Warning: Array to string conversion in /home/wwwroot/myf5/wp-content/plugins/wpjam-basic/public/wpjam-utils.php on line 496
拉取busybox镜像，并运行一个容器实例（挂载一个自命名的volume进去）
[root@docker1 volumes]# docker run -it -v /root/dockervolume/:/data busybox
观察此时/var/lib/docker下结构：
[root@docker1 docker]# tree -L 4
.
├── containers
│ ├── 276041ef9cbefee243480ed52e5d2e0529df7a7c6c6a617f38ab6937136079f3
│ │ ├── 276041ef9cbefee243480ed52e5d2e0529df7a7c6c6a617f38ab6937136079f3-json.log
│ │ ├── checkpoints
│ │ ├── config.v2.json
│ │ ├── hostconfig.json
│ │ ├── hostname
│ │ ├── hosts
│ │ ├── resolv.conf
│ │ ├── resolv.conf.hash
│ │ └── shm
│ └── 985e538f6b25487f5944707d44db1c3f624dd83f95adf02ab901fc75e6750823
│ ├── 985e538f6b25487f5944707d44db1c3f624dd83f95adf02ab901fc75e6750823-json.log
│ ├── checkpoints
│ ├── config.v2.json
│ ├── hostconfig.json
│ ├── hostname
│ ├── hosts
│ ├── resolv.conf
│ ├── resolv.conf.hash
│ └── shm
├── image
│ └── overlay
│ ├── distribution
│ │ ├── diffid-by-digest
│ │ └── v2metadata-by-diffid
│ ├── imagedb
│ │ ├── content
│ │ └── metadata
│ ├── layerdb
│ │ ├── mounts
│ │ ├── sha256
│ │ └── tmp
│ └── repositories.json
├── network
│ └── files
│ └── local-kv.db
├── overlay
│ ├── 14d4a3283bd0fac4850cf1151a5699266e62ac0366e15d6a290fe13ab6a452cd
│ │ ├── lower-id
│ │ ├── merged
│ │ ├── upper
│ │ │ ├── dev
│ │ │ ├── etc
│ │ │ ├── proc
│ │ │ └── sys
│ │ └── work
│ │ └── work
│ ├── 14d4a3283bd0fac4850cf1151a5699266e62ac0366e15d6a290fe13ab6a452cd-init
│ │ ├── lower-id
│ │ ├── merged
│ │ ├── upper
│ │ │ ├── dev
│ │ │ ├── etc
│ │ │ ├── proc
│ │ │ └── sys
│ │ └── work
│ │ └── work
│ ├── 4ff8b86a0317b5a6bd539e51ec676395e6079f4d8a77b34ff95cb8a9451279a0
│ │ └── root
│ │ └── hello
│ ├── a626a89bd36ab93ba340eb98f01a824b1edb75082694cc8c695992b4e57e1087
│ │ └── root
│ │ ├── bin
│ │ ├── dev
│ │ ├── etc
│ │ ├── home
│ │ ├── root
│ │ ├── tmp
│ │ ├── usr
│ │ └── var
│ ├── c1eb6f4be0f4f384fe4a1645cc03e3f9c3c81c72a9f276c844f62c6d7cca0974
│ │ ├── lower-id
│ │ ├── merged
│ │ │ ├── bin
│ │ │ ├── data
│ │ │ ├── dev
│ │ │ ├── etc
│ │ │ ├── home
│ │ │ ├── proc
│ │ │ ├── root
│ │ │ ├── sys
│ │ │ ├── tmp
│ │ │ ├── usr
│ │ │ └── var
│ │ ├── upper
│ │ │ ├── data
│ │ │ ├── dev
│ │ │ ├── etc
│ │ │ ├── proc
│ │ │ ├── root
│ │ │ └── sys
│ │ └── work
│ │ └── work
│ └── c1eb6f4be0f4f384fe4a1645cc03e3f9c3c81c72a9f276c844f62c6d7cca0974-init
│ ├── lower-id
│ ├── merged
│ ├── upper
│ │ ├── dev
│ │ ├── etc
│ │ ├── proc
│ │ └── sys
│ └── work
│ └── work
├── plugins
│ ├── storage
│ │ └── blobs
│ │ └── tmp
│ └── tmp
├── swarm
├── tmp
├── tmp-old
├── trust
└── volumes
└── metadata.db
93 directories, 22 files
在busybox内查看，注意 / 的mount，与上述粗红对应
/ # mount
rootfs on / type rootfs (rw)
overlay on / type overlay (rw,seclabel,relatime,lowerdir=/var/lib/docker/overlay/a626a89bd36ab93ba340eb98f01a824b1edb75082694cc8c695992b4e57e1087/root,upperdir=/var/lib/docker/overlay/c1eb6f4be0f4f384fe4a1645cc03e3f9c3c81c72a9f276c844f62c6d7cca0974/upper,workdir=/var/lib/docker/overlay/c1eb6f4be0f4f384fe4a1645cc03e3f9c3c81c72a9f276c844f62c6d7cca0974/work)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=666)
