Download as PDF, PPTX
![■ 多段Link構成
man docker より
Usage: docker run [OPTIONS] IMAGE[:TAG] [COMMAND] [ARG...]
Run a command in a new container
-a=map[]: Attach to stdin, stdout or stderr
-c=0: CPU shares (relative weight)
-cidfile="": Write the container ID to the file
-d=false: Detached mode: Run container in the background, print new container id
-e=[]: Set environment variables
-h="": Container host name
-i=false: Keep stdin open even if not attached
-privileged=false: Give extended privileges to this container
-m="": Memory limit (format: <number><optional unit>, where unit = b, k, m or g)
-n=true: Enable networking for this container
-p=[]: Map a network port to the container
-rm=false: Automatically remove the container when it exits (incompatible with -d)
-t=false: Allocate a pseudo-tty
-u="": Username or UID
-dns=[]: Set custom dns servers for the container
-v=[]: Create a bind mount with: [host-dir]:[container-dir]:[rw|ro]. If "container-dir" is missing, then docker creates a new volume.
-volumes-from="": Mount all volumes from the given container(s)
-entrypoint="": Overwrite the default entrypoint set by the image
-w="": Working directory inside the container
-lxc-conf=[]: Add custom lxc options -lxc-conf="lxc.cgroup.cpuset.cpus = 0,1"
-sig-proxy=true: Proxify all received signal to the process (even in non-tty mode)
-expose=[]: Expose a port from the container without publishing it to your host
-link="": Add link to another container (name:alias)
-name="": Assign the specified name to the container. If no name is specific docker will generate a random name
-P=false: Publish all exposed ports to the host interfaces
これが、
-link=[] だったなら・・・
-link="": Add link to another container (name:alias)
72](https://image.slidesharecdn.com/20140212-hack-for-docker-network-140212212814-phpapp01/85/Hack-for-Docker-s-Network-72-320.jpg)
Uploaded byMasahito Yoshida
Hack for Docker's Network
Hack for Docker's Network * ICC(Inter-Container Communication) * iptables rules * pipework
Hack for Docker's Network
- 1. Hack for Docker'sNetwork 2014/02/12(水) @hansode
- 2.
- 3. ■自己紹介 •吉田将士 / MasahitoYoshida • 株式会社あくしゅ http://axsh.jp/ • 担当: Wakame-vdc CI環境周りで生活 • ⇒ 「国産IaaSコントローラ」らしいです •Twitter: @hansode •GitHub: https://github.com/hansode 気付いたら、 1年以上、連続活動。 3
- 4.
- 5.
- 6.
- 7.
- 8. ■Docker Host 検証環境 •LinuxDistribution: •CentOS 6.5 •Base: •kernel-2.6.32-431.el6.x86_64 •bridge-utils-1.2-10.el6.x86_64 •EPEL: •docker-io-0.7.6-2.el6.x86_64 •lxc-0.9.0-2.el6.x86_64 •OpenStack: •iproute-2.6.32-130.el6ost.netns.2.x86_64 •openvswitch-1.11.0_8ce28d-1.el6ost.x86_64 8
- 9.
- 10.
- 11.
- 12. ■ ICC http://docs.docker.io/en/latest/use/networking/ The valueof the Docker daemon's icc parameter determines whether containers can communicate with each other over the bridge network. + The default, -icc=true allows containers to communicate with each other. + -icc=false means containers are isolated from each other. Docker uses iptables under the hood to either accept or drop communication between containers. -icc=true/false 切り替えで コンテナ間通信を制御する機能 12
- 13. ■ ICC http://docs.docker.io/en/latest/use/networking/ The valueof the Docker daemon's icc parameter determines whether containers can communicate with each other over the bridge network. + The default, -icc=true allows containers to communicate with each other. + -icc=false means containers are isolated from each other. Docker uses iptables under the hood to either accept or drop communication between containers. iptablesで コンテナ間通信を遮断 13
- 14. ■ ICC http://docs.docker.io/en/latest/use/networking/ The valueof the Docker daemon's icc parameter determines whether containers can communicate with each other over the bridge network. + The default, -icc=true allows containers to communicate with each other. + -icc=false means containers are isolated from each other. Docker uses iptables under the hood to either accept or drop communication between containers. iptablesの詳細は無い 14
- 15.
