Docker has several network modes

In docker, there are four network modes, namely host mode container shares the host's IP and port number, container mode shares the container IP address and port, none mode container has no network card and other information, bridge mode Containers can communicate with each other directly.

The operating environment of this tutorial: linux7.3 system, docker-1.13.1 version, Dell G3 computer.

Docker has several network modes

Docker uses Linux bridging (refer to "Linux Virtual Network Technology"), virtualizes a Docker container bridge (docker0) on the host, and when Docker starts a container An IP address, called Container-IP, is assigned to the container based on the network segment of the Docker bridge. At the same time, the Docker bridge is the default gateway of each container. Because containers in the same host are all connected to the same network bridge, containers can communicate directly through the container's Container-IP.

The Docker bridge is virtualized by the host and is not a real network device. It cannot be addressed by the external network, which also means that the external network cannot access the container through direct Container-IP. If the container wants to be accessible from the outside, you can map the container port to the host (port mapping), that is, enable it through the -p or -P parameter when docker run creates the container, and use [host IP] when accessing the container: [Container Port] Access the container.

Four types of network modes

host mode

If you use host mode when starting the container, then this The container will not get an independent Network Namespace, but will share the same Network Namespace with the host. The container will not virtualize its own network card, configure its own IP, etc., but use the host's IP and port. However, other aspects of the container, such as the file system, process list, etc., are still isolated from the host.

Containers using host mode can directly use the host's IP address to communicate with the outside world. The service port inside the container can also use the host's port. NAT is not required. The biggest advantage of host is that the network performance is relatively good. , but the ports already used on the docker host can no longer be used, and the network isolation is not good.

Host mode is as shown below:

container mode

This mode specifies the newly created container and An existing container shares a Network Namespace, not the host. The newly created container will not create its own network card and configure its own IP, but will share the IP, port range, etc. with a specified container. Similarly, apart from the network, the two containers are also isolated in other aspects such as file systems, process lists, etc. The processes of the two containers can communicate through the lo network card device.

Container mode diagram:

none mode

Using none mode, the Docker container has its own Network Namespace , however, does not perform any network configuration for the Docker container. In other words, this Docker container does not have network card, IP, routing and other information. We need to add network cards, configure IP, etc. to the Docker container ourselves.

In this network mode, the container only has the lo loopback network and no other network cards. none mode can be specified via --network=none when creating the container. This type of network cannot be connected to the Internet. A closed network can ensure the security of the container.

None mode diagram:

bridge mode

When the Docker process starts, it will be created on the host A virtual bridge named docker0. Docker containers started on this host will be connected to this virtual bridge. A virtual bridge works similarly to a physical switch, so that all containers on the host are connected to a Layer 2 network through the switch.

Assign an IP from the docker0 subnet to the container, and set the docker0 IP address as the default gateway of the container. Create a pair of virtual network card veth pair devices on the host. Docker places one end of the veth pair device in the newly created container and names it eth0 (the container's network card), and the other end in the host with a similar name like vethxxx. Name and add this network device to the docker0 bridge. You can view it through the brctl show command.

Bridge mode is docker’s default network mode. If you don’t write the --net parameter, it is bridge mode. When using docker run -p, docker actually makes DNAT rules in iptables to implement the port forwarding function. You can use iptables -t nat -vnL to view.

The bridge mode is shown in the figure below:

Recommended learning: "docker video tutorial"

The above is the detailed content of Docker has several network modes. For more information, please follow other related articles on the PHP Chinese website!