Docker容器可以在外部ping，即使它只有一个专用网络

Question

我正在尝试创建一个Vagrant项目：1.一个具有互联网接入(桥接(的VirtualBox VM(Ubonda(，只能与2。2.一个Docker容器(从连接器(，可以与1通信。(桥接(和3。(仅限主机(3.只有2才能访问的Docker(Slave1(容器。

这是我的流浪者文件：

Vagrant.configure("2") do |config|
config.vm.define "ubonda" do |vm0|
vm0.vm.box = "hashicorp/precise64"
vm0.vm.provider "virtualbox"
vm0.vm.network "public_network", ip: "192.168.1.75", bridge: "wlan0"
end
config.vm.define "slave-connector" do |vm1|
vm1.vm.hostname = "slave-connector"
vm1.vm.provider "docker" do |d|
d.build_dir = "."
d.name = 'slave-connector'
end 
vm1.vm.network :public_network, type: "dhcp", bridge: "wlan0", docker_network__ip_range: "192.168.1.252/24"
vm1.vm.network :private_network,ip: "172.20.128.2", netmask: "16"
end
config.vm.define "slave1" do |vm2|
vm2.vm.hostname = "slave1"
vm2.vm.provider "docker" do |d|
d.build_dir = "."
d.name = 'slave1'
end 
vm2.vm.network :private_network,ip: "172.20.128.3", netmask: "16"
end
end

我不知道为什么，但Slave1可以ping Ubonda，即使它没有访问权限！我怎样才能做到这一点？

Answer 1

我认为实现这一点的正确方法是

1. 创建docker网络：

docker network create bridge2 --gateway=192.168.50.1 --subnet=192.168.50.1/24

2. 检查网络id：

docker network ls

3. 放入Vagrantfile：

Vagrant.configure("2") do |config|
config.vm.define "ubonda" do |vm0|
vm0.vm.box = "hashicorp/precise64
vm0.vm.provider "virtualbox"

vm0.vm.network "public_network", ip: "192.168.50.4", bridge: "br-9ed82ac09f1b"
end

config.vm.define "slave-connector" do |vm1|
vm1.vm.hostname = "slave-connector"
vm1.vm.provider "docker" do |d|
d.build_dir = "."
d.name = 'slave-connector'
end 

vm1.vm.network :public_network, ip: "192.168.50.5", bridge: "br-9ed82ac09f1b"
vm1.vm.network :private_network,ip: "50.20.128.2", netmask: "16", , docker_network__internal: true
end

config.vm.define "slave1" do |vm2|
vm2.vm.hostname = "slave1"
vm2.vm.provider "docker" do |d|
d.build_dir = "."
d.name = 'slave1'
end    

vm2.vm.network :private_network,ip: "50.20.128.3", netmask: "16", docker_network__internal: true
end
end