- 16.
- 17.
- 18.
- 19. ■ICC: /etc/sysconfig/docker default other_args="” falseの場合は、-icc=false 設定反映の為、 Daemonを再起動 $ sudo/etc/init.d/docker restart other_args="-icc=false” 19
- 20.
- 21.
- 22. ■ルール比較のシナリオ iccフラグを指定し、 デーモンを再起動 $ sudo /etc/init.d/dockerrestart -icc=? 22
- 23. ■ルール比較のシナリオ コンテナ(CT1)を作成 -icc=? $ sudo /etc/init.d/dockerrestart $ sudo docker run -d ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D CT1 23
- 24. ■ルール比較のシナリオ ルールを取得 $ sudo /etc/init.d/dockerrestart -icc=? $ sudo docker run -d ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D CT1 rule $ sudo iptables -t filter -nL | ¥ tee /tmp/iptables.filter.1.log $ sudo iptables -t nat -nL | ¥ tee /tmp/iptables.nat.1.log 24
- 25. ■ルール比較のシナリオ コンテナ(CT2)を作成 $ sudo dockerrun -d ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D -icc=? CT1 CT2 rule $ sudo /etc/init.d/docker restart $ sudo iptables -t filter -nL | ¥ tee /tmp/iptables.filter.1.log $ sudo iptables -t nat -nL | ¥ tee /tmp/iptables.nat.1.log $ sudo docker run -d ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D $ sudo iptables -t filter -nL | ¥ tee /tmp/iptables.filter.2.log $ sudo iptables -t nat -nL | ¥ tee /tmp/iptables.nat.2.log 25
- 26. ■ルール比較のシナリオ ルールを取得 $ sudo /etc/init.d/dockerrestart -icc=? $ sudo docker run -d ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D CT1 CT2 rule rule $ sudo iptables -t filter -nL | ¥ tee /tmp/iptables.filter.1.log $ sudo iptables -t nat -nL | ¥ tee /tmp/iptables.nat.1.log $ sudo docker run -d ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D $ sudo iptables -t filter -nL | ¥ tee /tmp/iptables.filter.2.log $ sudo iptables -t nat -nL | ¥ tee /tmp/iptables.nat.2.log 26
- 27.
- 28.
- 29. ■ルール比較結果 -icc=true $ cat iptables.filter.1.log ChainINPUT (policy ACCEPT) target prot opt source -icc=false destination $ cat iptables.filter.1.log Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED Chain FORWARD (policy ACCEPT) target prot opt source destination DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT がDROP へ変化 29
- 30.
- 31.
- 32.
- 33. ■コンテナ間通信遮断を確認 root@a819b0a1729c:~# ssh 172.17.0.7 Theauthenticity of host '172.17.0.7 (172.17.0.7)' can't be established. ECDSA key fingerprint is 88:f4:ba:25:54:47:ce:8c:63:54:fa:17:53:31:d5:6d. Are you sure you want to continue connecting (yes/no)? -icc=false CT1 CT2 おや・・？DROPされてない？！ 33
- 34.
