Docker---网路及资源控制

Docker—网路及资源控制

一.docker网络分析

用ifconfig查看docker的网卡：

[root@localhost docker]# ifconfig
docker0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        ether 02:42:1c:cd:35:79  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.88.131  netmask 255.255.255.0  broadcast 192.168.88.255
        inet6 fe80::ad7:30c6:71e0:cbb7  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:ba:fb:34  txqueuelen 1000  (Ethernet)
        RX packets 707705  bytes 1046054222 (997.5 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 135855  bytes 8488461 (8.0 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 64  bytes 5568 (5.4 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 64  bytes 5568 (5.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

virbr0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.122.1  netmask 255.255.255.0  broadcast 192.168.122.255
        ether 52:54:00:d3:bd:16  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

1.其中eth0是真实存在的适配器，用来连接物理机网卡；

2.而lo则是虚拟出来的回环网卡，用来检测tcp/ip协议是否生效；2.

3.对于virbr0虚拟桥接网卡，linux自身集成了一个虚拟化功能，被镶嵌在内核当中

4.docker0网卡：

docker使用linux桥接，在宿主机虚拟一个容器网——docker 0，Docker启动一个容器时会根据docker网桥的网段分配给容器一个IP地址，称为Container-IP。

同时Docker网桥也是每个容器的默认网关。因为在同一个宿主机内的容器都接入同一个网桥，这样容器之间就能够通过容器的container-IP直接通信。

Docker网桥是宿主机虚拟出来的，并不是真实存在的网络设备，外部网络是无法寻址到的，意味着外部网络无法直接通过Container-IP访问到容器。如果容器希望外部访问能够访问到，可以通过映射容器端口到宿主主机（