sysfs on /sys type sysfs (ro,seclabel,nosuid,nodev,noexec,relatime)
tmpfs on /sys/fs/cgroup type tmpfs (ro,seclabel,nosuid,nodev,noexec,relatime,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (ro,nosuid,nodev,noexec,relatime,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd)
cgroup on /sys/fs/cgroup/memory type cgroup (ro,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/pids type cgroup (ro,nosuid,nodev,noexec,relatime,pids)
cgroup on /sys/fs/cgroup/net_prio,net_cls type cgroup (ro,nosuid,nodev,noexec,relatime,net_prio,net_cls)
cgroup on /sys/fs/cgroup/cpuset type cgroup (ro,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (ro,nosuid,nodev,noexec,relatime,hugetlb)
cgroup on /sys/fs/cgroup/cpuacct,cpu type cgroup (ro,nosuid,nodev,noexec,relatime,cpuacct,cpu)
cgroup on /sys/fs/cgroup/freezer type cgroup (ro,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/devices type cgroup (ro,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/blkio type cgroup (ro,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/perf_event type cgroup (ro,nosuid,nodev,noexec,relatime,perf_event)
mqueue on /dev/mqueue type mqueue (rw,seclabel,nosuid,nodev,noexec,relatime)
/dev/mapper/centos-root on /data type xfs (rw,seclabel,relatime,attr2,inode64,noquota)
/dev/mapper/centos-root on /etc/resolv.conf type xfs (rw,seclabel,relatime,attr2,inode64,noquota)
/dev/mapper/centos-root on /etc/hostname type xfs (rw,seclabel,relatime,attr2,inode64,noquota)
/dev/mapper/centos-root on /etc/hosts type xfs (rw,seclabel,relatime,attr2,inode64,noquota)
shm on /dev/shm type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=65536k)
devpts on /dev/console type devpts (rw,seclabel,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
proc on /proc/asound type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/bus type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/fs type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/irq type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sys type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sysrq-trigger type proc (ro,nosuid,nodev,noexec,relatime)
tmpfs on /proc/kcore type tmpfs (rw,seclabel,nosuid,mode=755)
tmpfs on /proc/timer_list type tmpfs (rw,seclabel,nosuid,mode=755)
tmpfs on /proc/timer_stats type tmpfs (rw,seclabel,nosuid,mode=755)
tmpfs on /proc/sched_debug type tmpfs (rw,seclabel,nosuid,mode=755)
tmpfs on /sys/firmware type tmpfs (ro,seclabel,relatime)
/ # df
Filesystem 1K-blocks Used Available Use% Mounted on
overlay 18307072 1672776 16634296 9% /
tmpfs 2015208 0 2015208 0% /dev
tmpfs 2015208 0 2015208 0% /sys/fs/cgroup
/dev/mapper/centos-root
18307072 1672776 16634296 9% /data
在宿主机的目录下创建一个文件，在容器里可以被看到：
[root@docker1 docker]# cd /root/dockervolume/ [root@docker1 dockervolume]# touch busybox.txt / # ls /data/ busybox.txt
网络方面：