- 35. ■コンテナ間通信遮断を確認 $ sysctl net.bridge.bridge-nf-call-iptables net.bridge.bridge-nf-call-iptables= 0 -icc=false file:///etc/sysctl.conf # Disable netfilter on bridges. net.bridge.bridge-nf-call-ip6tables = 0 net.bridge.bridge-nf-call-iptables = 0 net.bridge.bridge-nf-call-arptables = 0 CT1 CT2 RHEL6系の場合、 Bridge経由パケットがフィルタ対象外。 35
- 36. ■コンテナ間通信遮断を確認 $ sudo –wsysctl net.bridge.bridge-nf-call-iptables=1 net.bridge.bridge-nf-call-iptables = 1 -icc=false file:///etc/sysctl.conf # Disable netfilter on bridges. net.bridge.bridge-nf-call-ip6tables = 0 net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-arptables = 0 CT1 CT2 $ sudo sysctl -p net.bridge.bridge-nf-call-iptables = 1 を設定すると、DROPされるようになる。 36
- 37.
- 38. ■ ICCをおさらい: iptablesrule http://docs.docker.io/en/latest/use/networking/ The value of the Docker daemon's icc parameter determines whether containers can communicate with each other over the bridge network. + The default, -icc=true allows containers to communicate with each other. + -icc=false means containers are isolated from each other. Docker uses iptables under the hood to either accept or drop communication between containers. rule内容が、 -icc=true時はACCEPT -icc=false時はDROP 38
- 39.
- 40.
- 41.
- 42.
- 43.
- 44. ■ Link Containers http://docs.docker.io/en/latest/use/working_with_links_names/ ContainerNaming: You can now name your container by using the -name flag. Links: service discovery for docker Links allow containers to discover and securely communicate with each other by using the flag -link name:alias. Inter-container communication can be disabled with the daemon flag -icc=false. With this flag set to false, Container A cannot access Container B unless explicitly allowed via a link. This is a huge win for securing your containers. When two containers are linked together Docker creates a parent child relationship between the containers. Daemonのフラグ-icc=false、 -nameフラグと-linkフラグを組み合わせて使う事が分かる。 44
- 45.
- 46. ■ Link Containers -icc=false -icc=false指定Dockerホスト 46
- 47. ■ Link Containers -icc=false $sudo docker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D -name 指定でコンテナを作成。 47
- 48. ■ Link Containers $sudo docker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D -icc=false CT01 -name ct01 48
- 49. ■ Link Containers $sudo docker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D -icc=false CT01 -name ct01 $ sudo docker run -d ¥ -name ct02 ¥ -link ct01:sshd ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D -link 指定でコンテナを作成。 49
- 50. ■ Link Containers $sudo docker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D -icc=false CT01 -name ct01 CT02 -link ct01:sshd $ sudo docker run -d ¥ -name ct02 ¥ -link ct01:sshd ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D CT01からの接続は、受け入れる。 50
- 51. ■ Link Containers $sudo docker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D -icc=false CT01 -name ct01 CT03 CT02 -link ct01:sshd $ sudo docker run -d ¥ -name ct02 ¥ -link ct01:sshd ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D CT03からの接続は、拒否。 51
- 52. ■ Link Containers -icc=false CT01 -namect01 CT02 -link ct01:sshd この関係はdocker psで確認出来る。 52
- 53. ■ Link Containers 実は、接続元ノード情報ではなく、 接続先ノード情報が表示されてる。 -icc=false CT01 -namect01 NAMES ct02 ct01,ct02/sshd CT02 -link ct01:sshd $ sudo docker ps CONTAINER ID IMAGE 1e25390d1efd sshd:latest 6d161816ac23 sshd:latest COMMAND CREATED STATUS PORTS NA MES /usr/sbin/sshd -D Less than a second ago Up Less than a second 22/tcp ct02 /usr/sbin/sshd -D 1 seconds ago Up Less than a second 0.0.0.0:49153->22/tcp ct01,ct02/sshd 53
- 54.
- 55.
