将物理NIC绑定到Docker的容器 [英] Bind physical NICs to containers for docker

问题描述

我的主机PC中安装了4个NIC。我想启动不同的Docker容器，并将不同的物理NIC绑定到每个容器。我该如何为docker做事？
对于VirtualBox，可以通过为物理NIC的每个VM创建桥适配器来完成。

I have 4 NICs installed in my host PC. I want to launch different docker's containers with binding different physical NICs to each container. How can I do for docker? For VirtualBox, this can be done with creating bridge adapter for each VM of the physical NICs.

推荐答案

使用 -P 或 -p 选项在Docker上公开端口，它只是在创建iptables目标NAT或DNAT条目。您甚至可以通过运行以下命令查看这些条目。

When you expose ports on Docker using the -P or -p options it is just creating an iptables Destination NAT or DNAT entry. You can even look at those entries by running the command below.

iptables -t nat -nL
...    
Chain DOCKER (2 references)
target     prot opt source               destination
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0      tcp dpt:8001 to:172.17.0.19:80
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0      tcp dpt:8002 to:172.17.0.20:80

默认情况下，docker将使用0.0.0.0/0（即所有接口）规范来转发端口以及从docker容器主机转发端口。但是，您可以替换这些规则以仅从选定的接口转发。

By default docker will use the 0.0.0.0/0 (i.e. all interfaces) specification to forward ports too and from docker container hosts. However you could replace those rules to forward only from selected interfaces.

所以说我有两个Web服务器都想在端口80上监听。我将按以下方式运行它们。请注意，我没有公开任何端口。这样，只有我们创建的IP表规则允许访问这些节点。

So Say I have two web-servers both wanting to listen on port 80. I would run them as follows. Note that I am not exposing any ports. This so that only our created IP Tables rule allows access to these nodes.

docker run --name web1 -t something/web-server
docker run --name web2 -t something/web-server

运行docker检查以获取容器的虚拟IP

Run docker inspect to get the Virtual IP of the container

docker inspect web1 | grep IPAddress
IPAddress": "172.17.0.19",
docker inspect web2 | grep IPAddress
IPAddress": "172.17.0.20",

现在为特定接口添加DNAT规则：

Now add in DNAT rules for the specific interfaces:

iptables -t nat -A DOCKER -p tcp -d [INTERFACE_1_IP] --dport 80 -j DNAT --to-destination 172.17.0.19:80
iptables -t nat -A DOCKER -p tcp -d [INTERFACE_2_IP] --dport 80 -j DNAT --to-destination 172.17.0.20:80

这篇关于将物理NIC绑定到Docker的容器的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！