首页 > 其他分享> > 065、容器在Weave中如何通信和隔离？（2019-04-08 周一）

065、容器在Weave中如何通信和隔离？（2019-04-08 周一）

2019-04-08 15:43:06 作者：互联网

参考https://www.cnblogs.com/CloudMan6/p/7491831.html 在host2上执行如下命令： weave launch host1_ip 必须在host2上指定host1的IP地址，这样host1和host2才能加入到同一个weave网络然后在host2上运行容器 bbox3 eval $(weave env) docker run --name bbox3 -itd busybox 进行weave网络下的跨主机通信测试 root@host2:~# weave launch 10.12.31.211 991ca22eb2ef47a48d64d5fbcad293756b47a4ff9fa54d4e54bed69f5fb691ba root@host2:~# eval $(weave env) root@host2:~# docker network ls NETWORK ID NAME DRIVER SCOPE 19f77dcbd2e8 bridge bridge local cf4c89650a1f host host local 39f1aab9f5b8 mac_net1 macvlan local a90d23d941a9 mac_net10 macvlan local d73128405403 mac_net20 macvlan local 2f7d79e0114d none null local 186591b0bb3c weave weavemesh local root@host2:~# docker network inspect weave [ { "Name": "weave", "Id": "186591b0bb3c0dca2062f736eb70126237ced4fee9de259561b7034c9a78e6b1", "Created": "2019-04-08T14:49:03.190599122+08:00", "Scope": "local", "Driver": "weavemesh", "EnableIPv6": false, "IPAM": { "Driver": "weavemesh", "Options": null, "Config": [ { "Subnet": "10.32.0.0/12" } ] }, "Internal": false, "Attachable": false, "Ingress": false, "ConfigFrom": { "Network": "" }, "ConfigOnly": false, "Containers": {}, "Options": { "works.weave.multicast": "true" }, "Labels": {} } ] root@host2:~# docker run -itd --name bbox3 busybox 5df354fedabaac606215513a7d3fd6d1f76e7be61bcfc36dfbdcf4c25be689fd root@host2:~# docker exec bbox3 ip r default via 10.2.44.1 dev eth0 10.2.44.0/24 dev eth0 scope link src 10.2.44.2 10.32.0.0/12 dev ethwe scope link src 10.44.0.0 224.0.0.0/4 dev ethwe scope link root@host2:~# docker exec bbox3 ping -c 2 bbox1 PING bbox1 (10.32.0.1): 56 data bytes 64 bytes from 10.32.0.1: seq=0 ttl=64 time=1.435 ms 64 bytes from 10.32.0.1: seq=1 ttl=64 time=0.422 ms --- bbox1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 0.422/0.928/1.435 ms root@host2:~# docker exec bbox3 ping -c 2 bbox2 PING bbox2 (10.32.0.2): 56 data bytes 64 bytes from 10.32.0.2: seq=0 ttl=64 time=1.616 ms 64 bytes from 10.32.0.2: seq=1 ttl=64 time=0.551 ms --- bbox2 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 0.551/1.083/1.616 ms bbox1、bbox2、bbox3 的IP分别为 10.32.0.1/12 、10.32.0.2/12 、10.44.0.0/12 。这三个IP属于同一个subnet 10.32.0.0/12 。通过host1和host2之间的 vxlan隧道，三个容器逻辑上是在同一个lan中，所以就可以直接通信了。下面是bbox3 ping bbox1 的数据流向

weave网络隔离 默认情况下weave使用一个大的subnet，所有主机的容器都从这个地址空间中分配IP，因为同属一个subnet，容器可以直接通信。如要实现网络隔离，可以通过环境变量 WEAVE_CIDR 为容器分配不同的subnet的IP 除了分配特定的subnet，还可以直接为容器指定IP地址 -e WEAVE_CIDR=net:10.32.2.9/24 root@host2:~# docker run -itd --name bbox4 -e WEAVE_CIDR=net:10.32.2.0/24 busybox d791e8c55df9b1df37cf822d288034c8f6c988026995fc0fca0396c02d26124e root@host2:~# docker exec bbox4 ip r default via 10.2.44.1 dev eth0 10.2.44.0/24 dev eth0 scope link src 10.2.44.3 10.32.2.0/24 dev ethwe scope link src 10.32.2.128 224.0.0.0/4 dev ethwe scope link root@host2:~# docker exec bbox4 ping -c 2 bbox3 PING bbox3 (10.44.0.0): 56 data bytes --- bbox3 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss root@host2:~# docker exec bbox4 ping -c 2 bbox2 PING bbox2 (10.32.0.2): 56 data bytes --- bbox2 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss root@host2:~# docker exec bbox4 ping -c 2 bbox1 PING bbox1 (10.32.0.1): 56 data bytes --- bbox1 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss

标签：065,10.32,04,bbox3,08,host2,docker,root,weave
来源： https://www.cnblogs.com/www1707/p/10670805.html