- 56. ■ nameの制約 $ sudodocker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D -icc=false CT01 -name ct01 $ sudo docker kill $(sudo docker ps -q) 繰り返し検証する為、同じnameを使い まわそうとしたら、 56
- 57. ■ nameの制約 $ sudodocker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D -icc=false CT01 -name ct01 $ sudo docker kill $(sudo docker ps -q) $ sudo docker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd ¥ /usr/sbin/sshd -D コンテナ作成時に、エラーが発生。 57
- 58. ■ nameの制約 -icc=false CT01 -name ct01 $sudo docker run -p 22 -d -name ct01 sshd /usr/sbin/sshd -D 2014/02/12 04:54:08 Error: create: Abort due to constraint violation: constraint failed 一度使ったnameは、 再利用出来ないと言う隠れた制約が存在。 58
- 59.
- 60.
- 61. ■ Link Containers 実は、接続元ノード情報ではなく、 接続先ノード情報が表示されてる。 -icc=false CT01 -namect01 NAMES ct02 ct01,ct02/sshd CT02 -link ct01:sshd $ sudo docker ps CONTAINER ID IMAGE 1e25390d1efd sshd:latest 6d161816ac23 sshd:latest COMMAND CREATED STATUS PORTS NA MES /usr/sbin/sshd -D Less than a second ago Up Less than a second 22/tcp ct02 /usr/sbin/sshd -D 1 seconds ago Up Less than a second 0.0.0.0:49153->22/tcp ct01,ct02/sshd 61
- 62.
- 63. ■反映されてるiptables rule Chain INPUT(policy ACCEPT) target prot opt source destination -icc=false CT01 -name ct01 CT02 -link ct01:sshd Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 172.17.0.4 172.17.0.5 ACCEPT tcp -- 172.17.0.5 172.17.0.4 DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 RELATED,ESTABLISHED DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 RELATED,ESTABLISHED tcp spt:22 tcp dpt:22 ctstate ctstate Chain OUTPUT (policy ACCEPT) target prot opt source destination linkフラグが影響を与えたルール 63
- 64. ■反映されてるiptables rule Chain INPUT(policy ACCEPT) target prot opt source destination -icc=false CT01 -name ct01 CT02 -link ct01:sshd Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 172.17.0.4 172.17.0.5 ACCEPT tcp -- 172.17.0.5 172.17.0.4 DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 RELATED,ESTABLISHED DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 RELATED,ESTABLISHED tcp spt:22 tcp dpt:22 ctstate ctstate Chain OUTPUT (policy ACCEPT) target prot opt source destination ところで、”tcp spt:22”・・？ 64
- 65. ■反映されてるiptables rule Chain INPUT(policy ACCEPT) target prot opt source destination -icc=false CT01 -name ct01 CT02 -link ct01:sshd Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 172.17.0.4 172.17.0.5 ACCEPT tcp -- 172.17.0.5 172.17.0.4 DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 RELATED,ESTABLISHED DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 RELATED,ESTABLISHED tcp spt:22 tcp dpt:22 ctstate ctstate Chain OUTPUT (policy ACCEPT) target prot opt source destination これは不要じゃないの・・・？ 65
- 66. ■反映されてるiptables rule Chain INPUT(policy ACCEPT) target prot opt source destination -icc=false CT01 -name ct01 CT02 -link ct01:sshd Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 172.17.0.4 172.17.0.5 ACCEPT tcp -- 172.17.0.5 172.17.0.4 DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 RELATED,ESTABLISHED DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 RELATED,ESTABLISHED tcp spt:22 tcp dpt:22 ctstate ctstate Chain OUTPUT (policy ACCEPT) target prot opt source destination sshしてみると、案の定、繋がらない。 66
- 67.
- 68.
- 69.
- 70.
- 71.
