QEMU/KVM虚拟机中Docker容器无网络访问问题求助

我租了一台运行Ubuntu 22.04的QEMU/KVM虚拟化服务器，想要在里面运行Docker容器，但遇到了容器无法访问网络的问题。

我执行以下命令启动容器：

host:~# docker run -it ubuntu /bin/bash

进入容器后执行apt-get update，结果因为无法连接Ubuntu软件源而失败，但在宿主机（也就是这个QEMU虚拟机）里ping archive.ubuntu.com是完全正常的。

我已经试过搜索到的「Docker容器内无网络连接」相关方案，也重启过Docker服务，但都没有解决问题。另外硬件防火墙已经关闭，ufw也处于禁用状态。

想请教一下，怎么才能让我的容器连上互联网？

补充信息2（优先级更高） #

看到相关回答后我配置了systemd-networkd，但发现一个奇怪的问题：docker0网卡一开始有172.17.0.1的IP，可启动容器后这个IP就丢失了。只要docker0还保留着IP，就存在这条路由：

172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown

补充信息1 #

我理解QEMU需要把网卡明确连接到物理宿主机的网卡，而Docker会为每个网络创建独立网卡（至少docker0是这样），可能它没连上互联网。假设我的虚拟机里默认网卡是ens6，能不能通过配置iptables把docker0的流量路由到ens6上？

系统信息 #

ip route输出：

default via 87.106.234.1 dev ens6 proto dhcp src [LOCAL_IP] metric 100
87.106.234.1 dev ens6 proto dhcp scope link src [LOCAL_IP] metric 100
212.227.123.16 via 87.106.234.1 dev ens6 proto dhcp src [LOCAL_IP] metric 100
212.227.123.17 via 87.106.234.1 dev ens6 proto dhcp src [LOCAL_IP] metric 100

ifconfig输出：

docker0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 02:42:74:19:f6:1a  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens6: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet [LOCAL_IP]  netmask 255.255.255.255  broadcast 0.0.0.0
        inet6 [LOCAL_IP_V6]  prefixlen 64  scopeid 0x20<link>
        ether 02:01:72:39:35:f9  txqueuelen 1000  (Ethernet)
        RX packets 14885  bytes 164716593 (164.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 11369  bytes 1415635 (1.4 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 184  bytes 19073 (19.0 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 184  bytes 19073 (19.0 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

nft list ruleset输出：

table ip nat {
	chain DOCKER {
		iifname "docker0" counter packets 0 bytes 0 return
	}

	chain POSTROUTING {
		type nat hook postrouting priority srcnat; policy accept;
		oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade
	}

	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		fib daddr type local counter packets 3317 bytes 150836 jump DOCKER
	}

	chain OUTPUT {
		type nat hook output priority -100; policy accept;
		ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
	}
}

table ip filter {
	chain DOCKER {
	}

	chain DOCKER-ISOLATION-STAGE-1 {
		iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2
		counter packets 0 bytes 0 return
	}

	chain DOCKER-ISOLATION-STAGE-2 {
		oifname "docker0" counter packets 0 bytes 0 drop
		counter packets 0 bytes 0 return
	}

	chain FORWARD {
		type filter hook forward priority filter; policy drop;
		counter packets 0 bytes 0 jump DOCKER-USER
		counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-1
		oifname "docker0" ct state related,established counter packets 0 bytes 0 accept
		oifname "docker0" counter packets 0 bytes 0 jump DOCKER
		iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept
		iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
	}

	chain DOCKER-USER {
		counter packets 0 bytes 0 return
	}
}

备注：内容来源于stack exchange，提问作者Eric