docker容器的端口映射

1.建立一個Nginx 容器,先不映射端口

[root@localhost ~]# docker run --name my_nginx -d nginx 7be3673a4c0f8f7ffe79a7b11ab86c4327dacaf734ed574e88e28c1db2243716 [root@localhost ~]# docker ps -a #能夠看到容器啓用了80端口,可是在宿主機上沒有進行映射 CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 7be3673a4c0f nginx "nginx -g 'daemon ..."   5 seconds ago       Up 4 seconds        80/tcp              my_nginx

2.獲取該容器的網絡信息

[root@localhost ~]# docker exec -it my_nginx  /bin/bash  #能夠看到Nginx容器很是簡潔，不少shell命令都沒有，沒法查看一些咱們想要的信息 root@7be3673a4c0f:/# ip a bash: ip: command not found root@7be3673a4c0f:/# ifconfig bash: ifconfig: command not found root@localhost ~]# docker network inspect bridge  #咱們能夠經過inspect查看一下網絡信息 "Containers": { "7be3673a4c0f8f7ffe79a7b11ab86c4327dacaf734ed574e88e28c1db2243716": { "Name": "my_nginx", "EndpointID": "6fa4eedf32d4a9d75b591d102613944d49a3cd40d2e41ea6c386685584fd09a7", "MacAddress": "02:42:ac:11:00:02", "IPv4Address": "172.17.0.2/16", #容器的IP地址 "IPv6Address": "" } }, 

3.經過宿主機訪問一下容器IP地址及端口

[root@localhost ~]# ping 172.17.0.2 #能夠ping通 PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data. 64 bytes from 172.17.0.2: icmp_seq=1 ttl=64 time=0.073 ms [root@localhost ~]# telnet 172.17.0.2 80 #Telnet 80端口正常 Trying 172.17.0.2... Connected to 172.17.0.2. Escape character is '^]'. [root@localhost ~]# curl -I 172.17.0.2 #訪問Nginx容器80端口正常 HTTP/1.1 200 OK

小結：默認建立的容器若是有服務端口那麼從宿主機能夠訪問，外部沒法訪問

4.建立一個容器，經過-p參數啓動端口映射

[root@localhost ~]# docker rm -f my_nginx [root@localhost ~]# docker run --name my_nginx -d -p 80:80 nginx  #注意-p參數的格式 f1166a72ab910b425cf32b91ababde2a5b6a4fda6db08852bf7a99d925d4985f [root@localhost ~]# docker ps -a #這裏的規則映射了 ，意味着將接受主機來自全部接口的流量。用戶能夠經過  或  來指定容許訪問容器的主機上的 IP、接口等，以制定更嚴格的規則 CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES f1166a72ab91 nginx "nginx -g 'daemon ..."   3 seconds ago       Up 3 seconds        0.0.0.0:80->80/tcp my_nginx
0.0.0.0-p IP:host_port:container_port-p IP::port

若是但願永久綁定到某個固定的 IP 地址，能夠在 Docker 配置文件 /etc/docker/daemon.json 中添加以下內容：

{ "ip": "0.0.0.0" }

經過宿主機IP地址訪問(注意端口)

[root@localhost ~]# ifconfig eth0|awk 'NR==2{print $2}'
172.16.150.135

 

5.建立一個容器，經過-P參數啓動端口映射

[root@localhost ~]# docker rm -f my_nginx my_nginx [root@localhost ~]# docker run --name my_nginx -d -P nginx #-P直接使用，不須要指定端口 8f9df2a803766862d08709b77054d35e890ca72c0ea17770dac8b3815278d35b [root@localhost ~]# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 8f9df2a80376 nginx "nginx -g 'daemon ..."   5 seconds ago       Up 5 seconds        0.0.0.0:10000->80/tcp   my_nginx

外部訪問(注意端口)

 6.-P及-p參數的用法及區別

官方文檔文檔：

   -P, --publish-all=true|false Publish all exposed ports to random ports on the host interfaces. The default is false. When set to true publish all exposed ports to the host interfaces. The default is false. If the operator uses -P (or  -p) then Docker will make the exposed port accessible on the host and the ports will be available to any client that can reach the host. When using -P, Docker will bind any exposed port to a random port on the host within an ephemeral port range defined by /proc/sys/net/ipv4/ip_local_port_range. To find the mapping between the host ports and the exposed ports, use docker port. -p, --publish=[] Publish a container's port, or range of ports, to the host.
 Format: ip:hostPort:containerPort |  ip::containerPort  | hostPort:containerPort | containerPort Both hostPort and containerPort can be specified as a range of ports. When specifying ranges for both, the number of container ports in the range must match the number of host ports in the range. (e.g., docker run -p 1234-1236:1222-1224 --name thisWorks -t busybox but not docker run -p 1230-1236:1230-1240 --name RangeContainerPortsBiggerThanRangeHost‐ Ports -t busybox) With ip: docker run -p 127.0.0.1:$HOSTPORT:$CONTAINERPORT --name CONTAINER -t someimage Use docker port to see the actual mapping: docker port CONTAINER $CONTAINERPORT

-P：

在宿主機上經過隨機端口映射容器內啓用端口，隨機的端口範圍經過/proc/sys/net/ipv4/ip_local_port_range配置獲取 [root@localhost ~]# cat /proc/sys/net/ipv4/ip_local_port_range 10000 65000

-p：

能夠指定要映射的端口，而且，在一個指定端口上只能夠綁定一個容器。 端口映射支持的格式有： 　　ip:hostport:containerport #指定ip、指定主機port、指定容器port 　　ip::containerport #指定ip、未指定主機port、指定容器port 　　hostport:container #未指定ip port、指定主機port、指定容器port 屢次使用-p標記能夠綁定多個端口，例 -p 00:80 -p 8088:8080
能夠指定範圍，例 -p 1234-1236:1222-1224

無論用那種辦法，其實也是在本地的 iptable 的 nat 表中添加相應的規則：

使用 -p 80:80 時：

[root@localhost ~]#  iptables -t nat -vnL|grep :80
    0     0 MASQUERADE  tcp  --  *      *       172.17.0.2           172.17.0.2           tcp dpt:80
    0     0 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:172.17.0.2:80

使用 -P 時：

[root@localhost ~]#  iptables -t nat -vnL|grep :80
    0     0 MASQUERADE  tcp  --  *      *       172.17.0.2           172.17.0.2           tcp dpt:80
    0     0 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10000 to:172.17.0.2:80