- 72. ■ 多段Link構成 man dockerより Usage: docker run [OPTIONS] IMAGE[:TAG] [COMMAND] [ARG...] Run a command in a new container -a=map[]: Attach to stdin, stdout or stderr -c=0: CPU shares (relative weight) -cidfile="": Write the container ID to the file -d=false: Detached mode: Run container in the background, print new container id -e=[]: Set environment variables -h="": Container host name -i=false: Keep stdin open even if not attached -privileged=false: Give extended privileges to this container -m="": Memory limit (format: <number><optional unit>, where unit = b, k, m or g) -n=true: Enable networking for this container -p=[]: Map a network port to the container -rm=false: Automatically remove the container when it exits (incompatible with -d) -t=false: Allocate a pseudo-tty -u="": Username or UID -dns=[]: Set custom dns servers for the container -v=[]: Create a bind mount with: [host-dir]:[container-dir]:[rw|ro]. If "container-dir" is missing, then docker creates a new volume. -volumes-from="": Mount all volumes from the given container(s) -entrypoint="": Overwrite the default entrypoint set by the image -w="": Working directory inside the container -lxc-conf=[]: Add custom lxc options -lxc-conf="lxc.cgroup.cpuset.cpus = 0,1" -sig-proxy=true: Proxify all received signal to the process (even in non-tty mode) -expose=[]: Expose a port from the container without publishing it to your host -link="": Add link to another container (name:alias) -name="": Assign the specified name to the container. If no name is specific docker will generate a random name -P=false: Publish all exposed ports to the host interfaces これが、 -link=[] だったなら・・・ -link="": Add link to another container (name:alias) 72
- 73.
- 74.
- 75.
- 76.
- 77. ■ 多段Link構成 -icc=false $ sudodocker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D CT01 77
- 78. ■ 多段Link構成 $ sudodocker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D -icc=false $ sudo docker run -d ¥ -name ct11 ¥ -link ct01:sshd ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D CT01 CT11 CT12 $ sudo docker run -d ¥ -name ct12 ¥ -link ct01:sshd ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D 78
- 79. ■ 多段Link構成 $ sudodocker run -d ¥ -name ct01 ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D -icc=false $ sudo docker run -d ¥ -name ct11 ¥ -link ct01:sshd ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D CT01 CT11 CT21 CT12 CT22 $ sudo docker run -d ¥ -name ct12 ¥ -link ct01:sshd ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D $ sudo docker run -d ¥ -name ct21 ¥ -link ct11:sshd ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D $ sudo docker run -d ¥ -name ct22 ¥ -link ct12:sshd ¥ -p 22 dhrp/sshd /usr/sbin/sshd -D 79
- 80. ■ 多段Link構成 $ sudodocker ps NAMES ct22 ct21 ct12,ct22/sshd ct11,ct21/sshd ct01,ct11/sshd,ct12/sshd,ct21/sshd/sshd,ct22/sshd/sshd -icc=false CT01 CT11 CT21 CT12 CT22 docker psの結果から、 NAMES項目のみ表示。 80
- 81. ■ 多段Link構成 $ sudodocker ps NAMES ct22 ct21 ct12,ct22/sshd ct11,ct21/sshd ct01,ct11/sshd,ct12/sshd,ct21/sshd/sshd,ct22/sshd/sshd -icc=false CT01 CT11 CT21 CT12 CT22 注目すべきは、 ct01からct21とct22へのlinkが 張られている事。 81
- 82.
