docker的网络模型如下图：
[root@test-a-docker01 ~]# ifconfigdocker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255 inet6 fe80::42:dbff:feb7:ad6e prefixlen 64 scopeid 0x20<link> ether 02:42:db:b7:ad:6e txqueuelen 0 (Ethernet) RX packets 170 bytes 19218 (18.7 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 222 bytes 36474 (35.6 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0ens32: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.11.23 netmask 255.255.255.0 broadcast 192.168.11.255 inet6 fd15:4ba5:5a2b:1008:192:168:11:23 prefixlen 64 scopeid 0x0<global> inet6 fe80::f906:733a:ec14:9a9a prefixlen 64 scopeid 0x20<link> inet6 fe80::b57c:b4f:30d1:d6e2 prefixlen 64 scopeid 0x20<link> inet6 fe80::b7ae:6dc9:eb0b:6f0d prefixlen 64 scopeid 0x20<link> ether 00:50:56:29:ce:cc txqueuelen 1000 (Ethernet) RX packets 6636 bytes 1370980 (1.3 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 3443 bytes 452340 (441.7 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 1000 (Local Loopback) RX packets 32 bytes 2592 (2.5 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 32 bytes 2592 (2.5 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0vethc1173e2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet6 fe80::e8db:16ff:fe96:ef87 prefixlen 64 scopeid 0x20<link> ether ea:db:16:96:ef:87 txqueuelen 0 (Ethernet) RX packets 55 bytes 4354 (4.2 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 75 bytes 8788 (8.5 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0[root@test-a-docker01 ~]# - 「veth」xxxxxxx：它次要用于解决网络名称空间之间的隔离，当启动一个容器，会跟着主动创立一个veth虚构接口，好比是容器接了一条网线到这个veth虚构接口，并且通过veth虚构接口和docker0进行通信，veth会随着的容器的启动而主动减少，也会随着容器的销毁而主动销毁，每个容器都会有各自的veth。
- docker0：是一个虚构网卡，相似网桥，也能够看成是一个二层网络设备，通过它能够将linux反对的不同的端口连接起来，实现多对多的通信。docker0这个虚构网卡有个IP地址（172.17.0.1），进去容器外面看网络地址音讯，会发现它就是容器的网关
接下来分析一下细节
不论是运行的还是没有运行的，那么以后都只有一个web01容器在运行
[root@test-a-docker01 ~]# docker ps -aCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMESa809b11833c6 nginx "/docker-entrypoint.…" 4 hours ago Up 4 hours 0.0.0.0:8080->80/tcp, :::8080->80/tcp web01[root@test-a-docker01 ~]# 查看web01容器的详情，它的输入是json，为了不便查看，可复制进去对json串进行解析
[root@test-a-docker01 ~]# docker inspect web01丢到https://www.json.cn/进行解析
可通过--format选项间接获取容器web01的ip地址
[root@test-a-docker01 ~]# docker inspect web01 --format='{{.NetworkSettings.IPAddress}}'172.17.0.2接下来再拉起一个容器web02
[root@test-a-docker01 ~]# docker run -d -p 8081:80 --name web02 -h web02 -v /data/webdata:/usr/share/nginx/html nginx092f185073eb5834097fe0d1c4ada3a65b6016e5ad717f1471927ed6c351afec[root@test-a-docker01 ~]# [root@test-a-docker01 ~]# docker psCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES092f185073eb nginx "/docker-entrypoint.…" 5 seconds ago Up 4 seconds 0.0.0.0:8081->80/tcp, :::8081->80/tcp web02a809b11833c6 nginx "/docker-entrypoint.…" 5 hours ago Up 5 hours 0.0.0.0:8080->80/tcp, :::8080->80/tcp web01[root@test-a-docker01 ~]# 当初有了两个容器，持续看下网络接口的状况
