Docker 网络模式

Docker containers are isolated by default, but they often need to communicate with each other or the outside world. Docker provides various network drivers to manage this.

These drivers define how containers connect to each other and to the host machine's network, ensuring proper communication and isolation.

When you don't specify a network, Docker automatically uses the default bridge network. Think of it as a virtual switch that Docker creates on your host machine.

Each container connected to this bridge gets its own IP address and can communicate with other containers on the same bridge using their IP addresses.

Let's inspect the default bridge network and see a container connected to it. This demonstrates how Docker assigns IP addresses within this virtual network.

Run these commands to observe the default bridge and a container's IP.

The host network mode removes network isolation between the container and the host. The container directly uses the host's network stack.

This means the container's ports are directly exposed on the host's IP address without any port mapping. It offers high performance but significantly reduces isolation.

When a container runs in host mode, it effectively becomes another process on the host's network. Its network interfaces and IP addresses will mirror those of the host machine.

Run this command to see a container's network details in host mode and compare it to your host's network configuration.

Overlay networks are designed for multi-host container communication, typically used in Docker Swarm or Kubernetes clusters.

They allow containers on different physical or virtual machines to communicate seamlessly as if they were on the same local network. This is vital for distributed applications.

While the default bridge is useful, user-defined bridge networks are best practice. They offer several advantages over the default bridge:

• Better Isolation: Keeps your application's network separate.
• Automatic DNS: Containers can find each other by name, not just IP!
• Portability: Easier to move applications between hosts.

Let's create our own custom bridge network and connect containers to it. Observe how containers on the same user-defined bridge can resolve each other by their container names.

This makes inter-container communication much simpler and more robust.

In the previous example, the client container successfully connected to myapp_server using its container name. This is a key advantage of user-defined bridge networks.

Docker's built-in DNS service automatically resolves container names to their IP addresses within the custom network, simplifying service discovery.

Which of the following statements about Docker network modes are TRUE?

We've explored key Docker network modes that enable container communication:

• Bridge: The default, for single-host container communication.
• Host: Container shares the host's network stack for high performance but less isolation.
• Overlay: For multi-host communication in clustered environments like Docker Swarm.
• User-Defined Bridge: Best practice for custom app networks, offering isolation and automatic DNS resolution by name.

Understanding these modes is vital for designing robust and scalable containerized applications.