启动的busybox container使用一个veth pair 连接到了 docker0网桥上，从网桥对应的网络获得IP地址，系统默认启动了 icc。 从宿主机ifconfig角度看，多了一个veth接口，该接口即连接到了docker0网桥上。在busybox内部，看到正常的一个eth0，其实它是veth pair的另一端。
[root@docker1 docker]# docker network ls
NETWORK ID NAME DRIVER SCOPE
734c4df7548e bridge bridge local
e7f32fd414b9 host host local
206ea33a6608 none null local
[root@docker1 docker]# docker network inspect 734c4df7548e
[
{
"Name": "bridge",
"Id": "734c4df7548e0b27980630a0edf4eec2094bfb24c51f8b89b04c543f7fd866b0",
"Created": "2017-05-08T11:19:43.110067372+08:00",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"Containers": {
"985e538f6b25487f5944707d44db1c3f624dd83f95adf02ab901fc75e6750823": {
"Name": "awesome_torvalds",
"EndpointID": "6c844510d4ab0ac7c98a33a9389438da87b05eb0a447d0d006f6fdb0a2105b3a",
"MacAddress": "02:42:ac:11:00:02",
"IPv4Address": "172.17.0.2/16",
"IPv6Address": ""
}
},
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Labels": {}
}
]
[root@docker1 docker]# ifconfig
docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.17.0.1 netmask 255.255.0.0 broadcast 0.0.0.0
inet6 fe80::42:4eff:febe:c289 prefixlen 64 scopeid 0x20<link>
ether 02:42:4e:be:c2:89 txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 2 bytes 168 (168.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eno16777736: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.0.129 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 fe80::20c:29ff:fe42:d98 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:42:0d:98 txqueuelen 1000 (Ethernet)
RX packets 25735 bytes 7140443 (6.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 6890 bytes 1759536 (1.6 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eno33554960: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 00:0c:29:42:0d:a2 txqueuelen 1000 (Ethernet)
RX packets 233 bytes 42888 (41.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eno50332184: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 00:0c:29:42:0d:ac txqueuelen 1000 (Ethernet)
RX packets 233 bytes 42888 (41.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1 (Local Loopback)
RX packets 68 bytes 5844 (5.7 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 68 bytes 5844 (5.7 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
veth0524764: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::b05c:6aff:fe25:44fd prefixlen 64 scopeid 0x20<link>
ether b2:5c:6a:25:44:fd txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 8 bytes 648 (648.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
/ # ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02
inet addr:172.17.0.2 Bcast:0.0.0.0 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:648 (648.0 B) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
docker inspect 查看该容器，可以看到容器的几大部分配置，config, hostconfig, networksetting, graphdirver. hostconfig是与宿主机有关联的相关配置。 网络部分中的sandbox可以理解为容器的namespace，其内包含一个endpoint，连接到相关network上，类似下图
[root@docker1 ns]# docker inspect awesome_torvalds
[
{
"Id": "985e538f6b25487f5944707d44db1c3f624dd83f95adf02ab901fc75e6750823",
"Created": "2017-05-09T01:26:23.01518301Z",
