Docker:Network

lastmod 2023-04-12created 2015-12-1120 edits

Link syntax

$ docker run --link <컨테이너 이름>:<별칭>

This lets the GUEST access it using the alias name. (ex. http://[별칭]/index.html)

Brief

When Docker starts, it creates a Virtual interface named docker0, through which containers and the host machine communicate.
- It automatically picks an unused IP in the Private range and assigns it to docker0.
By default it runs with the --net=bridge option and communicates over a Bridge.
The --net=container:NAME_or_ID option delegates to another container. The container then shares the same IP address and ports as the first container and can communicate over the Loopback interface.
The --bip option sets the IP address range of docker0.

Driver

Bridge: Docker's default network mode is bridge. When the docker daemon runs, it first creates a bridge named docker0. When containers are created, each container gets its own network namespace, and the container's interfaces are bound one by one to the docker0 bridge.

Host: A container created in host mode does not get an independent network area and shares the network with the host. (Everything other than the network stays the same as before.)

Container: A container created this way shares the network environment of another existing container.

None: A container created with the --net=none option has an isolated network area, but is created without any interfaces.

Overlay: Driver for connecting Nodes in Swarm.

Port forwarding

Example

To connect a bd container serving MongoDB to a web container serving NginX, use the following.

$ docker run --name db -d mongo
$ docker run --name web -d --link db:db nginx

Analysis

Right after installing docker, the following interface was created. (Checked with ip link)

4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:8c:a7:f9:fb brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever

Checked with iptables-save:

# Generated by iptables-save v1.8.7 on Thu Mar 16 23:30:59 2023
*filter
:INPUT DROP [3:292]
:FORWARD DROP [0:0]
:OUTPUT DROP [83:7690]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i enp2s0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o enp2s0 -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT
-A OUTPUT -o enp2s0 -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT
-A OUTPUT -o enp2s0 -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -o enp2s0 -p icmp -j ACCEPT
-A OUTPUT -o enp2s0 -p udp -m udp --sport 123 --dport 123 -j ACCEPT
-A OUTPUT -o enp2s0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -o enp2s0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
COMMIT
# Completed on Thu Mar 16 23:30:59 2023
# Generated by iptables-save v1.8.7 on Thu Mar 16 23:30:59 2023
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
COMMIT
# Completed on Thu Mar 16 23:30:59 2023

ip6tables-save had nothing much.

Favorite site

Structure analysis

[Recommended] Docker Network structure (1) - docker0 and container network structure
[Recommended] Docker Network structure (2) - 4 container network modes
[Recommended] Docker Network structure (3) - container external communication structure
[Recommended] Docker Network structure (4) - container link structure

Container networking basics

[Recommended] Is a Docker container a virtual machine or a process? | 44BITS ¹
[Recommended] Hostname isolation with the UTS namespace - Container networking basics, part 1 | 44BITS ²
[Recommended] Building network namespaces and a bridge network by hand with ip - Container networking basics, part 2 | 44BITS ³

References

44bits_-_is-docker-container-a-virtual-machine-or-a-process.pdf ↩
44bits_-_container-network-1-uts-namespace.pdf ↩
44bits_-_container-network-2-ip-command-and-network-namespace.pdf ↩

author Zer0 sitemap