介绍一种生产环境Docker overlay network的配置方案。
先讲一下生产环境中的问题:
docker service create
/docker stack deploy
创建的。docker run
/docker compose up
创建的。tasks.<service-name>
DNS name 连接到无状态应用(见Container discovery)<container-name>
DNS name 连接到有状态应用解决办法:
到manager节点上创建attachable的overlay network,名字叫做prod-overlay:
docker network create -d overlay --attachable prod-overlay
在manager节点上查看这个网络是否创建成功:
$ docker network ls
NETWORK ID NAME DRIVER SCOPE
fbfde97ed12a bridge bridge local
73ab6bbac970 docker_gwbridge bridge local
a2adb3de5f7a host host local
nm7pgzuh6ww4 ingress overlay swarm
638e550dab67 none null local
qqf78g8iio10 prod-overlay overlay swarm
在worker节点上查看这个网络,这时你看不到这个网络,不过不要担心,当后面在worker节点上创建工作负载后就能看到了:
$ docker network ls
NETWORK ID NAME DRIVER SCOPE
fbfde97ed12a bridge bridge local
73ab6bbac970 docker_gwbridge bridge local
a2adb3de5f7a host host local
nm7pgzuh6ww4 ingress overlay swarm
638e550dab67 none null local
在manager上创建容器c1
,挂到prod-overlay
network上:
docker run --name c1 --network prod-overlay -itd busybox
在worker上创建容器c2
,挂到prod-overlay
network上:
docker run --name c2 --network prod-overlay -itd busybox
在manager上创建service c
,挂到prod-overlay
network上:
docker service create -td --name c --replicas 2 --network prod-overlay busybox
之前在worker节点上没有看到prod-overlay
network,现在你应该可以看见了:
$ docker network ls
NETWORK ID NAME DRIVER SCOPE
01180b9d4833 bridge bridge local
cd94df435afc docker_gwbridge bridge local
74721e7670eb host host local
nm7pgzuh6ww4 ingress overlay swarm
32e6853ea78d none null local
dw8kd2nb2yl3 prod-overlay overlay swarm
到manager节点上,让c1
ping c2
$ docker exec c1 ping -c 2 c2
PING c2 (10.0.2.2): 56 data bytes
64 bytes from 10.0.2.2: seq=0 ttl=64 time=0.682 ms
64 bytes from 10.0.2.2: seq=1 ttl=64 time=0.652 ms
到manager节点上,让c1
ping tasks.c
,tasks.c
是之前创建的service c
的DNS name:
$ docker exec c1 ping -c 2 tasks.c
PING tasks.c (10.0.2.8): 56 data bytes
64 bytes from 10.0.2.8: seq=0 ttl=64 time=2.772 ms
64 bytes from 10.0.2.8: seq=1 ttl=64 time=0.694 ms
到manager节点上,让c1
查询 tasks.c
的DNS name,可以看到tasks.c
有两条记录:
$ docker exec c1 nslookup -type=a tasks.c
Server: 127.0.0.11
Address: 127.0.0.11:53
Non-authoritative answer:
Name: tasks.c
Address: 10.0.2.7
Name: tasks.c
Address: 10.0.2.8
到manager节点上,查看service c
的task,看到有c.1
、c.2
两个task,分别部署在两个节点上:
$ docker service ps c
ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS
p5n70vhtnz2f c.1 busybox:latest docker-learn-1 Running Running 17 minutes ago
byuoox1t7cve c.2 busybox:latest docker-learn-2 Running Running 17 minutes ago
到c.1
task所在的节点上,查看task c.1
的容器名:
$ docker ps -f name=c.1
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
795a3bd3c20a busybox:latest "sh" 21 minutes ago Up 21 minutes c.1.p5n70vhtnz2f5q8p2pcvbyfmw
然后在c1
里ping task c.1
的容器名:
$ docker exec c1 ping -c 2 c.1.p5n70vhtnz2f5q8p2pcvbyfmw
PING c.1.p5n70vhtnz2f5q8p2pcvbyfmw (10.0.2.7): 56 data bytes
64 bytes from 10.0.2.7: seq=0 ttl=64 time=0.198 ms
64 bytes from 10.0.2.7: seq=1 ttl=64 time=0.128 ms
你同样可以:
c2
里:
c1
tasks.c
c.1
、c.2
的容器c.1
、c.2
的容器里:
c1
、c2
;tasks.c
c.1
、c.2
的容器通过docker run
/ docker compose up
创建的容器的名字,要保证在整个集群里是唯一的。docker 不会帮你检查名称冲突的情况,如果名称冲突了那么会得到错误的DNS结果。