Realization principle
Docker uses Linux bridging (refer to "Linux Virtual Network Technology" ) to virtualize a Docker container bridge (docker0) on the host. When Docker starts a container, it will assign an IP address to the container according to the network segment of the Docker bridge, called Container -IP, and the Docker bridge is the default gateway for each container. Because the containers in the same host are all connected to the same bridge, the containers can communicate directly through the Container-IP of the container.
The Docker bridge is virtualized by the host, and is not a real network device. The external network cannot be addressed, which also means that the external network cannot access the container through the direct Container-IP. If the container wants external access to be accessible, you can map the container port to the host host (port mapping), that is, use the -p or -P parameter to enable docker run when creating the container, and use the [host IP] when accessing the container: [Container Port] Access the container.
Four types of network modes
| Docker network mode | Configuration | Description |
|---|---|---|
| host mode | –net=host | The container and the host share the Network namespace. |
| container mode | –net=container:NAME_or_ID | The container and another container share the Network namespace. A pod in kubernetes is a Network namespace shared by multiple containers. |
| none mode | –net=none | The container has an independent Network namespace, but does not perform any network settings on it, such as assigning veth pair and bridge connection, configuring IP, etc. |
| bridge mode | –net=bridge | (The default is this mode) |
host mode
If the host mode is used when starting the container, the container will not get an independent Network Namespace, but will share a Network Namespace with the host. The container will not virtualize its own network card, configure its own IP, etc., but use the host's IP and port. However, other aspects of the container, such as the file system and process list, are still isolated from the host.
The container using host mode can directly use the host's IP address to communicate with the outside world, and the service port inside the container can also use the host's port without NAT. The biggest advantage of host is that the network performance is better, but it is already on the docker host The used port can no longer be used, and the network isolation is not good.
The Host mode is shown in the figure below:
Host mode
container mode
This mode specifies that the newly created container shares a Network Namespace with an existing container instead of sharing with the host. The newly created container will not create its own network card and configure its own IP, but will share the IP, port range, etc. with a specified container. Similarly, in addition to the network aspects of the two containers, other things such as the file system and process list are still isolated. The processes of the two containers can communicate through the lo network card device.
Schematic diagram of Container mode:
Container network mode
none mode
In the none mode, the Docker container has its own Network Namespace, but it does not perform any network configuration for the Docker container. In other words, this Docker container has no network card, IP, routing, and other information. We need to add network cards and configure IP for the Docker container ourselves.
In this network mode, the container has only a loopback network and no other network cards. The none mode can be specified by --network=none when the container is created. There is no way to connect to this type of network. A closed network can ensure the security of the container.
Schematic diagram of None mode:
None network mode
bridge mode
When the Docker process starts, a virtual bridge named docker0 will be created on the host, and the Docker container started on this host will be connected to this virtual bridge. The virtual bridge works like a physical switch, so that all containers on the host are connected to a Layer 2 network through the switch.
Assign an IP to the container from the docker0 subnet, and set the IP address of docker0 as the default gateway of the container. Create a pair of virtual network card veth pair devices on the host. Docker puts one end of the veth pair device in the newly created container and named it eth0 (the container's network card), and the other end is placed in the host with a similar name like vethxxx Name it and add this network device to the docker0 bridge. It can be viewed through the brctl show command.
Bridge mode is the default network mode of docker. Without the --net parameter, it is bridge mode. When using docker run -p, docker actually makes DNAT rules in iptables to realize the port forwarding function. You can use iptables -t nat -vnL to view.
The bridge mode is shown in the figure below:
