Compose
About versions and upgrading (Compose)
ASP.NET Core + SQL Server on Linux (Compose)
CLI environment variables (Compose)
Command-line completion (Compose)
Compose（组成）
Compose command-line reference（组合命令行参考）
Control startup order (Compose)
Django and PostgreSQL (Compose)
Docker stacks and distributed application bundles (Compose)
docker-compose build（docker-compose构建）
docker-compose bundle
docker-compose config
docker-compose create
docker-compose down
docker-compose events
docker-compose exec
docker-compose help
docker-compose images
docker-compose kill
docker-compose logs
docker-compose pause
docker-compose port
docker-compose ps
docker-compose pull
docker-compose push
docker-compose restart
docker-compose rm
docker-compose run
docker-compose scale
docker-compose start
docker-compose stop
docker-compose top
docker-compose unpause
docker-compose up
Environment file (Compose)
Environment variables in Compose
Extend services in Compose
Frequently asked questions (Compose)
Getting started (Compose)
Install Compose
Link environment variables (deprecated) (Compose)
Networking in Compose
Overview of Docker Compose
Overview of docker-compose CLI
Quickstart: Compose and WordPress
Rails and PostgreSQL (Compose)
Sample apps with Compose
Using Compose in production
Using Compose with Swarm
Engine
.NET Core application (Engine)
About images, containers, and storage drivers (Engine)
Add nodes to the swarm (Engine)
Apply custom metadata (Engine)
Apply rolling updates (Engine)
apt-cacher-ng
Best practices for writing Dockerfiles (Engine)
Binaries (Engine)
Bind container ports to the host (Engine)
Breaking changes (Engine)
Build your own bridge (Engine)
Configure container DNS (Engine)
Configure container DNS in user-defined networks (Engine)
CouchDB (Engine)
Create a base image (Engine)
Create a swarm (Engine)
Customize the docker0 bridge (Engine)
Debian (Engine)
Default bridge network
Delete the service (Engine)
Deploy a service (Engine)
Deploy services to a swarm (Engine)
Deprecated Engine features
Docker container networking (Engine)
Docker overview (Engine)
Docker run reference (Engine)
Dockerfile reference (Engine)
Dockerize an application
Drain a node (Engine)
Engine
FAQ (Engine)
Fedora (Engine)
Get started (Engine)
Get started with macvlan network driver (Engine)
Get started with multi-host networking (Engine)
How nodes work (Engine)
How services work (Engine)
Image management (Engine)
Inspect the service (Engine)
Install Docker (Engine)
IPv6 with Docker (Engine)
Join nodes to a swarm (Engine)
Legacy container links (Engine)
Lock your swarm (Engine)
Manage nodes in a swarm (Engine)
Manage sensitive data with Docker secrets (Engine)
Manage swarm security with PKI (Engine)
Manage swarm service networks (Engine)
Migrate to Engine 1.10
Optional Linux post-installation steps (Engine)
Overview (Engine)
PostgreSQL (Engine)
Raft consensus in swarm mode (Engine)
Riak (Engine)
Run Docker Engine in swarm mode
Scale the service (Engine)
SDKs (Engine)
Select a storage driver (Engine)
Set up for the tutorial (Engine)
SSHd (Engine)
Storage driver overview (Engine)
Store service configuration data (Engine)
