我让它正常工作,但现在它停了。我尝试了以下命令,但没有效果:
Docker运行-dns 8.8.8.8 base ping google.com
Docker运行base ping google.com
Sysctl -w net.ipv4。Ip_forward =1 -在主机和容器上
我得到的是未知主机google.com。Docker 0.7.0版本
什么好主意吗?
P.S. ufw也被禁用了
我让它正常工作,但现在它停了。我尝试了以下命令,但没有效果:
Docker运行-dns 8.8.8.8 base ping google.com
Docker运行base ping google.com
Sysctl -w net.ipv4。Ip_forward =1 -在主机和容器上
我得到的是未知主机google.com。Docker 0.7.0版本
什么好主意吗?
P.S. ufw也被禁用了
当前回答
对我来说,使用centos 7.4,这不是/etc/resolve.conf, iptables, iptables NAT规则或docker本身的问题。问题是主机缺少包bridge-utils, docker需要使用brctl命令来构建桥。Yum安装-y bridge-utils并重新启动docker,解决问题。
其他回答
我试了所有的答案,没有一个对我有效。
在尝试了几个小时后,我找到了这个方法:
reboot
-_-
对于Ubuntu 19.04使用openconnect 8.3进行VPN,我必须将/etc/resolve.conf符号链接到systemd中的文件(与answerby wisbucky相反)
执行ln -sf /etc/resolv.conf /run/systemd/resolve/resolv.conf
调试步骤
连接到公司VPN 在/etc/resolv.conf或/run/systemd/resolve/resolv.conf中查找正确的VPN设置 无论哪个有正确的DNS设置,我们都会将其符号链接到另一个文件 (提示:在赋值的左边放置一个设置正确的)
Docker版本:Docker版本19.03.0-rc2,构建f97efcc
在我的例子中,由于一些未知的原因,docker被配置为不生成网络所需的iptables规则容器。docker容器只能ping主机,没有其他功能。这里的大多数答案都没有帮助;重新创建桥或重新启动服务改变了任何东西。
但后来,在一次偶然的机会下,我发现了以下内容:
$ cat /etc/docker/daemon.json
{"iptables": false}
我删除了/etc/docker/daemon.文件Json并重新启动守护进程(默认是创建iptables规则)。这解决了网络问题。
下面是修复前的iptables规则:
$ iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
现在,iptables规则修复后:
$ iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- 0.0.0.0/0 0.0.0.0/0
DOCKER-ISOLATION-STAGE-1 all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
DOCKER all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
DOCKER all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (2 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 172.17.0.2 tcp dpt:8443
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target prot opt source destination
DOCKER-ISOLATION-STAGE-2 all -- 0.0.0.0/0 0.0.0.0/0
DOCKER-ISOLATION-STAGE-2 all -- 0.0.0.0/0 0.0.0.0/0
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target prot opt source destination
DROP all -- 0.0.0.0/0 0.0.0.0/0
DROP all -- 0.0.0.0/0 0.0.0.0/0
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
我使用的是Arch Linux,在尝试了以上所有的答案后,我意识到我的机器上启用了防火墙,nftables,并禁用它。我说:
sudo systemctl disable nftables
sudo systemctl stop nftables
sudo reboot
我的网卡:
➜ ~ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp1s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN mode DEFAULT group default qlen 1000
link/ether 68:f7:28:84:e7:fe brd ff:ff:ff:ff:ff:ff
3: wlp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DORMANT group default qlen 1000
link/ether d0:7e:35:d2:42:6d brd ff:ff:ff:ff:ff:ff
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
link/ether 02:42:43:3f:ff:94 brd ff:ff:ff:ff:ff:ff
5: br-c51881f83e32: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default
link/ether 02:42:ae:34:49:c3 brd ff:ff:ff:ff:ff:ff
6: br-c5b2a1d25a86: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default
link/ether 02:42:72:d3:6f:4d brd ff:ff:ff:ff:ff:ff
8: veth56f42a2@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP mode DEFAULT group default
link/ether 8e:70:36:10:4e:83 brd ff:ff:ff:ff:ff:ff link-netnsid 0
和我的防火墙配置,/etc/nftables.conf,我现在禁用了,将来会尝试改进,这样我就可以正确设置docker0网卡规则:
#!/usr/bin/nft -f
# vim:set ts=2 sw=2 et:
# IPv4/IPv6 Simple & Safe firewall ruleset.
# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/.
table inet filter
delete table inet filter
table inet filter {
chain input {
type filter hook input priority filter
policy drop
ct state invalid drop comment "early drop of invalid connections"
ct state {established, related} accept comment "allow tracked connections"
iifname lo accept comment "allow from loopback"
ip protocol icmp accept comment "allow icmp"
meta l4proto ipv6-icmp accept comment "allow icmp v6"
#tcp dport ssh accept comment "allow sshd"
pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
counter
}
chain forward {
type filter hook forward priority filter
policy drop
}
对我来说,是主机的防火墙。我必须在主机的防火墙上允许DNS。并且在更改主机防火墙设置后不得不重新启动docker。