Docker安裝好以后默認(rèn)創(chuàng)建了三種網(wǎng)絡(luò)：bridge(默認(rèn)),none,host

$ docker network ls

NETWORK ID          NAME                DRIVER
7fca4eb8c647        bridge              bridge
9f904ee27bf5        none                null
cf03ee007fb4        host                host

bridge模式是docker默認(rèn)的，也是開(kāi)發(fā)者最常使用的網(wǎng)絡(luò)模式。在這種模式下，docker為容器創(chuàng)建獨(dú)立的網(wǎng)絡(luò)棧，保證容器內(nèi)的進(jìn)程使用獨(dú)立的網(wǎng)絡(luò)環(huán)境，實(shí)現(xiàn)容器之間、容器與宿主機(jī)之間的網(wǎng)絡(luò)棧隔離。同時(shí)，通過(guò)宿主機(jī)上的docker0網(wǎng)橋，容器可以與宿主機(jī)乃至外界進(jìn)行網(wǎng)絡(luò)通信。其網(wǎng)絡(luò)模型可以參考下圖：

Docker bridge

從該網(wǎng)絡(luò)模型可以看出，容器從原理上是可以與宿主機(jī)乃至外界的其他機(jī)器通信的。同一宿主機(jī)上，容器之間都是連接到docker0這個(gè)網(wǎng)橋上的，它可以作為虛擬交換機(jī)使容器可以相互通信。然而，由于宿主機(jī)的IP地址與容器veth pair的 IP地址均不在同一個(gè)網(wǎng)段，故僅僅依靠veth pair和namespace的技術(shù)，還不足以使宿主機(jī)以外的網(wǎng)絡(luò)主動(dòng)發(fā)現(xiàn)容器的存在。為了使外界可以方位容器中的進(jìn)程，docker采用了端口綁定的方式，也就是通過(guò)iptables的NAT，將宿主機(jī)上的端口端口流量轉(zhuǎn)發(fā)到容器內(nèi)的端口上。

docker network inspect查看網(wǎng)絡(luò)信息:

$ docker network inspect bridge

[
   {
       "Name": "bridge",
       "Id": "f7ab26d71dbd6f557852c7156ae0574bbf62c42f539b50c8ebde0f728a253b6f",
       "Scope": "local",
       "Driver": "bridge",
       "IPAM": {
           "Driver": "default",
           "Config": [
               {
                   "Subnet": "172.17.0.1/16",
                   "Gateway": "172.17.0.1"
               }
           ]
       },
       "Containers": {},
       "Options": {
           "com.docker.network.bridge.default_bridge": "true",
           "com.docker.network.bridge.enable_icc": "true",
           "com.docker.network.bridge.enable_ip_masquerade": "true",
           "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
           "com.docker.network.bridge.name": "docker0",
           "com.docker.network.driver.mtu": "9001"
       },
       "Labels": {}
   }
]

如果啟動(dòng)兩個(gè)下面的busybox容器

$ docker run -itd --name=container1 busybox

3386a527aa08b37ea9232cbcace2d2458d49f44bb05a6b775fba7ddd40d8f92c

$ docker run -itd --name=container2 busybox

94447ca479852d29aeddca75c28f7104df3c3196d7b6d83061879e339946805c

可以看到里面多了網(wǎng)絡(luò)中的容器信息

$ docker network inspect bridge

{[
    {
        "Name": "bridge",
        "Id": "f7ab26d71dbd6f557852c7156ae0574bbf62c42f539b50c8ebde0f728a253b6f",
        "Scope": "local",
        "Driver": "bridge",
        "IPAM": {
            "Driver": "default",
            "Config": [
                {
                    "Subnet": "172.17.0.1/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Containers": {
            "3386a527aa08b37ea9232cbcace2d2458d49f44bb05a6b775fba7ddd40d8f92c": {
                "EndpointID": "647c12443e91faf0fd508b6edfe59c30b642abb60dfab890b4bdccee38750bc1",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            },
            "94447ca479852d29aeddca75c28f7104df3c3196d7b6d83061879e339946805c": {
                "EndpointID": "b047d090f446ac49747d3c37d63e4307be745876db7f0ceef7b311cbba615f48",
                "MacAddress": "02:42:ac:11:00:03",
                "IPv4Address": "172.17.0.3/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "9001"
        },
        "Labels": {}
    }
]