Swarm administration guide (Engine)
Swarm mode key concepts (Engine)
Swarm mode overlay network security model (Engine)
Swarm mode overview (Engine)
Understand container communication (Engine)
Use multi-stage builds (Engine)
Use swarm mode routing mesh (Engine)
Use the AUFS storage driver (Engine)
Use the Btrfs storage driver (Engine)
Use the Device mapper storage driver (Engine)
Use the OverlayFS storage driver (Engine)
Use the VFS storage driver (Engine)
Use the ZFS storage driver (Engine)
Engine: Admin Guide
Amazon CloudWatch logs logging driver (Engine)
Bind mounts (Engine)
Collect Docker metrics with Prometheus (Engine)
Configuring and running Docker (Engine)
Configuring logging drivers (Engine)
Control and configure Docker with systemd (Engine)
ETW logging driver (Engine)
Fluentd logging driver (Engine)
Format command and log output (Engine)
Google Cloud logging driver (Engine)
Graylog Extended Format (GELF) logging driver (Engine)
Journald logging driver (Engine)
JSON File logging driver (Engine)
Keep containers alive during daemon downtime (Engine)
Limit a container's resources (Engine)
Link via an ambassador container (Engine)
Log tags for logging driver (Engine)
Logentries logging driver (Engine)
PowerShell DSC usage (Engine)
Prune unused Docker objects (Engine)
Run multiple services in a container (Engine)
Runtime metrics (Engine)
Splunk logging driver (Engine)
Start containers automatically (Engine)
Storage overview (Engine)
Syslog logging driver (Engine)
tmpfs mounts
Troubleshoot volume problems (Engine)
Use a logging driver plugin (Engine)
Using Ansible (Engine)
Using Chef (Engine)
Using Puppet (Engine)
View a container's logs (Engine)
Volumes (Engine)
Engine: CLI
Daemon CLI reference (dockerd) (Engine)
docker
docker attach
docker build
docker checkpoint
docker checkpoint create
docker checkpoint ls
docker checkpoint rm
docker commit
docker config
docker config create
docker config inspect
docker config ls
docker config rm
docker container
docker container attach
docker container commit
docker container cp
docker container create
docker container diff
docker container exec
docker container export
docker container inspect
docker container kill
docker container logs
docker container ls
docker container pause
docker container port
docker container prune
docker container rename
docker container restart
docker container rm
docker container run
docker container start
docker container stats
docker container stop
docker container top
docker container unpause
docker container update
docker container wait
docker cp
docker create
docker deploy
docker diff
docker events
docker exec
docker export
docker history
docker image
docker image build
docker image history
docker image import
docker image inspect
docker image load
docker image ls
docker image prune
docker image pull
docker image push
docker image rm
docker image save
docker image tag
docker images
docker import
docker info
docker inspect
docker kill
docker load
docker login
docker logout
docker logs
docker network
docker network connect
docker network create
docker network disconnect
docker network inspect
docker network ls
