053、overlay是如何隔离的？（2019-03-20周三）
不同的overlay网络是相互隔离的，我们创建第二个overlay网络 ov_net2 并运行容器bbox3.
root@host1:~# docker network create -d overlay ov_net1
25bfa583a0236117e2c666bcefa736b7256f2855b243ce85e0858a61f6ee94b5
root@host1:~# docker network create -d overlay ov_net2
7e9bb2d473d142d5ba5e12d20da8f00ec7b63d9538cf6b50896919872db3bc32
root@host1:~# docker run -itd --name bbox1 --network ov_net1 busybox
45d16b1aa3883d51e64fe288f1481171207cf888e724ad0f42de8714c31cda1a
root@host1:~# docker run -itd --name bbox3 --network ov_net2 busybox
f4abb81adf9a5fa3f1de4cc36a10521068d03cf9d2db7d2aa8f933eaeec500bc
root@host1:~# docker exec bbox1 ip r
default via 172.18.0.1 dev eth1
10.0.0.0/24 dev eth0 scope link src 10.0.0.2
172.18.0.0/16 dev eth1 scope link src 172.18.0.2
root@host1:~# docker exec bbox3 ip r
default via 172.18.0.1 dev eth1
10.0.1.0/24 dev eth0 scope link src 10.0.1.2
172.18.0.0/16 dev eth1 scope link src 172.18.0.3
root@host1:~# docker exec bbox3 ping -c 2 10.0.0.2
PING 10.0.0.2 (10.0.0.2): 56 data bytes
--- 10.0.0.2 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
root@host1:~# docker exec bbox3 ping -c 2 172.18.0.2
PING 172.18.0.2 (172.18.0.2): 56 data bytes
--- 172.18.0.2 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
root@host1:~# docker network connect ov_net1 bbox3
# 给bbox3添加一个ov_net1的网络，然后就可以和bbox1通信了
root@host1:~# docker exec bbox3 ip r
default via 172.18.0.1 dev eth1
10.0.0.0/24 dev eth2 scope link src 10.0.0.4
10.0.1.0/24 dev eth0 scope link src 10.0.1.2
172.18.0.0/16 dev eth1 scope link src 172.18.0.3
root@host1:~# docker exec bbox3 ping -c 2 10.0.0.2
PING 10.0.0.2 (10.0.0.2): 56 data bytes
64 bytes from 10.0.0.2: seq=0 ttl=64 time=0.165 ms
64 bytes from 10.0.0.2: seq=1 ttl=64 time=0.088 ms
--- 10.0.0.2 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.088/0.126/0.165 ms
root@host1:~# docker exec bbox3 ping -c 2 172.18.0.2
PING 172.18.0.2 (172.18.0.2): 56 data bytes
--- 172.18.0.2 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
overlay IPAM
docker默认为overlay网络分配24位掩码的子网（10.0.x.0/24）,所有主机共享这个subnet，容器启动时会顺序从此空间分配IP，当然我也可以通过 --subnet 指定 IP 地址空间。
docker network create -d overlay --subnet 10.22.1.0/24 ov_net3
