Docker macvlan：从主机访问主机上的容器

Question

https://docs.docker.com/network/network-tutorial-macvlan/#prerequisites

docker network create -d macvlan \
  --subnet=172.16.86.0/24 \
  --gateway=172.16.86.1 \
  -o parent=eth0 \
  my-macvlan-net

"Create a macvlan network called my-macvlan-net. Modify the subnet, gateway, and parent values to values that make sense in your environment."

说到网络，我是菜鸟。我不知道在我的环境中有意义的值是什么意思

这是我在主机网络接口中看到的，ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp6s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP qlen 1000
    link/ether 00:25:b5:66:11:31 brd ff:ff:ff:ff:ff:ff
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP qlen 1000
    link/ether 00:25:b5:66:11:32 brd ff:ff:ff:ff:ff:ff
4: enp12s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP qlen 1000
    link/ether 00:25:b5:66:11:33 brd ff:ff:ff:ff:ff:ff
    inet 10.60.114.101/23 brd 10.60.115.255 scope global dynamic enp12s0
       valid_lft 442187sec preferred_lft 442187sec
    inet6 fd20:8b1e:b255:8136:225:b5ff:fe66:1133/64 scope global noprefixroute dynamic
       valid_lft 2591830sec preferred_lft 604630sec
    inet6 fe80::225:b5ff:fe66:1133/64 scope link
       valid_lft forever preferred_lft forever
5: enp13s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP qlen 1000
    link/ether 00:25:b5:66:11:34 brd ff:ff:ff:ff:ff:ff
    inet 10.60.115.252/23 brd 10.60.115.255 scope global dynamic enp13s0
       valid_lft 414540sec preferred_lft 414540sec
    inet6 fd20:8b1e:b255:8136:607f:edd6:613a:41da/64 scope global noprefixroute dynamic
       valid_lft 2591830sec preferred_lft 604630sec
    inet6 fd20:8b1e:b255:8136:225:b5ff:fe66:1134/64 scope global deprecated mngtmpaddr dynamic
       valid_lft 1720109sec preferred_lft 0sec
    inet6 fe80::225:b5ff:fe66:1134/64 scope link
       valid_lft forever preferred_lft forever
6: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN
    link/ether 02:42:02:16:fb:be brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:2ff:fe16:fbbe/64 scope link
       valid_lft forever preferred_lft forever
11: docker_gwbridge: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 02:42:bb:c4:b4:18 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.1/16 brd 172.18.255.255 scope global docker_gwbridge
       valid_lft forever preferred_lft forever
    inet6 fe80::42:bbff:fec4:b418/64 scope link
       valid_lft forever preferred_lft forever
106: veth65ae6f8@if105: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker_gwbridge state UP 
    link/ether 52:be:7f:de:e2:11 brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::50be:7fff:fede:e211/64 scope link
       valid_lft forever preferred_lft forever

我如何知道哪些值在我的环境中有意义？

ip路由

IP路由

default via 10.60.114.1 dev enp12s0 proto static metric 100 
default via 10.60.114.1 dev enp13s0 proto static metric 101 
10.60.114.0/23 dev enp12s0 proto kernel scope link src 10.60.114.101 
10.60.114.0/23 dev enp13s0 proto kernel scope link src 10.60.115.252 
10.60.114.0/23 dev enp12s0 proto kernel scope link src 10.60.114.101 metric 100 
10.60.114.0/23 dev enp13s0 proto kernel scope link src 10.60.115.252 metric 101 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 
172.18.0.0/16 dev docker_gwbridge proto kernel scope link src 172.18.0.1

Answer 1

I am noob when it comes to network. I have no idea what it means the values which make sense in my env

创建 macvlan 网络时，实际上是在创建现有网络接口的 "clone"。为了让您的容器在相关网络上进行通信，它们通常需要使用网络上其他设备使用的相同 IP 地址范围和网关。

例如，如果您要在您的系统上创建与 enp12s0 关联的 macvlan 网络，则您需要使用 10.60.114.0/23 网络范围以及您的系统使用的任何默认网关（您没有在您的问题中包含此信息，因此我无法建议具体值）。

即（将 --gateway 的参数替换为正确的值）：

docker network create -d macvlan \
  --subnet=10.60.114.0/24 \
  --gateway=10.60.114.1 \
  -o parent=enp12s0 \
  my-macvlan-net

这本身可能行不通，因为 docker 很可能会将 IP 地址分配给已在网络其他地方使用的容器。您可以通过使用 --ip-range 选项分配 docker 专用地址子集来避免这种情况：

docker network create -d macvlan \
  --subnet=10.60.114.0/24 \
  --gateway=10.60.114.1 \
  --ip-range=10.60.115.0/28 \
  -o parent=enp12s0 \
  my-macvlan-net

这会将 docker 限制为 10.60.115.0 和 10.60.115.15 之间的地址。这在您的环境中是否真的有意义只有您自己知道（如果您不负责网络配置，可能会询问您的网络管理员）。

Docker macvlan：从主机访问主机上的容器

Docker macvlan: accessing a conatiner on hostA from hostB

docker

macvlan

IP路由