docker network prune
docker network rm
docker node
docker node demote
docker node inspect
docker node ls
docker node promote
docker node ps
docker node rm
docker node update
docker pause
docker plugin
docker plugin create
docker plugin disable
docker plugin enable
docker plugin inspect
docker plugin install
docker plugin ls
docker plugin push
docker plugin rm
docker plugin set
docker plugin upgrade
docker port
docker ps
docker pull
docker push
docker rename
docker restart
docker rm
docker rmi
docker run
docker save
docker search
docker secret
docker secret create
docker secret inspect
docker secret ls
docker secret rm
docker service
docker service create
docker service inspect
docker service logs
docker service ls
docker service ps
docker service rm
docker service scale
docker service update
docker stack
docker stack deploy
docker stack ls
docker stack ps
docker stack rm
docker stack services
docker start
docker stats
docker stop
docker swarm
docker swarm ca
docker swarm init
docker swarm join
docker swarm join-token
docker swarm leave
docker swarm unlock
docker swarm unlock-key
docker swarm update
docker system
docker system df
docker system events
docker system info
docker system prune
docker tag
docker top
docker unpause
docker update
docker version
docker volume
docker volume create
docker volume inspect
docker volume ls
docker volume prune
docker volume rm
docker wait
Use the Docker command line (Engine)
Engine: Extend
Access authorization plugin (Engine)
Docker log driver plugins
Docker network driver plugins (Engine)
Extending Engine with plugins
Managed plugin system (Engine)
Plugin configuration (Engine)
Plugins API (Engine)
Volume plugins (Engine)
Engine: Security
AppArmor security profiles for Docker (Engine)
Automation with content trust (Engine)
Content trust in Docker (Engine)
Delegations for content trust (Engine)
Deploying Notary (Engine)
Docker security (Engine)
Docker security non-events (Engine)
Isolate containers with a user namespace (Engine)
Manage keys for content trust (Engine)
Play in a content trust sandbox (Engine)
Protect the Docker daemon socket (Engine)
Seccomp security profiles for Docker (Engine)
Secure Engine
Use trusted images
Using certificates for repository client verification (Engine)
Engine: Tutorials
Engine tutorials
Network containers (Engine)
Get Started
Part 1: Orientation
Part 2: Containers
Part 3: Services
Part 4: Swarms
Part 5: Stacks
Part 6: Deploy your app
Machine
Amazon Web Services (Machine)
Digital Ocean (Machine)
docker-machine active
docker-machine config
docker-machine create
docker-machine env
docker-machine help
docker-machine inspect
docker-machine ip
docker-machine kill
docker-machine ls
docker-machine provision
docker-machine regenerate-certs
docker-machine restart
docker-machine rm
docker-machine scp
docker-machine ssh
docker-machine start
docker-machine status
docker-machine stop
docker-machine upgrade
docker-machine url
Driver options and operating system defaults (Machine)
Drivers overview (Machine)
Exoscale (Machine)
Generic (Machine)
Get started with a local VM (Machine)
Google Compute Engine (Machine)
IBM Softlayer (Machine)
Install Machine
