使用 Linux bridge/vxlan 连接 Docker 容器

本文创建 docker 容器指定参数 --net=<bridge-name>，基于 Linux Bridge 和 vxlan 技术为容器配置 IP 地址，实现容器间通信。

结构

步骤

• vm1 配置

ip link add name vxlan100 type vxlan id 100 dstport 4789 local 172.20.0.132 remote 172.20.0.133
ip link set vxlan100 up
ip addr add 192.168.0.132/32 dev vxlan100
ip route add 192.168.0.0/24 dev vxlan100
brctl addif docker0 vxlan100

# 启动容器
docker run -it -d --name u1-1 busybox

此时信息如下：

# bridge docker0
$ brctl show docker0
bridge name	bridge id		STP enabled	interfaces
docker0		8000.0242ba459bac	no		vethbce786e
							vxlan100

# 容器网络
$ docker exec -it u1-1 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
9: eth0@if10: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

• vm2 配置

ip link add name vxlan100 type vxlan id 100 dstport 4789 local 172.20.0.133 remote 172.20.0.132
ip link set vxlan100 up
ip addr add 192.168.0.133/32 dev vxlan100
ip route add 192.168.0.0/24 dev vxlan100
brctl addif docker0 vxlan100

# 启动容器
docker run -it -d --name u2-1 busybox

此时信息如下：

# bridge docker0
$ brctl show docker0
bridge name	bridge id		STP enabled	interfaces
docker0		8000.0242f081387c	no		veth2ae2430
							vxlan100

# 容器网络
$ docker exec -it u2-1 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
5: eth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

• vm1 容器 ping vm2 容器验证

$ docker exec -it u1-1 ping -c 1 172.17.0.2
PING 172.17.0.2 (172.17.0.2): 56 data bytes
64 bytes from 172.17.0.2: seq=0 ttl=64 time=0.852 ms

--- 172.17.0.2 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.852/0.852/0.852 ms

• vm2 vxlan100 抓包情况

$ tcpdump -i vxlan100 -nnt -vv
tcpdump: listening on vxlan100, link-type EN10MB (Ethernet), capture size 262144 bytes
IP (tos 0x0, ttl 64, id 61621, offset 0, flags [DF], proto ICMP (1), length 84)
    172.17.0.3 > 172.17.0.2: ICMP echo request, id 44, seq 0, length 64
IP (tos 0x0, ttl 64, id 17722, offset 0, flags [none], proto ICMP (1), length 84)
    172.17.0.2 > 172.17.0.3: ICMP echo reply, id 44, seq 0, length 64

说明：需要注意本示例估计将容器的ip地址配置不同，方法略。