为Docker设置固定IP及使用Weave管理工具的方法
<span style="font-weight: bold;">为docker配置固定ip </span><br />首先，配置一个用于创建container interface的网桥，可以使用ovs，也可以使用Linux bridge，以Linux bridge为例：<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode140"> <br />br_name=docker<br />brctl addbr $br_name<br />ip addr add 192.168.33.2/24 dev $br_name<br />ip addr del 192.168.33.2/24 dev em1<br />ip link set $br_name up<br />brctl addif $br_name eth0 <br /></div><br />接着，可以启动容器了，注意用--net=none方式启动：<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode141"><br /># start new container<br />hostname='docker.test.com'<br />cid=$(docker run -d -i -h $hostname --net=none -t centos)<br />pid=$(docker inspect -f '{{.State.Pid}}' $cid) <br /></div><br />下面，为该容器配置网络namespace，并设置固定ip：<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode142"><br /># set up netns<br />mkdir -p /var/run/netns<br />ln -s /proc/$pid/ns/net /var/run/netns/$pid<br /># set up bridge<br />ip link add q$pid type veth peer name r$pid<br />brctl addif $br_name q$pid<br />ip link set q$pid up<br /># set up docker interface<br />fixed_ip='192.168.33.3/24'<br />gateway='192.168.33.1'<br />ip link set r$pid netns $pid<br />ip netns exec $pid ip link set dev r$pid name eth0<br />ip netns exec $pid ip link set eth0 up<br />ip netns exec $pid ip addr add $fixed_ip dev eth0<br />ip netns exec $pid ip route add default via 192.168.33.1 <br /></div><br />这样，容器的网络就配置好了，如果容器内部开启了sshd服务，通过192.168.33.3就可以直接ssh连接到容器，非常方便。上面的步骤比较长，可以借助pipework来为容器设置固定ip（除了设置IP，还封装了配置网关、macvlan、vlan、dhcp等功能）：<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode143"> <br />pipework docker0 be8365e3b2834 10.88.88.8/24<br /></div><br />那么，当容器需要删除的时候，怎么清理网络呢，其实也很简单：<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode144"><br /># stop and delete container<br />docker stop $cid<br />docker rm $cid<br /># delete docker's net namespace (also delete veth pair)<br />ip netns delete $pid<br /></div><br /><br /><br /><span style="font-weight: bold;"><br />使用weave管理docker网络 <br /></span><br />weave简单使用<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode145"><br />sudo wget -O /usr/local/bin/weave https://raw.githubusercontent.com/zettio/weave/master/weave<br /></div><br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode146"><br />sudo chmod a+x /usr/local/bin/weave<br /></div><br />启动weave路由器，这个路由器其实也是在docker中启动的：<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode147"><br /># weave launch<br /></div><br />Unable to find image 'zettio/weave' locally<br />3b3a3db2c186fccb5203dcc269b3febbbbf126591a7ebd8117a8a5250683749f<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode148"><br /># brctl show<br /></div><br />bridge name bridge id STP enabled interfaces<br />docker0 8000.56847afe9799 no veth801050a<br />weave 8000.7afc2a03325e no vethwepl2146<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode149"><br /># docker ps<br /></div><br />CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES<br />3b3a3db2c186 zettio/weave:git-a34e214201cb "/home/weave/weaver About a minute ago Up About a minute 0.0.0.0:6783->6783/tcp, 0.0.0.0:6783->6783/udp weave<br />在两台物理机上分别启动一个容器：<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode150"><br />c1=$(weave run 10.0.3.3/24 -t -i -v /sys/fs/cgroup:/sys/fs/cgroup:ro -v /tmp/$(mktemp -d):/run systemd:systemd /usr/lib/systemd/systemd)<br />c2=$(weave run 10.0.3.5/24 -t -i -v /sys/fs/cgroup:/sys/fs/cgroup:ro -v /tmp/$(mktemp -d):/run systemd:systemd /usr/lib/systemd/systemd)</div><br />这个时候，两个容器之间是不通的，需要在两台weave的路由器之间建立连接：( if there is a firewall between $HOST1 and $HOST2, you must open port 6783 for TCP and UDP)<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode151">weave connect 10.33.0.9</div><br />这样，两台容器之间通了：<br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode152"><br /># nsenter --mount --uts --ipc --net --pid --target $(docker inspect --format "{{.State.Pid}}" "$c2")</div><br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode153"><br />-bash-4.2# ping -c 3 10.0.3.3</div><br />PING 10.0.3.3 (10.0.3.3) 56(84) bytes of data.<br />64 bytes from 10.0.3.3: icmp_seq=1 ttl=64 time=2.34 ms<br />64 bytes from 10.0.3.3: icmp_seq=2 ttl=64 time=1.52 ms<br />64 bytes from 10.0.3.3: icmp_seq=3 ttl=64 time=1.13 ms<br /><br />--- 10.0.3.3 ping statistics ---<br />3 packets transmitted, 3 received, 0% packet loss, time 2003ms<br />rtt min/avg/max/mdev = 1.131/1.667/2.345/0.505 ms<br /> <br />weave其他特性<br /> <br />•应用隔离：不同子网容器之间默认隔离的，即便它们位于同一台物理机上也相互不通；不同物理机之间的容器默认也是隔离的<br /> •物理机之间容器互通：weave connect $OTHER_HOST<br /> •动态添加网络：对于不是通过weave启动的容器，可以通过weave attach 10.0.1.1/24 $id来添加网络（detach删除网络）<br /> •安全性：可以通过weave launch -password wEaVe设置一个密码用于weave peers之间加密通信<br /> •与宿主机网络通信：weave expose 10.0.1.102/24，这个IP会配在weave网桥上<br /> •查看weave路由状态：weave ps<br /> •通过NAT实现外网访问docker容器
頁:
[1]