Machine
Machine CLI overview
Machine command-line completion
Machine concepts and help
Machine overview
Microsoft Azure (Machine)
Microsoft Hyper-V (Machine)
Migrate from Boot2Docker to Machine
OpenStack (Machine)
Oracle VirtualBox (Machine)
Provision AWS EC2 instances (Machine)
Provision Digital Ocean Droplets (Machine)
Provision hosts in the cloud (Machine)
Rackspace (Machine)
VMware Fusion (Machine)
VMware vCloud Air (Machine)
VMware vSphere (Machine)
Notary
Client configuration (Notary)
Common Server and signer configurations (Notary)
Getting started with Notary
Notary changelog
Notary configuration files
Running a Notary service
Server configuration (Notary)
Signer configuration (Notary)
Understand the service architecture (Notary)
Use the Notary client
©
本文档使用 PHP中文网手册 发布
文字
Libnetwork 使用户可以完全控制 IPv4 和I Pv6 寻址。VLAN 驱动程序建立在此基础之上，为运营商提供对感兴趣进行底层网络集成的用户的二层 VLAN 标记的完全控制。对于抽象掉物理约束的重叠部署，请参阅多主机重叠驱动程序。
Macvlan 是经过验证的真正网络虚拟化技术的新转折点。Linux实施非常轻便，因为它们不是使用传统的 Linux桥接进行隔离，而是与 Linux 以太网接口或子接口关联，以实现网络间的分离和与物理网络的连接。
Macvlan 提供了许多独特的功能，并为各种模式的进一步创新提供了充足的空间。这些方法的两个高级优势是，绕过 Linux 桥接的积极性能影响以及移动部件少的简单性。移除 Docker 主机 NIC 和容器接口之间传统上的桥接会留下一个非常简单的设置，由容器接口组成，直接连接到 Docker 主机接口。由于在这些场景中没有端口映射，因此该结果易于访问面向外部的服务。
Pre-Requisites
这个页面上的例子都是使用 Docker 1.12.0+的单个主机和设置
所有示例都可以在运行 Docker 的单个主机上执行。任何使用子接口的例子
eth0.10都可以替换eth0为 Docker 主机上的任何其他有效的父接口。动态.创建子接口。-o parent接口也可以docker network create全部排除在外，驱动程序将创建一个dummy接口，使本地主机连接性能够执行示例。内核要求：
- To check your current kernel version, use `uname -r` to display your kernel version- Macvlan Linux kernel v3.9–3.19 and 4.0+
Macvlan Bridge 模式示例用法
Macvlan Bridge 模式每个容器都有一个唯一的 MAC 地址，用于跟踪 Docker 主机的 MAC 映射到端口映射。
Macvlan 驱动程序网络连接到父 Docker主机接口。例如物理接口，如
eth0用于 802.1q VLAN标记的子接口eth0.10（.10代表VLAN10），甚至包含将两个以太网接口捆绑为单个逻辑接口的捆绑主机适配器。指定的网关在网络基础结构提供的主机外部。
每个 Macvlan Bridge 模式 Docker 网络彼此隔离，一次只能有一个网络连接到父接口。Docker网络可以连接的每个主机适配器有4,094个子接口的理论限制。
同一子网内的任何容器都可以在没有网关的情况下与同一网络中的任何其他容器通话
macvlan bridge。相同的
docker network命令适用于vlan驱动程序。在 Macvlan 模式下，不通过两个网络/子网之间的外部流程路由，单独网络上的容器无法到达彼此。这也适用于同一个码头网络中的多个子网。
在以下示例中，eth0泊坞窗主机在172.16.86.0/24网络上有一个IP，并且有一个默认网关172.16.86.1。网关是一个地址为的外部路由器172.16.86.1。eth0在bridge模式下，Docker 主机接口上不需要IP地址，只需将其置于正确的上游网络中即可通过网络交换机或网络路由器转发。
注意：对于 Macvlan 桥接模式，子网值需要与 Docker 主机的 NIC 接口相匹配。例如，使用该
-o parent=选项指定的 Docker 主机以太网接口的相同子网和网关。
此示例中使用的父接口是
eth0并且位于子网上172.16.86.0/24。docker network意志中的容器也需要与父代在同一个子网上-o parent=。网关是网络上的外部路由器，不是任何ip伪装或任何其他本地代理。驱动程序是用
-d driver_name选项指定的。在这种情况下-d macvlan父接口
-o parent=eth0配置如下：
ip addr show eth03: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 inet 172.16.86.250/24 brd 172.16.86.255 scope global eth0
创建 macvlan 网络并运行连接到它的几个容器：
# Macvlan (-o macvlan_mode= Defaults to Bridge mode if not specified)docker network create -d macvlan \ --subnet=172.16.86.0/24 \ --gateway=172.16.86.1 \ -o parent=eth0 pub_net # Run a container on the new network specifying the --ip address.docker run --net=pub_net --ip=172.16.86.10 -itd alpine /bin/sh # Start a second container and ping the first docker run --net=pub_net -it --rm alpine /bin/sh ping -c 4 172.16.86.10
看看容器IP和路由表：
