# 查看Docker默認網(wǎng)絡配置
$ docker network ls
NETWORK ID     NAME      DRIVER    SCOPE
a1b2c3d4e5f6   bridge    bridge    local
d4e5f6a1b2c3   host      host      local
e5f6a1b2c3d4   none      null      local

# AWS VPC的典型配置
VPC CIDR: 10.0.0.0/16
子網(wǎng)1: 10.0.1.0/24 (公有子網(wǎng))
子網(wǎng)2: 10.0.2.0/24 (私有子網(wǎng))
子網(wǎng)3: 172.17.0.0/16 (Docker默認網(wǎng)段沖突!)

# docker-compose.yml 示例
version: '3.8'
services:
  app:
    image: myapp:latest
    networks:
      - app-network
  mongodb:
    image: mongo:latest
    networks:
      - app-network
networks:
  app-network:
    driver: bridge
    # Docker可能自動分配 172.19.0.0/16
    # 但RDS內網(wǎng)恰好也是這個網(wǎng)段！

#!/bin/bash
# 查詢所有Docker網(wǎng)絡及其子網(wǎng)
echo "========== 當前所有Docker網(wǎng)絡 =========="
docker network ls
echo -e "\n========== 網(wǎng)絡詳細信息（包含子網(wǎng)） =========="
docker network ls --quiet | xargs docker network inspect \
  | grep -E "(Name|Subnet|Gateway)" \
  | awk '
      /Name/ {printf "\n網(wǎng)絡名稱: " $2}
      /Subnet/ {printf "\n子網(wǎng): " $2}
      /Gateway/ {printf "\n網(wǎng) 關: " $2 "\n"}
    '
echo -e "\n========== 按網(wǎng)絡顯示容器 =========="
for net_id in $(docker network ls -q); do
  net_name=$(docker network inspect $net_id --format '{{.Name}}')
  containers=$(docker network inspect $net_id --format '{{range .Containers}}{{.Name}} {{end}}')
  if [ -n "$containers" ]; then
    echo "網(wǎng)絡: $net_name"
    echo "容器: $containers"
    echo "---"
  fi
done

#!/usr/bin/env python3
"""
Docker網(wǎng)絡沖突檢測工具
"""
import subprocess
import json
import ipaddress
from collections import defaultdict
def get_docker_networks():
    """獲取所有Docker網(wǎng)絡信息"""
    cmd = "docker network ls --quiet"
    network_ids = subprocess.check_output(cmd, shell=True).decode().strip().split('\n')
    networks = []
    for net_id in network_ids:
        if not net_id:
            continue
        cmd = f"docker network inspect {net_id}"
        try:
            output = subprocess.check_output(cmd, shell=True).decode()
            network_info = json.loads(output)[0]
            networks.append({
                'id': net_id,
                'name': network_info['Name'],
                'subnet': network_info.get('IPAM', {}).get('Config', [{}])[0].get('Subnet', 'N/A'),
                'gateway': network_info.get('IPAM', {}).get('Config', [{}])[0].get('Gateway', 'N/A'),
                'containers': list(network_info.get('Containers', {}).keys())
            })
        except Exception as e:
            print(f"獲取網(wǎng)絡 {net_id} 信息失敗: {e}")
    return networks
def check_conflict(existing_networks, new_subnet):
    """檢查新子網(wǎng)是否與現(xiàn)有網(wǎng)絡沖突"""
    conflicts = []
    try:
        new_network = ipaddress.ip_network(new_subnet)
    except ValueError as e:
        return [f"無效的子網(wǎng)格式: {new_subnet} - {e}"]
    for net in existing_networks:
        if net['subnet'] == 'N/A':
            continue
        try:
            existing_network = ipaddress.ip_network(net['subnet'])
            if new_network.overlaps(existing_network):
                conflicts.append(f"與網(wǎng)絡 '{net['name']}' ({net['subnet']}) 沖突")
        except ValueError:
            continue
    return conflicts
def main():
    print("?? Docker網(wǎng)絡沖突檢測工具")
    print("=" * 50)
    # 獲取現(xiàn)有網(wǎng)絡
    networks = get_docker_networks()
    print("\n?? 當前Docker網(wǎng)絡配置:")
    print("-" * 50)
    for net in networks:
        print(f"網(wǎng)絡: {net['name']}")
        print(f"  子網(wǎng): {net['subnet']}")
        print(f"  網(wǎng) 關: {net['gateway']}")
        print(f"  容器數(shù): {len(net['containers'])}")
        if net['containers']:
            print(f"  容器: {', '.join(net['containers'][:3])}" + 
                  ("..." if len(net['containers']) > 3 else ""))
        print()
    # 測試新網(wǎng)絡
    test_subnets = [
        "172.17.0.0/16",
        "192.168.1.0/24",
        "10.0.0.0/16"
    ]
    print("\n?? 網(wǎng)絡沖突測試:")
    print("-" * 50)
    for subnet in test_subnets:
        conflicts = check_conflict(networks, subnet)
        if conflicts:
            print(f"? 子網(wǎng) {subnet} 存在沖突:")
            for conflict in conflicts:
                print(f"   - {conflict}")
        else:
            print(f"? 子網(wǎng) {subnet} 可用")
if __name__ == "__main__":
    main()

