docker - 当 docker0 具有非默认地址时无法在 docker 容器内访问 Internet

Question

问题:在 docker 容器中无法访问互联网。

在我的裸机 Ubuntu 17.10 机器上...

$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=52 time=10.8 ms

但是……

$ docker run --rm debian:latest ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
92 bytes from 7911d89db6a4 (192.168.220.2): Destination Host Unreachable

我认为根本原因是我必须为 docker0 设置一个非默认网络，因为默认网络 172.17.0.1 已在我的组织中使用。

我的/etc/docker/daemon.json 文件需要看起来像这样才能使 docker 成功启动。

$ cat /etc/docker/daemon.json 
{
  "bip": "192.168.220.1/24",
  "fixed-cidr": "192.168.220.0/24",
  "fixed-cidr-v6": "0:0:0:0:0:ffff:c0a8:dc00/120",
  "mtu": 1500,
  "default-gateway": "192.168.220.10",
  "default-gateway-v6": "0:0:0:0:0:ffff:c0a8:dc0a",
  "dns": ["10.0.0.69","10.0.0.70","10.1.1.11"],
  "debug": true
}

请注意，默认网关设置看起来不对。但是，如果我将其更正为 192.168.220.1，docker 服务将无法启动。在命令行运行 dockerd 直接产生最有用的日志记录，因此:

在 daemon.json 中使用 "default-gateway": 192.168.220.1...

$ sudo dockerd
-----8<-----
many lines removed
----->8-----
Error starting daemon: Error initializing network controller: Error creating default "bridge" network: failed to allocate secondary ip address (DefaultGatewayIPv4:192.168.220.1): Address already in use

这是 docker0 的信息...

$ ip addr show docker0
10: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:10:bc:66:fd brd ff:ff:ff:ff:ff:ff
    inet 192.168.220.1/24 brd 192.168.220.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:10ff:febc:66fd/64 scope link 
       valid_lft forever preferred_lft forever

和路由表...

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.62.131.1     0.0.0.0         UG    100    0        0 enp14s0
10.62.131.0     0.0.0.0         255.255.255.0   U     100    0        0 enp14s0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 enp14s0
192.168.220.0   0.0.0.0         255.255.255.0   U     0      0        0 docker0

这是根本原因吗？我如何实现看似相互排斥的状态:

• docker0接口(interface)地址为x.x.x.1
• 网关地址相同，x.x.x.1
• dockerd 运行正常

?

谢谢!

对 Wedge Martin 问题的更长回答。我按照您的建议对 daemon.json 进行了更改:

{
  "bip": "192.168.220.2/24",
  "fixed-cidr": "192.168.220.0/24",
  "fixed-cidr-v6": "0:0:0:0:0:ffff:c0a8:dc00/120",
  "mtu": 1500,
  "default-gateway": "192.168.220.1",
  "default-gateway-v6": "0:0:0:0:0:ffff:c0a8:dc0a",
  "dns": ["10.0.0.69","10.0.0.70","10.1.1.11"],
  "debug": true
}

所以至少守护进程启动了，但我仍然无法在容器内访问互联网...

$ docker run -it --rm debian:latest bash
root@bd9082bf70a0:/# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
15: eth0@if16: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:c0:a8:dc:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 192.168.220.3/24 brd 192.168.220.255 scope global eth0
       valid_lft forever preferred_lft forever
root@bd9082bf70a0:/# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
92 bytes from bd9082bf70a0 (192.168.220.3): Destination Host Unreachable

Answer 1

事实证明，少即是多。将 daemon.json 简化为以下内容解决了我的问题。

{
  "bip": "192.168.220.2/24"
}