ip a show eth0 eth0@if3: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UNKNOWN link/ether 46:b2:6b:26:2f:69 brd ff:ff:ff:ff:ff:ff inet 172.16.86.2/24 scope global eth0 ip route default via 172.16.86.1 dev eth0 172.16.86.0/24 dev eth0 src 172.16.86.2# NOTE: the containers can NOT ping the underlying host interfaces as# they are intentionally filtered by Linux for additional isolation.# In this case the containers cannot ping the -o parent=172.16.86.250
您可以明确指定bridge模式选项-o macvlan_mode=bridge。这是默认设置，因此将以bridge任何一种方式进行。
虽然eth0接口不需要在 Macvlan Bridge 中拥有 IP 地址，但在接口上使用 IP 地址并不罕见。通过使用该--aux-address=x.x.x.x标志，可以将地址从默认的内置 IPAM 中获取地址。这会将指定的地址黑名单分发给容器。上面的同一网络示例阻止将-o parent=eth0地址分发到容器。
docker network create -d macvlan \ --subnet=172.16.86.0/24 \ --gateway=172.16.86.1 \ --aux-address="exclude_host=172.16.86.250" \ -o parent=eth0 pub_net
在由默认的 Docker IPAM 驱动程序提供的网络中选择子池IP地址的另一个选项是使用--ip-range=。这将指定驱动程序从此池中分配容器地址，而不是--subnet=从网络创建的参数中分配更广泛的范围，如以下示例中所示，该示例将分配192.168.32.128从此处开始并向上递增的地址。
docker network create -d macvlan \ --subnet=192.168.32.0/24 \ --ip-range=192.168.32.128/25 \ --gateway=192.168.32.254 \ -o parent=eth0 macnet32 # Start a container and verify the address is 192.168.32.128docker run --net=macnet32 -it --rm alpine /bin/sh
网络可以通过以下方式删除：
docker network rm <network_name or id>
注意：在 Macvlan 中，您无法使用默认名称空间IP地址进行 ping 或通信。例如，如果您创建一个容器，并尝试 ping 多克尔主机
eth0将无法正常工作。该流量被内核模块明确过滤以提供额外的提供者隔离和安全性。
有关 Docker 网络命令的更多信息，请参阅使用 Docker 网络命令
Macvlan 802.1q中继桥接模式示例用法
VLAN（虚拟局域网）长期以来一直是虚拟化数据中心网络的主要手段，并且现在仍然在几乎所有现有网络中。VLAN 通过标记第2层隔离域，并使用从1-4094范围内插入到包头中的12位标识符来实现，该包头允许对
IPv4 和 IPv6 的单个或多个子网进行逻辑分组。这是很常见的网络运营商使用基于子网（或多个）功能或安全简档，如 VLAN 分隔交通web，db或任何其它隔离的需要。
计算主机要求在主机上同时运行多个虚拟网络是非常普遍的。长期以来，Linux 网络支持 VLAN 标记（也称为802.1q），用于维护网络之间的数据通路隔离。连接到 Docker 主机的以太网链路可以配置为支持802.1q VLAN ID，方法是创建 Linux 子接口，每个子接口专用于一个唯一的 VLAN ID。
将 802.1q 中继到 Linux 主机对于许多操作来说非常痛苦。它需要更改配置文件才能在重新启动后保持不变。如果涉及网桥，则需要将物理网卡移入网桥，然后网桥获取IP地址。这导致了许多搁浅的服务器，因为在该复杂过程中切断访问的风险很高。
像所有的 Docker 网络驱动程序一样，总体目标是减轻管理网络资源的操作痛苦。为此，当网络接收到不存在的父接口的子接口时，驱动程序会在创建网络时创建带 VLAN 标记的接口。
在主机重启的情况下，当 Docker 守护进程重新启动时，驱动程序将重新创建所有网络链接，而不需要修改经常复杂的网络配置文件。驱动程序会跟踪它是否创建了最初使用网络创建的 VLAN 标记的子接口，并且只会在重新启动后重新创建子接口，或者docker network rm如果首先使用链接创建链接，则会删除该链接docker network create。
如果用户不想让 Docker 修改-o parent子接口，用户只需要传递一个已经存在的现有链接作为父接口。父接口eth0不会被删除，只有不是主链接的子接口。
驱动程序需要添加/删除 vlan子接口interface_name.vlan_tag。
例如：eth0.50表示与vlan id标记eth0的从站的父接口。等效的命令是。eth0.5050ip linkip link add link eth0 name eth0.50 type vlan id 50
Vlan ID 50
在由 Docker 主机标记和隔离的第一个网络中，eth0.50父节点是使用50指定的 vlan id 标记的-o parent=eth0.50。可以使用其他命名格式，但需要使用ip link或 Linux 配置文件手动添加和删除链接。只要-o parent存在任何可以使用的东西，只要符合 Linux netlink。
# now add networks and hosts as you would normally by attaching to the master (sub)interface that is tagged docker network create -d macvlan \ --subnet=192.168.50.0/24 \ --gateway=192.168.50.1 \ -o parent=eth0.50 macvlan50 # In two separate terminals, start a Docker container and the containers can now ping one another.docker run --net=macvlan50 -it --name macvlan_test5 --rm alpine /bin/sh docker run --net=macvlan50 -it --name macvlan_test6 --rm alpine /bin/sh
Vlan ID 60
在第二个网络中，由 Docker 主机进行标记和隔离，eth0.60是使用60指定的vlan id标记的父接口-o parent=eth0.60。该macvlan_mode=默认macvlan_mode=bridge。它也可以显式设置，结果与下一个示例中显示的结果相同。