# 查看系統(tǒng)路由表，識別可能的沖突
$ ip route show
# 或
$ route -n
# 或 Windows系統(tǒng)
$ netstat -rn

# 檢查特定IP的路由
$ ip route get 172.18.0.1

# docker-compose.yml - 指定不沖突的子網(wǎng)
version: '3.8'
networks:
  backend:
    driver: bridge
    ipam:
      config:
        - subnet: "10.10.0.0/24"
          gateway: "10.10.0.1"
          ip_range: "10.10.0.128/25"
  frontend:
    driver: bridge
    ipam:
      config:
        - subnet: "10.20.0.0/24"
          gateway: "10.20.0.1"
services:
  database:
    image: postgres:13
    networks:
      backend:
        ipv4_address: 10.10.0.10
  backend-api:
    image: myapi:latest
    networks:
      - backend
      - frontend
  frontend-app:
    image: nginx:latest
    networks:
      frontend:
        ipv4_address: 10.20.0.10
    ports:
      - "80:80"
      - "443:443"

# 連接現(xiàn)有網(wǎng)絡或創(chuàng)建外部網(wǎng)絡
version: '3.8'
networks:
  company-network:
    external: true
    name: company-internal
  isolated-network:
    driver: bridge
    ipam:
      config:
        - subnet: "192.168.100.0/28"  # 很小的子網(wǎng)，避免沖突
services:
  legacy-app:
    image: legacy:1.0
    networks:
      company-network:
        aliases:
          - legacy-app.company.internal
  new-microservice:
    image: new-service:latest
    networks:
      isolated-network:
    # 通過extra_hosts訪問外部網(wǎng)絡
    extra_hosts:
      - "database.company.internal:10.0.0.100"
      - "api.company.internal:10.0.0.101"

#!/bin/bash
# auto_docker_network.sh - 自動創(chuàng)建不沖突的Docker網(wǎng)絡
# 公司內部網(wǎng)絡范圍（需要避免的網(wǎng)段）
declare -a CONFLICT_SUBNETS=(
    "10.0.0.0/8"
    "172.16.0.0/12"
    "192.168.0.0/16"
    "100.64.0.0/10"  # CGNAT范圍
)
# 可用的私有網(wǎng)段（RFC 1918以外的私有空間）
declare -a AVAILABLE_SUBNETS=(
    "192.168.200.0/24"
    "192.168.201.0/24"
    "192.168.202.0/24"
    "10.200.0.0/16"
    "10.201.0.0/16"
)
# 檢查子網(wǎng)是否沖突
check_subnet_conflict() {
    local subnet=$1
    # 檢查是否在沖突列表中
    for conflict in "${CONFLICT_SUBNETS[@]}"; do
        if docker network inspect --format "{{.IPAM.Config}}" all | grep -q "$conflict"; then
            return 1  # 沖突
        fi
    done
    # 檢查現(xiàn)有Docker網(wǎng)絡
    existing_subnets=$(docker network ls --quiet | xargs docker network inspect | grep -oP '(?<="Subnet": ")[^"]+')
    for existing in $existing_subnets; do
        if [ "$existing" = "$subnet" ]; then
            return 1  # 已存在
        fi
    done
    return 0  # 可用
}
# 創(chuàng)建安全的Docker網(wǎng)絡
create_safe_network() {
    local network_name=$1
    for subnet in "${AVAILABLE_SUBNETS[@]}"; do
        if check_subnet_conflict "$subnet"; then
            echo "創(chuàng)建網(wǎng)絡 $network_name 使用子網(wǎng) $subnet"
            # 提取網(wǎng)絡地址和網(wǎng) 關
            network_addr=$(echo $subnet | cut -d'/' -f1)
            gateway="${network_addr%.*}.1"
            docker network create \
                --driver bridge \
                --subnet="$subnet" \
                --gateway="$gateway" \
                "$network_name"
            return 0
        fi
    done
    echo "錯誤: 找不到可用的子網(wǎng)"
    return 1
}
# 使用示例
create_safe_network "myapp-production"
create_safe_network "myapp-staging"

