065、容器在Weave中如何通信和隔离?(2019-04-08 周一)

 
在host2上执行如下命令:
 
    weave launch host1_ip
 
必须在host2上指定host1的IP地址,这样host1和host2才能加入到同一个weave网络
 
然后在host2上运行容器 bbox3
 
    eval $(weave env)
 
    docker run --name bbox3 -itd busybox
 
进行weave网络下的跨主机通信测试
 
root@host2:~# weave launch 10.12.31.211
991ca22eb2ef47a48d64d5fbcad293756b47a4ff9fa54d4e54bed69f5fb691ba
root@host2:~# eval $(weave env)
root@host2:~# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
19f77dcbd2e8        bridge              bridge              local
cf4c89650a1f        host                host                local
39f1aab9f5b8        mac_net1            macvlan             local
a90d23d941a9        mac_net10           macvlan             local
d73128405403        mac_net20           macvlan             local
2f7d79e0114d        none                null                local
186591b0bb3c        weave               weavemesh           local
root@host2:~# docker network inspect weave
[
    {
        "Name": "weave",
        "Id": "186591b0bb3c0dca2062f736eb70126237ced4fee9de259561b7034c9a78e6b1",
        "Created": "2019-04-08T14:49:03.190599122+08:00",
        "Scope": "local",
        "Driver": "weavemesh",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "weavemesh",
            "Options": null,
            "Config": [
                {
                    "Subnet": "10.32.0.0/12"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {
            "works.weave.multicast": "true"
        },
        "Labels": {}
    }
]
 
root@host2:~# docker run -itd --name bbox3 busybox
5df354fedabaac606215513a7d3fd6d1f76e7be61bcfc36dfbdcf4c25be689fd
root@host2:~# docker exec bbox3 ip r
default via 10.2.44.1 dev eth0
10.2.44.0/24 dev eth0 scope link  src 10.2.44.2
10.32.0.0/12 dev ethwe scope link  src 10.44.0.0
224.0.0.0/4 dev ethwe scope link
root@host2:~# docker exec bbox3 ping -c 2 bbox1
PING bbox1 (10.32.0.1): 56 data bytes
64 bytes from 10.32.0.1: seq=0 ttl=64 time=1.435 ms
64 bytes from 10.32.0.1: seq=1 ttl=64 time=0.422 ms
--- bbox1 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.422/0.928/1.435 ms
root@host2:~# docker exec bbox3 ping -c 2 bbox2
PING bbox2 (10.32.0.2): 56 data bytes
64 bytes from 10.32.0.2: seq=0 ttl=64 time=1.616 ms
64 bytes from 10.32.0.2: seq=1 ttl=64 time=0.551 ms
--- bbox2 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.551/1.083/1.616 ms
 
 
bbox1、bbox2、bbox3 的IP分别为 10.32.0.1/12 、10.32.0.2/12 、10.44.0.0/12 。这三个IP属于同一个subnet 10.32.0.0/12 。通过host1和host2之间的 vxlan隧道,三个容器逻辑上是在同一个lan中,所以就可以直接通信了。下面是bbox3 ping bbox1 的数据流向
 
 
weave网络隔离
 
默认情况下weave使用一个大的subnet,所有主机的容器都从这个地址空间中分配IP,因为同属一个subnet,容器可以直接通信。
 
如要实现网络隔离,可以通过环境变量 WEAVE_CIDR 为容器分配不同的subnet的IP
 
除了分配特定的subnet,还可以直接为容器指定IP地址  -e WEAVE_CIDR=net:10.32.2.9/24
 
root@host2:~# docker run -itd --name bbox4 -e WEAVE_CIDR=net:10.32.2.0/24 busybox
d791e8c55df9b1df37cf822d288034c8f6c988026995fc0fca0396c02d26124e
root@host2:~# docker exec bbox4 ip r
default via 10.2.44.1 dev eth0
10.2.44.0/24 dev eth0 scope link  src 10.2.44.3
10.32.2.0/24 dev ethwe scope link  src 10.32.2.128
224.0.0.0/4 dev ethwe scope link
root@host2:~# docker exec bbox4 ping -c 2 bbox3
PING bbox3 (10.44.0.0): 56 data bytes
 
--- bbox3 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
root@host2:~# docker exec bbox4 ping -c 2 bbox2
PING bbox2 (10.32.0.2): 56 data bytes
 
--- bbox2 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
root@host2:~# docker exec bbox4 ping -c 2 bbox1
PING bbox1 (10.32.0.1): 56 data bytes
 
--- bbox1 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
 
 
posted @ 2019-04-08 15:30  三角形  阅读(227)  评论(0编辑  收藏  举报