- 83. ■反映されてるiptables rule Chain FORWARD(policy ACCEPT) target prot opt source destination ACCEPT tcp -- 172.17.0.6 172.17.0.8 -icc=false ACCEPT tcp -- 172.17.0.8 172.17.0.6 ACCEPT tcp -- 172.17.0.5 172.17.0.7 ACCEPT tcp -- 172.17.0.7 172.17.0.5 CT01 ACCEPT tcp -- 172.17.0.4 172.17.0.6 ACCEPT tcp -- 172.17.0.6 172.17.0.4 ACCEPT tcp -- 172.17.0.4 172.17.0.5 ACCEPT tcp -- 172.17.0.5 172.17.0.4 CT11 CT12 DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 CT22 CT21 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 linkフラグが影響を与えたルール tcp spt:22 tcp dpt:22 tcp spt:22 tcp dpt:22 tcp spt:22 tcp dpt:22 tcp spt:22 tcp dpt:22 ctstate RELATED,ESTABLISHED ctstate RELATED,ESTABLISHED ctstate RELATED,ESTABLISHED 83
- 84. ■反映されてるiptables rule -icc=false CT01 CT11 CT12 CT21 Chain FORWARD(policy ACCEPT) target prot opt source destination ACCEPT tcp -- 172.17.0.6 172.17.0.8 ACCEPT tcp -- 172.17.0.8 172.17.0.6 ACCEPT tcp -- 172.17.0.5 172.17.0.7 ACCEPT tcp -- 172.17.0.7 172.17.0.5 ACCEPT tcp -- 172.17.0.4 172.17.0.6 ACCEPT tcp -- 172.17.0.6 172.17.0.4 ACCEPT tcp -- 172.17.0.4 172.17.0.5 ACCEPT tcp -- 172.17.0.5 172.17.0.4 tcp spt:22 tcp dpt:22 tcp spt:22 tcp dpt:22 tcp spt:22 tcp dpt:22 tcp spt:22 tcp dpt:22 CT22 Iptables ruleでは、 2ノード間のACCEPTルールのみ である事が分かる。 84
- 85.
- 86.
- 87.
- 88.
- 89.
- 90. ■ Pipework https://github.com/jpetazzo/pipework Software-Defined Networkingfor Linux Containers Pipework lets you connect together containers in arbitrarily complex scenarios. 多様なコンテナ間通 信を提供 200行弱の シェルスクリプト 90
- 91. ■ Pipework: Usage https://github.com/jpetazzo/pipework $pipework br1 $CTID 192.168.1.2/24 使い方の１つ、 コンテナに狙ったIPアドレスを 指定可能。 91
- 92.
- 93.
- 94. ■ Pipework docker0 veth0 eth0 CT Pipeworkを実行。 $ pipeworkbr1 $CTID 192.168.1.2/24 94
- 95. ■ Pipework docker0 veth0 eth0 CT veth1 eth1 vethペアを作成。 $ pipeworkbr1 $CTID 192.168.1.2/24 95
- 96. ■ Pipework docker0 veth0 eth0 CT br1 veth1 eth1 vethをbr1に追加する。 $ pipeworkbr1 $CTID 192.168.1.2/24 96
- 97. ■ Pipework docker0 veth0 eth0 CT br1 veth1 eth1 eth1にIPアドレスを割り当て。 $ pipeworkbr1 $CTID 192.168.1.2/24 97
- 98.
- 99.
- 100. ■ Pipework https://github.com/jpetazzo/pipework Support OpenvSwitch If you want to attach a container to the Open vSwitch bridge, no problem. Linux Bridgeの代わりに、 Open vSwitchを利用可能 100
- 101. ■ Pipework +Open vSwitch docker0 veth0 eth0 CT br1 veth1 eth1 ここをOpen vSwitch化。 101
- 102. ■ Pipework +Open vSwitch docker0 veth0 eth0 CT ovsbr1 veth1 eth1 ovsbr1を指定するだけ。 $ pipework ovsbr1 $CTID 192.168.1.2/24 102
- 103.
- 104.
- 105.
- 106.
- 107. ■ Network周りを触ってみて・・・ ・linkを始め、iptablse周りの実装がまだ枯れてなさそう ⇒複数link等、EC2のSecurityGroups相当の機能が必要？ ・複数Docker Host構成の場合 ・本体は、しばらく1ホストしか考慮に入れてなさそう？ ・ホスト超えした時のlinkは、どうするのか ・複数ホスト管理、ネットワーク層管理 ・ホスト間通信、ホスト超えしたコンテナ間通信 ・Mesos,Marathon, Serf, Wakame-vdc, OpenVNet… 特にこの領域は、まだまだ発展途上。 107
- 108.