"Path": "sh",
"Args": [],
"State": {
"Status": "running",
"Running": true,
"Paused": false,
"Restarting": false,
"OOMKilled": false,
"Dead": false,
"Pid": 5013,
"ExitCode": 0,
"Error": "",
"StartedAt": "2017-05-09T01:26:23.179898703Z",
"FinishedAt": "0001-01-01T00:00:00Z"
},
"Image": "sha256:00f017a8c2a6e1fe2ffd05c281f27d069d2a99323a8cd514dd35f228ba26d2ff",
"ResolvConfPath": "/var/lib/docker/containers/985e538f6b25487f5944707d44db1c3f624dd83f95adf02ab901fc75e6750823/resolv.conf",
"HostnamePath": "/var/lib/docker/containers/985e538f6b25487f5944707d44db1c3f624dd83f95adf02ab901fc75e6750823/hostname",
"HostsPath": "/var/lib/docker/containers/985e538f6b25487f5944707d44db1c3f624dd83f95adf02ab901fc75e6750823/hosts",
"LogPath": "/var/lib/docker/containers/985e538f6b25487f5944707d44db1c3f624dd83f95adf02ab901fc75e6750823/985e538f6b25487f5944707d44db1c3f624dd83f95adf02ab901fc75e6750823-json.log",
"Name": "/awesome_torvalds",
"RestartCount": 0,
"Driver": "overlay",
"MountLabel": "",
"ProcessLabel": "",
"AppArmorProfile": "",
"ExecIDs": null,
"HostConfig": {
"Binds": [
"/root/dockervolume/:/data"
],
"ContainerIDFile": "",
"LogConfig": {
"Type": "json-file",
"Config": {}
},
"NetworkMode": "default",
"PortBindings": {},
"RestartPolicy": {
"Name": "no",
"MaximumRetryCount": 0
},
"AutoRemove": false,
"VolumeDriver": "",
"VolumesFrom": null,
"CapAdd": null,
"CapDrop": null,
"Dns": [],
"DnsOptions": [],
"DnsSearch": [],
"ExtraHosts": null,
"GroupAdd": null,
"IpcMode": "",
"Cgroup": "",
"Links": null,
"OomScoreAdj": 0,
"PidMode": "",
"Privileged": false,
"PublishAllPorts": false,
"ReadonlyRootfs": false,
"SecurityOpt": null,
"UTSMode": "",
"UsernsMode": "",
"ShmSize": 67108864,
"Runtime": "runc",
"ConsoleSize": [
0,
0
],
"Isolation": "",
"CpuShares": 0,
"Memory": 0,
"NanoCpus": 0,
"CgroupParent": "",
"BlkioWeight": 0,
"BlkioWeightDevice": null,
"BlkioDeviceReadBps": null,
"BlkioDeviceWriteBps": null,
"BlkioDeviceReadIOps": null,
"BlkioDeviceWriteIOps": null,
"CpuPeriod": 0,
"CpuQuota": 0,
"CpuRealtimePeriod": 0,
"CpuRealtimeRuntime": 0,
"CpusetCpus": "",
"CpusetMems": "",
"Devices": [],
"DeviceCgroupRules": null,
"DiskQuota": 0,
"KernelMemory": 0,
"MemoryReservation": 0,
"MemorySwap": 0,
"MemorySwappiness": -1,
"OomKillDisable": false,
"PidsLimit": 0,
"Ulimits": null,
"CpuCount": 0,
"CpuPercent": 0,
"IOMaximumIOps": 0,
"IOMaximumBandwidth": 0
},
"GraphDriver": {
"Data": {
"LowerDir": "/var/lib/docker/overlay/a626a89bd36ab93ba340eb98f01a824b1edb75082694cc8c695992b4e57e1087/root",
"MergedDir": "/var/lib/docker/overlay/c1eb6f4be0f4f384fe4a1645cc03e3f9c3c81c72a9f276c844f62c6d7cca0974/merged",
"UpperDir": "/var/lib/docker/overlay/c1eb6f4be0f4f384fe4a1645cc03e3f9c3c81c72a9f276c844f62c6d7cca0974/upper",
"WorkDir": "/var/lib/docker/overlay/c1eb6f4be0f4f384fe4a1645cc03e3f9c3c81c72a9f276c844f62c6d7cca0974/work"
},
"Name": "overlay"
},
"Mounts": [
{
"Type": "bind",
"Source": "/root/dockervolume",
"Destination": "/data",
"Mode": "",
"RW": true,
"Propagation": ""
