docker59 人正在系统学习中