docker_practice/advanced_network/access_control.md

57 lines
2.8 KiB
Go
Raw Blame History

This file contains ambiguous Unicode characters!

This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.

# 访
访 Linux `iptables` `iptables` Linux
## 访
访Linux
```bash
$sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
```
0
```bash
$sysctl -w net.ipv4.ip_forward=1
```
Docker `--ip-forward=true`, Docker `ip_forward` 1
## 访
访
* `docker0`
* -- `iptables`
### 访
Docker dockerd iptables FORWARD `ACCEPT``DROP``--icc=true` `--icc=false` `--iptables=false` `iptables`
`/etc/docker/daemon.json` `{"icc": false}`
### 访
`-icc=false` 访 `--link=CONTAINER_NAME:ALIAS` 访
Docker 使 `icc=false --iptables=true` 访 Docker `iptables`
`iptables`
```bash
$ sudo iptables -nL
...
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DROP all -- 0.0.0.0/0 0.0.0.0/0
...
```
`docker run`使 `--link=CONTAINER_NAME:ALIAS` Docker `iptable` `ACCEPT` 访 `Dockerfile` `EXPOSE`
`--link=CONTAINER_NAME:ALIAS` `iptables`
```bash
$ sudo iptables -nL
...
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- 172.17.0.2 172.17.0.3 tcp spt:80
ACCEPT tcp -- 172.17.0.3 172.17.0.2 tcp dpt:80
DROP all -- 0.0.0.0/0 0.0.0.0/0
```
`--link=CONTAINER_NAME:ALIAS` `CONTAINER_NAME` Docker 使 `--name`