LXC 容器網路

我剛開始試驗 LXC 容器。我能夠創建一個容器並啟動它，但我無法讓 dhcp 為容器分配一個 IP 地址。如果我分配一個靜態地址，容器可以 ping 主機 IP，但不能在主機 IP 之外。

主機是 CentOS 6.5，來賓是 Ubuntu 14.04LTS。我使用了 lxc-create -t​​ download -n cn-01 命令下載的模板。

如果我試圖在與主機相同的子網上獲取 IP 地址，我認為我不需要 IP 表規則進行偽裝，但我還是添加了它。與IP轉發相同。

我從以下來源手動編譯了 LXC https://linuxcontainers.org/downloads/lxc-1.0.4.tar.gz

主機作業系統版本

#> cat /etc/redhat-release 
CentOS release 6.5 (Final)

#> uname -a
Linux localhost.localdomain 2.6.32-431.20.3.el6.x86_64 #1 SMP Thu Jun 19 21:14:45 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

容器配置

#> cat /usr/local/var/lib/lxc/cn-01/config 
# Template used to create this container: /usr/local/share/lxc/templates/lxc-download
# Parameters passed to the template:
# For additional config options, please look at lxc.container.conf(5)

# Distribution configuration
lxc.include = /usr/local/share/lxc/config/ubuntu.common.conf
lxc.arch = x86_64

# Container specific configuration
lxc.rootfs = /usr/local/var/lib/lxc/cn-01/rootfs
lxc.utsname = cn-01

# Network configuration
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = br0

LXC default.confu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:12:30:f2 brd ff:ff:ff:ff:f

#> cat /usr/local/etc/lxc/default.conf 
lxc.network.type = veth
lxc.network.link = br0
lxc.network.flags = up


#> lxc-checkconfig 
Kernel configuration not found at /proc/config.gz; searching...
Kernel configuration found at /boot/config-2.6.32-431.20.3.el6.x86_64
--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: enabled
Network namespace: enabled
Multiple /dev/pts instances: enabled

--- Control groups ---
Cgroup: enabled
Cgroup namespace: enabled
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: /usr/local/bin/lxc-checkconfig: line 103: [: too many arguments
enabled
Cgroup cpuset: enabled

--- Misc ---
Veth pair device: enabled
Macvlan: enabled
Vlan: enabled
File capabilities: /usr/local/bin/lxc-checkconfig: line 118: [: -gt: unary operator expected

Note : Before booting a new kernel, you can check its configuration
usage : CONFIG=/path/to/config /usr/local/bin/lxc-checkconfig

網路配置（主機）

#> cat /etc/sysconfig/network-scripts/ifcfg-br0 
DEVICE=br0
TYPE=Bridge
BOOTPROTO=dhcp
ONBOOT=yes

#> cat /etc/sysconfig/network-scripts/ifcfg-eth0 
DEVICE=eth0
ONBOOT=yes
TYPE=Ethernet
IPV6INIT=no
USERCTL=no
BRIDGE=br0

#> cat /etc/networks 
default 0.0.0.0
loopback 127.0.0.0
link-local 169.254.0.0


#> ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
   link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
   inet 127.0.0.1/8 scope host lo
   inet6 ::1/128 scope host 
      valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
   link/ether 00:0c:29:12:30:f2 brd ff:ff:ff:ff:ff:ff
   inet6 fe80::20c:29ff:fe12:30f2/64 scope link 
      valid_lft forever preferred_lft forever
3: pan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN 
   link/ether 42:7e:43:b3:61:c5 brd ff:ff:ff:ff:ff:ff
4: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN 
   link/ether 00:0c:29:12:30:f2 brd ff:ff:ff:ff:ff:ff
   inet 10.60.70.121/24 brd 10.60.70.255 scope global br0
   inet6 fe80::20c:29ff:fe12:30f2/64 scope link 
      valid_lft forever preferred_lft forever
12: vethT6BGL2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
   link/ether fe:a1:69:af:50:17 brd ff:ff:ff:ff:ff:ff
   inet6 fe80::fca1:69ff:feaf:5017/64 scope link 
      valid_lft forever preferred_lft forever


#> brctl show
bridge name bridge id       STP enabled interfaces
br0     8000.000c291230f2   no      eth0
                       vethT6BGL2
pan0        8000.000000000000   no  

#> cat /proc/sys/net/ipv4/ip_forward 
1

# Generated by iptables-save v1.4.7 on Fri Jul 11 15:11:36 2014
*nat
:PREROUTING ACCEPT [34:6287]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE 
COMMIT
# Completed on Fri Jul 11 15:11:36 2014

網路配置（容器）

#> cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

#> ip a s
11: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
   link/ether 02:69:fb:42:ee:d7 brd ff:ff:ff:ff:ff:ff
   inet6 fe80::69:fbff:fe42:eed7/64 scope link 
      valid_lft forever preferred_lft forever
13: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
   link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
   inet 127.0.0.1/8 scope host lo
   inet6 ::1/128 scope host 
      valid_lft forever preferred_lft forever

試試這個：（來源：http ://www.linuxfoundation.org/collaborate/workgroups/networking/bridge#No_traffic_gets_trough_.28except_ARP_and_STP.29 ）

沒有流量進入低谷（ARP 和 STP 除外）

您的核心可能啟用了乙太網過濾（ebtables、bridge-nf、arptables），並且流量被過濾。禁用此功能的最簡單方法是轉到 /proc/sys/net/bridge。檢查其中的bridge-nf-*條目是否設置為1；在這種情況下，請將它們設置為零並重試。

cd /proc/sys/net/bridge
ls bridge-nf-call-arptables bridge-nf-call-iptables bridge-nf-call-ip6tables bridge-nf-filter-vlan-tagged
for f in bridge-nf-*; do echo 0 > $f; done

引用自：https://serverfault.com/questions/612021