# now add networks and hosts as you would normally by attaching to the master (sub)interface that is tagged.docker network create -d macvlan \ --subnet=192.168.60.0/24 \ --gateway=192.168.60.1 \ -o parent=eth0.60 \ -o macvlan_mode=bridge macvlan60 # In two separate terminals, start a Docker container and the containers can now ping one another.docker run --net=macvlan60 -it --name macvlan_test7 --rm alpine /bin/sh docker run --net=macvlan60 -it --name macvlan_test8 --rm alpine /bin/sh
Example: Multi-Subnet Macvlan 802.1q Trunking
与之前的示例相同，除了绑定到网络的附加子网用户可以选择放置容器。在MacVlan / Bridge模式下，除非在两个子网之间有路由流量的外部路由器（回答ARP等），否则容器只能在相同的子网/广播域上互相ping通。
### Create multiple L2 subnets docker network create -d ipvlan \ --subnet=192.168.210.0/24 \ --subnet=192.168.212.0/24 \ --gateway=192.168.210.254 \ --gateway=192.168.212.254 \ -o ipvlan_mode=l2 ipvlan210 # Test 192.168.210.0/24 connectivity between containers docker run --net=ipvlan210 --ip=192.168.210.10 -itd alpine /bin/sh docker run --net=ipvlan210 --ip=192.168.210.9 -it --rm alpine ping -c 2 192.168.210.10# Test 192.168.212.0/24 connectivity between containers docker run --net=ipvlan210 --ip=192.168.212.10 -itd alpine /bin/sh docker run --net=ipvlan210 --ip=192.168.212.9 -it --rm alpine ping -c 2 192.168.212.10
双栈IPv4 IPv6 Macvlan桥接模式
例如： Macvlan Bridge模式，802.1q中继，VLAN ID：218，多子网，双协议栈
# Create multiple bridge subnets with a gateway of x.x.x.1:docker network create -d macvlan \ --subnet=192.168.216.0/24 --subnet=192.168.218.0/24 \ --gateway=192.168.216.1 --gateway=192.168.218.1 \ --subnet=2001:db8:abc8::/64 --gateway=2001:db8:abc8::10 \ -o parent=eth0.218 \ -o macvlan_mode=bridge macvlan216 # Start a container on the first subnet 192.168.216.0/24docker run --net=macvlan216 --name=macnet216_test --ip=192.168.216.10 -itd alpine /bin/sh # Start a container on the second subnet 192.168.218.0/24docker run --net=macvlan216 --name=macnet216_test --ip=192.168.218.10 -itd alpine /bin/sh # Ping the first container started on the 192.168.216.0/24 subnet docker run --net=macvlan216 --ip=192.168.216.11 -it --rm alpine /bin/sh ping 192.168.216.10# Ping the first container started on the 192.168.218.0/24 subnet docker run --net=macvlan216 --ip=192.168.218.11 -it --rm alpine /bin/sh ping 192.168.218.10
查看其中一个容器的详细信息：
docker run --net=macvlan216 --ip=192.168.216.11 -it --rm alpine /bin/sh root@526f3060d759:/# ip a show eth0 eth0@if92: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default link/ether 8e:9a:99:25:b6:16 brd ff:ff:ff:ff:ff:ff inet 192.168.216.11/24 scope global eth0 valid_lft forever preferred_lft forever inet6 2001:db8:abc4::8c9a:99ff:fe25:b616/64 scope link tentative valid_lft forever preferred_lft forever inet6 2001:db8:abc8::2/64 scope link nodad valid_lft forever preferred_lft forever # Specified v4 gateway of 192.168.216.1root@526f3060d759:/# ip route default via 192.168.216.1 dev eth0 192.168.216.0/24 dev eth0 proto kernel scope link src 192.168.216.11# Specified v6 gateway of 2001:db8:abc8::10root@526f3060d759:/# ip -6 route 2001:db8:abc4::/64 dev eth0 proto kernel metric 256 2001:db8:abc8::/64 dev eth0 proto kernel metric 256 default via 2001:db8:abc8::10 dev eth0 metric 1024