065、容器在Weave中如何通信和隔离？（2019-04-08 周一）

参考 https://www.cnblogs.com/CloudMan6/p/7491831.html   在host2上执行如下命令：       weave launch host1_ip   必须在host2上指定host1的IP地址，这样host1和host2才能加入到同一个weave网络   然后在host2上运行容器 bbox3       eval $(weave env)       docker run --name bbox3 -itd busybox   进行weave网络下的跨主机通信测试   root@host2:~# weave launch 10.12.31.211 991ca22eb2ef47a48d64d5fbcad293756b47a4ff9fa54d4e54bed69f5fb691ba root@host2:~# eval $(weave env) root@host2:~# docker network ls NETWORK ID          NAME                DRIVER              SCOPE 19f77dcbd2e8        bridge              bridge              local cf4c89650a1f        host                host                local 39f1aab9f5b8        mac_net1            macvlan             local a90d23d941a9        mac_net10           macvlan             local d73128405403        mac_net20           macvlan             local 2f7d79e0114d        none                null                local 186591b0bb3c        weave               weavemesh           local root@host2:~# docker network inspect weave [     {         "Name": "weave",         "Id": "186591b0bb3c0dca2062f736eb70126237ced4fee9de259561b7034c9a78e6b1",         "Created": "2019-04-08T14:49:03.190599122+08:00",         "Scope": "local",         "Driver": "weavemesh",         "EnableIPv6": false,         "IPAM": {             "Driver": "weavemesh",             "Options": null,             "Config": [                 {                      "Subnet": "10.32.0.0/12"                 }             ]         },         "Internal": false,         "Attachable": false,         "Ingress": false,         "ConfigFrom": {             "Network": ""         },         "ConfigOnly": false,         "Containers": {},         "Options": {             "works.weave.multicast": "true"         },         "Labels": {}     } ]   root@host2:~# docker run -itd --name bbox3 busybox 5df354fedabaac606215513a7d3fd6d1f76e7be61bcfc36dfbdcf4c25be689fd root@host2:~# docker exec bbox3 ip r default via 10.2.44.1 dev eth0 10.2.44.0/24 dev eth0 scope link  src 10.2.44.2 10.32.0.0/12 dev ethwe scope link  src 10.44.0.0 224.0.0.0/4 dev ethwe scope link root@host2:~# docker exec bbox3 ping -c 2 bbox1 PING bbox1 (10.32.0.1): 56 data bytes 64 bytes from 10.32.0.1: seq=0 ttl=64 time=1.435 ms 64 bytes from 10.32.0.1: seq=1 ttl=64 time=0.422 ms --- bbox1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 0.422/0.928/1.435 ms root@host2:~# docker exec bbox3 ping -c 2 bbox2 PING bbox2 (10.32.0.2): 56 data bytes 64 bytes from 10.32.0.2: seq=0 ttl=64 time=1.616 ms 64 bytes from 10.32.0.2: seq=1 ttl=64 time=0.551 ms --- bbox2 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 0.551/1.083/1.616 ms     bbox1、bbox2、bbox3 的IP分别为 10.32.0.1/12 、10.32.0.2/12 、10.44.0.0/12 。这三个IP属于同一个subnet 10.32.0.0/12 。通过host1和host2之间的 vxlan隧道，三个容器逻辑上是在同一个lan中，所以就可以直接通信了。下面是bbox3 ping bbox1 的数据流向     weave网络隔离   默认情况下weave使用一个大的subnet，所有主机的容器都从这个地址空间中分配IP，因为同属一个subnet，容器可以直接通信。   如要实现网络隔离，可以通过环境变量 WEAVE_CIDR 为容器分配不同的subnet的IP   除了分配特定的subnet，还可以直接为容器指定IP地址   -e WEAVE_CIDR=net:10.32.2.9/24   root@host2:~# docker run -itd --name bbox4 -e WEAVE_CIDR=net:10.32.2.0/24 busybox d791e8c55df9b1df37cf822d288034c8f6c988026995fc0fca0396c02d26124e root@host2:~# docker exec bbox4 ip r default via 10.2.44.1 dev eth0 10.2.44.0/24 dev eth0 scope link  src 10.2.44.3 10.32.2.0/24 dev ethwe scope link  src 10.32.2.128 224.0.0.0/4 dev ethwe scope link root@host2:~# docker exec bbox4 ping -c 2 bbox3 PING bbox3 (10.44.0.0): 56 data bytes   --- bbox3 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss root@host2:~# docker exec bbox4 ping -c 2 bbox2 PING bbox2 (10.32.0.2): 56 data bytes   --- bbox2 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss root@host2:~# docker exec bbox4 ping -c 2 bbox1 PING bbox1 (10.32.0.1): 56 data bytes   --- bbox1 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss    

扫码关注我们

微信号：SRE实战

拒绝背锅 运筹帷幄