}
],
"Config": {
"Hostname": "985e538f6b25",
"Domainname": "",
"User": "",
"AttachStdin": true,
"AttachStdout": true,
"AttachStderr": true,
"Tty": true,
"OpenStdin": true,
"StdinOnce": true,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Cmd": [
"sh"
],
"Image": "busybox",
"Volumes": null,
"WorkingDir": "",
"Entrypoint": null,
"OnBuild": null,
"Labels": {}
},
"NetworkSettings": {
"Bridge": "",
"SandboxID": "3a98bfe3abf762a396cdf403eaa1fa3d7aa2b26473a40f5797c6e9020ca0e055",
"HairpinMode": false,
"LinkLocalIPv6Address": "",
"LinkLocalIPv6PrefixLen": 0,
"Ports": {},
"SandboxKey": "/var/run/docker/netns/3a98bfe3abf7",
"SecondaryIPAddresses": null,
"SecondaryIPv6Addresses": null,
"EndpointID": "6c844510d4ab0ac7c98a33a9389438da87b05eb0a447d0d006f6fdb0a2105b3a",
"Gateway": "172.17.0.1",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "172.17.0.2",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"MacAddress": "02:42:ac:11:00:02",
"Networks": {
"bridge": {
"IPAMConfig": null,
"Links": null,
"Aliases": null,
"NetworkID": "734c4df7548e0b27980630a0edf4eec2094bfb24c51f8b89b04c543f7fd866b0",
"EndpointID": "6c844510d4ab0ac7c98a33a9389438da87b05eb0a447d0d006f6fdb0a2105b3a",
"Gateway": "172.17.0.1",
"IPAddress": "172.17.0.2",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"MacAddress": "02:42:ac:11:00:02"
}
}
}
}
]
那么如何在宿主机下进入该容器的namespace里面呢？
1. 首先通过上述输出中的State.Pid获得该容器在主机里的进程号，这里是5013
2. 将/proc/5013/ns/net link到/var/run/netns下，例如
[root@docker1 ns]# ln -s /proc/5013/ns/net /var/run/netns/busyboxns
随后就可以模拟进入该ns下查看：
[root@docker1 ns]# ip netns exec busyboxns ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.17.0.2 netmask 255.255.0.0 broadcast 0.0.0.0
ether 02:42:ac:11:00:02 txqueuelen 0 (Ethernet)
RX packets 15 bytes 1222 (1.1 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 7 bytes 574 (574.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
loop txqueuelen 1 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
docker run -itd 方式运行一个带sh的容器后，再次docker attach上去后并exit退出bash，此时这个容器会被stop，用docker exec -it *** sh执行后再退出则不会stop之前运行的容器，因为此时后一个命令，相当于又开了一个新进程，原来运行该容器的进程还活着
docker start命令启动的container，依旧包含有使用run命令时候所带的参数。
映射主机8080到容器的80端口后，iptables变化，可以看到多了一条目的地址/PAT转换的规则，以及多了一条接受目的地址是容器，目的端口是80的接受规则（注意match参数都是tcp）
-A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
控制的是容许从宿主机外部过来的请求，input 接口是非docker0，无此规则的话将只能从宿主机本身发起到容器的访问
[root@docker1 494d881fa57ffb2f1cf77861aa208c22385e9abb43bf03201d41aa6e42167f51]# iptables-save | grep -i docker :DOCKER - [0:0] -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE -A DOCKER -i docker0 -j RETURN -A DOCKER ! -i docker0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.3:80 :DOCKER - [0:0] :DOCKER-ISOLATION - [0:0] -A FORWARD -j DOCKER-ISOLATION -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -o docker0 -j DOCKER -A FORWARD -i docker0 ! -o docker0 -j ACCEPT -A FORWARD -i docker0 -o docker0 -j ACCEPT -A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT -A DOCKER-ISOLATION -j RETURN
Array
