The New World of Docker Networking
•
4 j'aime•1,674 vues
This document discusses Docker's new multi-host networking capabilities introduced in version 1.9. It uses overlay networks with VXLAN transport and key-value stores for cluster discovery to allow containers on different Docker hosts to communicate securely over a virtual network without port mappings. The new networking model addresses challenges with the previous single-host approach and enables use cases like multi-tenancy, segmentation, and multi-cloud networks.
Contenu connexe
Tendances
Tendances (19)
En vedette
En vedette (16)
Similaire à The New World of Docker Networking
Similaire à The New World of Docker Networking (20)
Dernier
Dernier (20)
The New World of Docker Networking
- 1. The New World ofThe New World of Docker NetworkingDocker Networking
- 2. 12 Nicola Kabar || nicola@docker.com Solutions Architect at Docker Help Customers Design Solutions based on Docker CCIE (for those who care) Favorite Moto : "Ping works. Not my problem !!!" @nicolakabar
- 3. 3 Agenda Old Networking Model Challenges What's Multi-Host Networking? How does it work? Demo Use-cases Roadmap
- 4. 4
- 5. 5 Docker Networking (< 1.9)Docker Networking (< 1.9) Docker creates three networks bridge (default) --> containers in local docker0 bridge null --> containers without any network interfaces host --> containers use same interfaces as host ( same netns) NETWORK ID NAME DRIVER 51d5e0c6b3f4 bridge bridge 0b240f7c1d73 none null b9819d9c0380 host host $ ifconfig docker0 Link encap:Ethernet HWaddr 02:42:30:91:60:49 inet addr:172.17.0.1 Bcast:0.0.0.0 Mask:255.255.0.0 inet6 addr: fe80::1/64 Scope:Link inet6 addr: fe80::42:30ff:fe91:6049/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:9001 Metric:1 RX packets:23957697 errors:0 dropped:0 overruns:0 frame:0 TX packets:17161453 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:9273953094 (9.2 GB) TX bytes:4601244328 (4.6 GB)
- 6. 6 ChallengesChallenges Required host port mapping for multi-host deployment No network visibility Need linking for container discovery No horizontal scaling
- 7. 7 The New Multi-Host NetworkingThe New Multi-Host Networking Exited experimental in 1.9 Batteries included: `overlay` network driver + IPAM New network API + UX Network Driver + IPAM Plugins Integration with Swarm and Compose ( --x-networking ) $ docker network --help Usage: docker network [OPTIONS] COMMAND [OPTIONS] Commands: disconnect Disconnect container from a network inspect Display detailed network information ls List all networks rm Remove a network create Create a network connect Connect container to a network
- 8. 8 Under the HoodUnder the Hood 1. VXLAN ==> Data Transport Virtual eXtensible Local Area Networks L2 Network over an L3 network ( overlay ) RFC7348 Invisible to the container Host as VXLAN Tunnel End Point (VTEP) Point-to-Multi-Point Tunnels Proxy-ARP
- 9. 9 Under the HoodUnder the Hood 2. Key-Value Store ==> Cluster Discovery ( Strongly Consistent) support etcd, zookeeper,consul,boltdb store Network ID, Subnets, Nodes, VXLAN ID, IPAM...etc 3. Serf ==> Cluster Discovery (Eventually Consistent) Gossip protocol Propagates cluster updates(e.g MAC <> VTEP IP mapping)
- 10. 10 Under the HoodUnder the Hood 4 . Network Namespaces ==> Host + Container Networks A Linux Bridge per Subnet per Overlay Network per Host A VXLAN interface per Overlay Network per Host 1 Linux Bridge per Host for default traffic (docker_gwbridge) Lazy creation ( Only if container is attached to network)
- 11. 11 RequirementsRequirements Linux Kernel 3.16+ Docker Engine 1.9 Underlying Open TCP/UDP Ports Docker Engine port (e.g TCP 2376) VXLAN: UDP 4789 Serf: TCP + UDP 7946 Key-value store ( e.g for Consul TCP 8500) Swarm 1.0 Compose 1.5
- 12. 12 Configuration WorkflowConfiguration Workflow 1. Create K/V Store 2. Configure Engines with `cluster-store` and `cluster-advertise` 3. Create Overlays with `docker network create -d oberlay BLUE` 4. Run containers with `--net BLUE` $ docker network create -d overlay --subnet 10.10.10.0/24 BLUE 68478121f0a73b7c27854f5ac7a7750bcb4bd1400d2fc20f1c1303aa72a5dfd5 $ docker network ls NETWORK ID NAME DRIVER 68478121f0a7 BLUE overlay 3748cf0d06c5 none null c7be99c9c48f host host 418e521b16a0 bridge bridge
- 15. 15 Roadmap:Roadmap: IPv6 Support for Overlays DNS-based service discovery Proxy containers Encryption
- 16. 16 Thank you!Thank you! www. .com @nicolakabar