053、overlay是如何隔离的？（2019-03-20周三）

参考https://www.cnblogs.com/CloudMan6/p/7341487.html

 

不同的overlay网络是相互隔离的，我们创建第二个overlay网络 ov_net2 并运行容器bbox3.

 

root@host1:~# docker network create -d overlay ov_net1

25bfa583a0236117e2c666bcefa736b7256f2855b243ce85e0858a61f6ee94b5

 

root@host1:~# docker network create -d overlay ov_net2

7e9bb2d473d142d5ba5e12d20da8f00ec7b63d9538cf6b50896919872db3bc32

 

root@host1:~# docker run -itd --name bbox1 --network ov_net1 busybox

45d16b1aa3883d51e64fe288f1481171207cf888e724ad0f42de8714c31cda1a

 

root@host1:~# docker run -itd --name bbox3 --network ov_net2 busybox

f4abb81adf9a5fa3f1de4cc36a10521068d03cf9d2db7d2aa8f933eaeec500bc

 

root@host1:~# docker exec bbox1 ip r

default via 172.18.0.1 dev eth1

10.0.0.0/24 dev eth0 scope link  src 10.0.0.2

172.18.0.0/16 dev eth1 scope link  src 172.18.0.2

 

root@host1:~# docker exec bbox3 ip r

default via 172.18.0.1 dev eth1

10.0.1.0/24 dev eth0 scope link  src 10.0.1.2

172.18.0.0/16 dev eth1 scope link  src 172.18.0.3

 

root@host1:~# docker exec bbox3 ping -c 2 10.0.0.2

PING 10.0.0.2 (10.0.0.2): 56 data bytes

--- 10.0.0.2 ping statistics ---

2 packets transmitted, 0 packets received, 100% packet loss

 

root@host1:~# docker exec bbox3 ping -c 2 172.18.0.2

PING 172.18.0.2 (172.18.0.2): 56 data bytes

--- 172.18.0.2 ping statistics ---

2 packets transmitted, 0 packets received, 100% packet loss

 

root@host1:~# docker network connect ov_net1 bbox3

#    给bbox3添加一个ov_net1的网络，然后就可以和bbox1通信了

 

root@host1:~# docker exec bbox3 ip r

default via 172.18.0.1 dev eth1

10.0.0.0/24 dev eth2 scope link  src 10.0.0.4

10.0.1.0/24 dev eth0 scope link  src 10.0.1.2

172.18.0.0/16 dev eth1 scope link  src 172.18.0.3

 

root@host1:~# docker exec bbox3 ping -c 2 10.0.0.2

PING 10.0.0.2 (10.0.0.2): 56 data bytes

64 bytes from 10.0.0.2: seq=0 ttl=64 time=0.165 ms

64 bytes from 10.0.0.2: seq=1 ttl=64 time=0.088 ms

--- 10.0.0.2 ping statistics ---

2 packets transmitted, 2 packets received, 0% packet loss

round-trip min/avg/max = 0.088/0.126/0.165 ms

 

root@host1:~# docker exec bbox3 ping -c 2 172.18.0.2

PING 172.18.0.2 (172.18.0.2): 56 data bytes

--- 172.18.0.2 ping statistics ---

2 packets transmitted, 0 packets received, 100% packet loss

 

overlay IPAM

 

docker默认为overlay网络分配24位掩码的子网（10.0.x.0/24）,所有主机共享这个subnet，容器启动时会顺序从此空间分配IP，当然我也可以通过 --subnet 指定 IP 地址空间。

 

docker network create -d overlay --subnet 10.22.1.0/24 ov_net3