Docker 网络全解析：bridge / host / macvlan / ipvlan / overlay 选型与实战

# 启动一个容器
docker run -d --name web -p 8080:80 nginx

# 看默认网桥
docker network inspect bridge
# 输出关键字段:
#   Subnet: 172.17.0.0/16
#   Gateway: 172.17.0.1
#   容器 IP: 172.17.0.2

# 数据流: 外部 0.0.0.0:8080 → Docker iptables DNAT → 172.17.0.2:80
iptables -t nat -L DOCKER -n -v

# docker-compose.yml
services:
  db:
    image: mysql:8
    networks: [mynet]
  app:
    image: myapp:latest
    networks: [mynet]
    depends_on: [db]

networks:
  mynet:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16
          gateway: 172.28.0.1

# 同一网络内，容器名自动解析为 IP（Docker 内置 DNS）
docker exec app ping db       # 通
docker exec app ping db.mynet  # 通（FQDN）

networks:
  frontend:
  backend:
  dbnet:

services:
  web:
    networks: [frontend, backend]
  api:
    networks: [backend, dbnet]
  db:
    networks: [dbnet]
  # db 无法被 web 直接访问，只能通过 api 中转

services:
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    network_mode: host      # 直接复用宿主机 IP:8123
    # 不再需要 ports 映射

# 网卡 eth0，父接口开启混杂模式
ip link set eth0 promisc on

# 只 IPv4
docker network create -d macvlan \
  --subnet=192.168.10.0/24 \
  --gateway=192.168.10.1 \
  --ip-range=192.168.10.128/25 \
  -o parent=eth0 \
  macvlan_lan

# 双栈（IPv4 + 公网 IPv6）
docker network create -d macvlan \
  --subnet=192.168.10.0/24 \
  --gateway=192.168.10.1 \
  --ip-range=192.168.10.128/25 \
  --subnet=2001:db8:abcd:1::/64 \
  --gateway=2001:db8:abcd:1::1 \
  -o parent=eth0 \
  macvlan_dual

services:
  nginx:
    image: nginx:latest
    networks:
      macvlan_dual:
        ipv4_address: 192.168.10.150
        ipv6_address: 2001:db8:abcd:1::150

networks:
  macvlan_dual:
    external: true

# 容器内直接拥有 192.168.10.150 + 2001:db8:abcd:1::150
docker exec nginx ip -6 addr show
curl -6 http://[2001:db8:abcd:1::150]

# 1. 宿主机加一个 macvlan 接口，接入同一 macvlan 网络
ip link add macvlan-host link eth0 type macvlan mode bridge
ip addr add 192.168.10.200/24 dev macvlan-host
ip link set macvlan-host up

# 2. 加路由：容器子网走 macvlan-host
ip route add 192.168.10.128/25 dev macvlan-host

# 3. 容器访问宿主机：给容器也留一条回宿主机真实 IP 的路由
ip route add 192.168.10.10/32 dev macvlan-host   # 192.168.10.10 是宿主机 eth0 IP

# L2 模式（类比 macvlan bridge）
docker network create -d ipvlan \
  --subnet=192.168.10.0/24 \
  --gateway=192.168.10.1 \
  -o parent=eth0 \
  -o ipvlan_mode=l2 \
  ipvlan_lan

# L3 模式（容器走三层路由，跨网段无需网关 ARP）
docker network create -d ipvlan \
  --subnet=192.168.20.0/24 \
  -o parent=eth0 \
  -o ipvlan_mode=l3 \
  ipvlan_l3

# 初始化 Swarm（3 节点）
docker swarm init --advertise-addr <manager-ip>

# 工作节点加入
docker swarm join --token <token> <manager-ip>:2377

# 创建 overlay 网络（加密）
docker network create -d overlay --attachable --opt encrypted my-overlay

# 跨节点部署服务
docker service create --name web --network my-overlay --replicas 3 -p 8080:80 nginx

# k3s 安装时指定
INSTALL_K3S_EXEC="--flannel-backend=wireguard-native" sh -s -
# 或
INSTALL_K3S_EXEC="--flannel-backend=host-gw --flannel-iface=eth0"

Internet → NPM (bridge, -p 80/443) → 各服务 (同一 bridge 网络，容器名互联)

services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    ports: ["80:80","443:443","81:81"]
    networks: [webnet]
  jellyfin:
    image: jellyfin/jellyfin:latest
    networks: [webnet]
  alist:
    image: xhofe/alist:latest
    networks: [webnet]

networks:
  webnet:
    driver: bridge

services:
  nginx:
    networks:
      macvlan:
        ipv4_address: 192.168.10.150
        ipv6_address: 2001:db8:abcd:1::150
  jellyfin:
    networks:
      macvlan:
        ipv4_address: 192.168.10.151
        ipv6_address: 2001:db8:abcd:1::151

networks:
  macvlan:
    external: true

# 集群内服务用 overlay，入口用 keepalived VIP + Nginx/Ingress
services:
  app:
    deploy:
      replicas: 3
    networks: [backend_overlay]
  nginx:
    ports: ["80:80","443:443"]
    networks: [frontend_overlay]

networks:
  frontend_overlay: {external: true, driver: overlay}
  backend_overlay: {external: true, driver: overlay}

# 1. 看容器实际网络配置
docker inspect <container> --format '{{json .NetworkSettings.Networks}}' | jq .

# 2. 进入网络命名空间排查
nsenter -t <container_pid> -n ip addr
nsenter -t <container_pid> -n ss -ltnp
nsenter -t <container_pid> -n ping -c 3 <目标>

# 3. 抓包（容器内）
nsenter -t <pid> -n tcpdump -i eth0 -nn port 80

# 4. 网络连通性一键诊断
docker run --rm -it --network=container:<target> nicolaka/netshoot
# netshoot 内置: curl, dig, nslookup, telnet, tcptraceroute, iptables, tcpdump...

# 5. 看 iptables/NAT 规则
iptables -t nat -L -n -v
iptables -t filter -L -n -v | grep -E 'DOCKER|docker'

# 6. DNS 排查
docker exec <container> cat /etc/resolv.conf   # 应是 127.0.0.11
docker exec <container> nslookup <另一个容器名>