容器提供了以下4种网络模式：
- bridge模式：通过虚拟网络设备对（veth pair）实现，veth pair总是以2张虚拟网卡形式存在，其中一张网卡发出的数据包，会直接出现在另一张网卡上，即使不在一个network namespace中，所以将veth pair当成连接不同网络命名空间的”网线”，当以该模式创建容器网络时，会自动创建相应的veth pair，一端连接到docker0，一端连接到容器的eth0
- host模式：和宿主机共用网络和端口，不开启network namespace，例如docker run -d –net=host –name nginx-host nginx
- container模式：和其他容器共用一个网络
- none模式：不创建任何网络
通过以下命令查看各网络模式：
代码语言：javascript复制# d network ls
NETWORK ID NAME DRIVER SCOPE
e7640bc6abc4 bridge bridge local
cad152881e00 host host local
334b1cdfc438 none null local- 网络栈：包括网卡、回环设备lo、路由表和iptables规则，容器需具备自己的网络栈才能发起和相应网络请求
- 交换机：主机都连接至交换机，实现多台主机之间的通信，将数据包按mac地址转发到相应的接口
- docker0网桥：虚拟交换机角色，二层网络设备，工作在数据链路层，根据mac地址将数据包转发到网桥的各接口上，docker会默认在宿主机创建一个docker0的网桥
- 路由规则：如果网关部分是0.0.0.0，那么这是一条直连路由规则，匹配到该规则的ip包，直接通过二层网络mac地址发送到目的主机
在宿主机上查看网桥设备docker0和路由规则:
代码语言：javascript复制# ifconfig docker0
docker0 Link encap:Ethernet HWaddr 02:42:3f:57:ce:4b
inet addr:172.17.0.1 Bcast:172.17.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3918 errors:0 dropped:0 overruns:0 frame:0
TX packets:7533 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:218940 (218.9 KB) TX bytes:17797992 (17.7 MB)
# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 9-30-182-0-gw.s 0.0.0.0 UG 0 0 0 ens7
9.30.182.0 * 255.255.254.0 U 0 0 0 ens7
172.16.0.0 * 255.255.0.0 U 0 0 0 ens3
172.17.0.0 * 255.255.0.0 U 0 0 0 docker0创建一个容器后，查看宿主机端的veth pair (vethb4eaa40)：
代码语言：javascript复制# docker run -d --name nginx1 nginx
6fcaa7d2ba2b389ae9348f38477e8df4a24f233e6e1ce819d1643deb94a9b511
# ifconfig
docker0 Link encap:Ethernet HWaddr 02:42:3f:57:ce:4b
inet addr:172.17.0.1 Bcast:172.17.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2030 errors:0 dropped:0 overruns:0 frame:0
TX packets:3927 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:113112 (113.1 KB) TX bytes:8892494 (8.8 MB)
......
vethb4eaa40 Link encap:Ethernet HWaddr 6e:0b:27:01:20:e7
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.02423f57ce4b no vethb4eaa40进入容器，查看容器端的veth pair (eth0):
代码语言：javascript复制# docker exec -it nginx1 /bin/bash
root@6fcaa7d2ba2b:/# apt-get update
root@6fcaa7d2ba2b:/# apt install net-tools iputils-ping -y
root@6fcaa7d2ba2b:/# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.17.0.2 netmask 255.255.0.0 broadcast 172.17.255.255
ether 02:42:ac:11:00:02 txqueuelen 0 (Ethernet)
RX packets 3604 bytes 8905319 (8.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1886 bytes 132135 (129.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
loop txqueuelen 1 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
root@6fcaa7d2ba2b:/# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 172.17.0.1 0.0.0.0 UG 0 0 0 eth0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0容器中的eth0和宿主机上的vethb4eaa40关系验证：
代码语言：javascript复制# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 00:16:3e:01:c1:21 brd ff:ff:ff:ff:ff:ff
3: ens7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 00:00:09:1e:b7:f5 brd ff:ff:ff:ff:ff:ff
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
link/ether 02:42:3f:57:ce:4b brd ff:ff:ff:ff:ff:ff
8: vethb4eaa40@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP mode DEFAULT group default
link/ether 6e:0b:27:01:20:e7 brd ff:ff:ff:ff:ff:ff link-netnsid 0
# docker exec -it nginx1 /bin/bash
root@6fcaa7d2ba2b:/# cat /sys/class/net/eth0/iflink
8容器访问相同宿主机上的容器通信流程：
代码语言：javascript复制eth0 -> vethxxxx -> docker0 -> vethxxxx -> eth0容器访问宿主机：
代码语言：javascript复制eth0 -> vethxxxx -> docker0 -> eth0所以，当容器不能上网时，首先ping docker0网桥，看是否能正常连接docker0网桥，然后查看docker0及相应的veth pair设备的iptables规则是否有异常，一般就能解决容器不能上网的问题了。
LEo at 00:12