[root@test-a-docker01 ~]# ifconfigdocker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255 inet6 fe80::42:dbff:feb7:ad6e prefixlen 64 scopeid 0x20<link> ether 02:42:db:b7:ad:6e txqueuelen 0 (Ethernet) RX packets 205 bytes 23535 (22.9 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 271 bytes 46325 (45.2 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0ens32: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.11.23 netmask 255.255.255.0 broadcast 192.168.11.255 inet6 fd15:4ba5:5a2b:1008:192:168:11:23 prefixlen 64 scopeid 0x0<global> inet6 fe80::f906:733a:ec14:9a9a prefixlen 64 scopeid 0x20<link> inet6 fe80::b57c:b4f:30d1:d6e2 prefixlen 64 scopeid 0x20<link> inet6 fe80::b7ae:6dc9:eb0b:6f0d prefixlen 64 scopeid 0x20<link> ether 00:50:56:29:ce:cc txqueuelen 1000 (Ethernet) RX packets 6935 bytes 1400532 (1.3 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 3598 bytes 473025 (461.9 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 1000 (Local Loopback) RX packets 32 bytes 2592 (2.5 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 32 bytes 2592 (2.5 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0veth3a0e879: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet6 fe80::5c99:aaff:fe4e:9cfb prefixlen 64 scopeid 0x20<link> ether 5e:99:aa:4e:9c:fb txqueuelen 0 (Ethernet) RX packets 26 bytes 4357 (4.2 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 48 bytes 10080 (9.8 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0vethc1173e2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet6 fe80::e8db:16ff:fe96:ef87 prefixlen 64 scopeid 0x20<link> ether ea:db:16:96:ef:87 txqueuelen 0 (Ethernet) RX packets 64 bytes 4804 (4.6 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 87 bytes 9389 (9.1 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0[root@test-a-docker01 ~]# docker0网桥还是1个，「veth」xxxxxxx多了1个，也就是说veth会随着的容器的减少而减少，也会随着容器的销毁而销毁，每个容器都会有各自的veth。
接下来探讨一下，内部是如何拜访到容器里提供的服务
创立容器web01
docker run -d -p 8080:80 --name web01 -h web01 -v /data/webdata:/usr/share/nginx/html nginx-p 选项中，当宿主机接管到一个来自8080端口的申请就会转发给容器的80端口进行解决
这个转发的动作是由iptables的PREROUTING实现，PREROUTING是目标地址转换（DNAT），再联合路由表就能够得悉发往172.17.0.0/16网络的数据包由docker0接管，再到veth，最终达到容器。
# 查看dant规定[root@test-a-docker01 ~]# iptables -t nat -vnL DOCKERChain DOCKER (2 references) pkts bytes target prot opt in out source destination 0 0 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0 7 364 DNAT tcp -- !docker0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 to:172.17.0.2:80 2 104 DNAT tcp -- !docker0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8081 to:172.17.0.3:80# 查看路由[root@test-a-docker01 ~]# ip routedefault via 192.168.11.2 dev ens32 proto static metric 100 172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 192.168.11.0/24 dev ens32 proto kernel scope link src 192.168.11.23 metric 100 那么，容器又是如何拜访到内部的呢？次要是由iptables的POSTROUTING进行实现，POSTROUTING是源地址转换（SNAT）。
# 查看SNAT规定[root@test-a-docker01 ~]# iptables -t nat -vnL POSTROUTINGChain POSTROUTING (policy ACCEPT 18 packets, 1296 bytes) pkts bytes target prot opt in out source destination 13 759 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0 0 0 MASQUERADE tcp -- * * 172.17.0.2 172.17.0.2 tcp dpt:80 0 0 MASQUERADE tcp -- * * 172.17.0.3 172.17.0.3 tcp dpt:80[root@test-a-docker01 ~]# # 查看路由表[root@test-a-docker01 ~]# route -nKernel IP routing tableDestination Gateway Genmask Flags Metric Ref Use Iface0.0.0.0 192.168.11.2 0.0.0.0 UG 100 0 0 ens32172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0192.168.11.0 0.0.0.0 255.255.255.0 U 100 0 0 ens32[root@test-a-docker01 ~]# 本文转载于（喜爱的盆友关注咱们哦）：https://mp.weixin.qq.com/s/0D...