# 使用Calico網(wǎng)絡插件
docker network create \
  --driver=calico \
  --ipam-driver=calico-ipam \
  --subnet=192.168.100.0/24 \
  calico-net
# 使用Weave網(wǎng)絡
docker network create \
  --driver=weave \
  --subnet=10.32.0.0/12 \
  weave-net

# 1. 檢查應用程序容器網(wǎng)絡
$ docker exec -it app-container cat /etc/resolv.conf

# 2. 從容器內測試RDS連接
$ docker exec -it app-container ping rds-hostname
# 如果返回未知主機，是DNS問題
# 如果連接超時，是網(wǎng)絡路由問題

# 3. 檢查容器路由
$ docker exec -it app-container ip route show

# 4. 發(fā)現(xiàn)RDS內網(wǎng)IP為 172.31.0.100
# 而Docker網(wǎng)絡為 172.31.0.0/16 - 沖突！

# docker-compose.override.yml
version: '3.8'
networks:
  default:
    ipam:
      config:
        - subnet: "10.10.10.0/24"
          gateway: "10.10.10.1"
# 或者使用extra_hosts直接指定IP
services:
  app:
    extra_hosts:
      - "database.rds.amazonaws.com:172.31.0.100"
    dns:
      - 8.8.8.8
      - 1.1.1.1

# project-a/docker-compose.yml
version: '3.8'
networks:
  project-a-net:
    driver: bridge
    ipam:
      config:
        - subnet: "10.100.1.0/24"
# project-b/docker-compose.yml
version: '3.8'
networks:
  project-b-net:
    driver: bridge
    ipam:
      config:
        - subnet: "10.100.2.0/24"
# 全局網(wǎng)絡配置 /etc/docker/daemon.json
{
  "default-address-pools": [
    {"base": "10.200.0.0/16", "size": 24},
    {"base": "10.201.0.0/16", "size": 24}
  ],
  "bip": "10.255.0.1/24"
}

# 企業(yè)級網(wǎng)絡規(guī)劃
開發(fā)環(huán)境: 10.10.0.0/16
測試環(huán)境: 10.20.0.0/16  
生產環(huán)境: 10.30.0.0/16
Docker網(wǎng)絡: 10.100.0.0/16

# .env文件
DOCKER_SUBNET=10.100.${ENV_NUM}.0/24
DOCKER_GATEWAY=10.100.${ENV_NUM}.1

# docker-compose.yml
networks:
  app-network:
    ipam:
      config:
        - subnet: ${DOCKER_SUBNET}
          gateway: ${DOCKER_GATEWAY}

# 部署前檢查腳本
#!/bin/bash
echo "檢查網(wǎng)絡配置..."
./check_network_conflicts.py

if [ $? -ne 0 ]; then
  echo "發(fā)現(xiàn)網(wǎng)絡沖突，終止部署"
  exit 1
fi

echo "開始部署..."
docker-compose up -d

# 定期清理無用網(wǎng)絡
docker network prune

# 監(jiān)控網(wǎng)絡使用情況
docker network ls --format "table {{.Name}}\t{{.Driver}}\t{{.Scope}}" | grep -v NAME

# 網(wǎng)絡健康檢查
for net in $(docker network ls -q); do
  echo "檢查網(wǎng)絡: $(docker network inspect $net --format '{{.Name}}')"
  docker network inspect $net --format '{{range .Containers}}{{.Name}}: {{.IPv4Address}}{{end}}'
done

# 緊急情況下重置Docker網(wǎng)絡
#!/bin/bash
# emergency_network_reset.sh

echo "警告: 這將停止所有容器并重置Docker網(wǎng)絡!"
read -p "確認繼續(xù)? (y/N): " confirm

if [ "$confirm" != "y" ]; then
  echo "操作取消"
  exit 0
fi

# 1. 停止所有容器
docker stop $(docker ps -q)

# 2. 刪除所有自定義網(wǎng)絡
docker network rm $(docker network ls -q --filter type=custom)

# 3. 清理
docker system prune -f --volumes

# 4. 重啟Docker服務
sudo systemctl restart docker

# 5. 重新創(chuàng)建安全網(wǎng)絡
./create_safe_network.sh production-net 10.100.100.0/24

echo "網(wǎng)絡重置完成"

# 網(wǎng)絡連通性測試
docker run --rm --net=container:<container_id> \
  appropriate/curl curl http://target-service:port

# DNS解析測試
docker run --rm --dns=8.8.8.8 alpine nslookup google.com