docker - 为什么docker0需要混杂模式？

Question

当我使用 docker 在我的一台主机上以默认桥接模式创建容器时docker run --name bb -dit busybox现在我得到了一个IP:172.17.0.2
当我ping这个IP时，不起作用

BUT BUT, when I use tcpdump for interface docker0, ping works*

OR put docker0 to promiscuose mode, ping also works*

我的问题是: 为什么我需要将 docker0 置于混杂模式(仅此主机)，其他主机无需这样做
我的 iptables 结果:

Chain INPUT (policy ACCEPT 29031 packets, 8703K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  eth0   *       <hide>               192.168.0.0/24       policy match dir in pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  *      eth0    192.168.0.0/24       <hide>         policy match dir out pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  eth0   *       <hide>               192.168.0.0/24       policy match dir in pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  *      eth0    192.168.0.0/24       <hide>          policy match dir out pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  eth0   *       10.10.10.0/24        192.168.0.0/24       policy match dir in pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  *      eth0    192.168.0.0/24       10.10.10.0/24        policy match dir out pol ipsec reqid 8 proto 50
   56 11716 ACCEPT     all  --  eth0   *       <hide>               10.10.1.0/24         policy match dir in pol ipsec reqid 8 proto 50
   81  6292 ACCEPT     all  --  *      eth0    10.10.1.0/24         <hide>         policy match dir out pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  eth0   *       <hide>               10.10.1.0/24         policy match dir in pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  *      eth0    10.10.1.0/24         <hide>          policy match dir out pol ipsec reqid 8 proto 50
 1320 53255 ACCEPT     all  --  eth0   *       10.10.10.0/24        10.10.1.0/24         policy match dir in pol ipsec reqid 8 proto 50
 1344  104K ACCEPT     all  --  *      eth0    10.10.1.0/24         10.10.10.0/24        policy match dir out pol ipsec reqid 8 proto 50
 2218 1192K DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2218 1192K DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      docker_gwbridge  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      docker_gwbridge  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker_gwbridge !docker_gwbridge  0.0.0.0/0            0.0.0.0/0
    0     0 DROP       all  --  docker_gwbridge docker_gwbridge  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 27320 packets, 8507K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
    0     0 DOCKER-ISOLATION-STAGE-2  all  --  docker_gwbridge !docker_gwbridge  0.0.0.0/0            0.0.0.0/0
 2218 1192K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
    0     0 DROP       all  --  *      docker_gwbridge  0.0.0.0/0            0.0.0.0/0
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
54846   16M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
--------------------------------------------------------------------------------
nat
Chain PREROUTING (policy ACCEPT 6853 packets, 399K bytes)
 pkts bytes target     prot opt in     out     source               destination
 5353  327K DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 5353 packets, 327K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 57595 packets, 3457K bytes)
 pkts bytes target     prot opt in     out     source               destination
    3   252 DOCKER     all  --  *      *       0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 57970 packets, 3481K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  *      !docker0  172.17.0.0/16        0.0.0.0/0
    2   224 MASQUERADE  all  --  *      !docker_gwbridge  172.18.0.0/16        0.0.0.0/0

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     all  --  docker0 *       0.0.0.0/0            0.0.0.0/0
    0     0 RETURN     all  --  docker_gwbridge *       0.0.0.0/0            0.0.0.0/0

NETWORK ID          NAME                DRIVER              SCOPE
a20b11f6afaf        bridge              bridge              local
b39d1b268305        docker_gwbridge     bridge              local
5870d314fa6f        host                host                local
e0883dc1d6d0        none                null                local

ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:15:5d:00:02:10 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.3/24 brd 192.168.0.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 10.10.1.3/24 brd 10.10.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::215:5dff:fe00:210/64 scope link
       valid_lft forever preferred_lft forever
3: docker_gwbridge: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
    link/ether 02:42:0b:48:8e:44 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.1/16 brd 172.18.255.255 scope global docker_gwbridge
       valid_lft forever preferred_lft forever
    inet6 fe80::42:bff:fe48:8e44/64 scope link
       valid_lft forever preferred_lft forever
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 02:42:f8:5d:0a:13 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:f8ff:fe5d:a13/64 scope link
       valid_lft forever preferred_lft forever
8: vethca01e3e@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP
    link/ether 62:a0:50:02:72:94 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::60a0:50ff:fe02:7294/64 scope link
       valid_lft forever preferred_lft forever

tcpdump -vv -ni vethca01e3e

tcpdump: listening on vethca01e3e, link-type EN10MB (Ethernet), capture size 65535 bytes
12:20:47.972359 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:20:47.972397 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.17.0.2 is-at 02:42:ac:11:00:02, length 28
12:20:48.973716 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:20:48.973750 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.17.0.2 is-at 02:42:ac:11:00:02, length 28
12:20:49.975718 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:20:49.975742 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.17.0.2 is-at 02:42:ac:11:00:02, length 28

tcpdump -vvv -p -ni docker0

tcpdump: listening on docker0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:21:05.458191 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:21:06.459709 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:21:07.461705 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28

veth 重播 arp 但 docker0 忽略它

Answer 1

我遇到了同样的问题。我发现如果我删除 docker0 接口(interface)并重新启动 docker 可以解决我的问题。