如何在Docker中使用venet0的两个不同IPv4地址？

我在Ubuntu服务器VPS上运行Docker容器，服务器的venet0接口有两个外部IPv4地址，对应子接口venet0:0和venet0:1。想让每个Docker容器使用不同的venet子接口，让容器的进出流量分别对应不同的IPv4地址，请问是否可行？

系统网络信息 #

ifconfig 输出 #

docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
ether 02:42:6e:1b:78:dd  txqueuelen 0  (Ethernet)
RX packets 300  bytes 40314 (40.3 KB)
RX errors 0  dropped 0  overruns 0  frame 0
TX packets 279  bytes 155791 (155.7 KB)
TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
inet 127.0.0.1  netmask 255.0.0.0
loop  txqueuelen 1000  (Local Loopback)
RX packets 0  bytes 0 (0.0 B)
RX errors 0  dropped 0  overruns 0  frame 0
TX packets 0  bytes 0 (0.0 B)
TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

venet0: flags=211<UP,BROADCAST,POINTOPOINT,RUNNING,NOARP>  mtu 1500
inet 127.0.0.1  netmask 255.255.255.255  broadcast 0.0.0.0  destination 127.0.0.1
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 0  (UNSPEC)
RX packets 2535  bytes 280255 (280.2 KB)
RX errors 0  dropped 0  overruns 0  frame 0
TX packets 3514  bytes 368638 (368.6 KB)
TX errors 0  dropped 1 overruns 0  carrier 0  collisions 0

venet0:0: flags=211<UP,BROADCAST,POINTOPOINT,RUNNING,NOARP>  mtu 1500
inet xx.xx.xx.xx  netmask 255.255.255.0  broadcast xx.xx.xx.xx  destination xx.xx.xx.xx
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 0  (UNSPEC)

venet0:1: flags=211<UP,BROADCAST,POINTOPOINT,RUNNING,NOARP>  mtu 1500
inet xx.yy.yy.yy  netmask 255.255.255.0  broadcast xx.yy.yy.yy  destination xx.yy.yy.yy
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 0  (UNSPEC)

veth3e60e5d: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
ether fe:73:1e:7d:30:0a  txqueuelen 0  (Ethernet)
RX packets 0  bytes 0 (0.0 B)
RX errors 0  dropped 0  overruns 0  frame 0
TX packets 6  bytes 252 (252.0 B)
TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth83488a2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
ether 0e:11:e7:a6:8d:47  txqueuelen 0  (Ethernet)
RX packets 300  bytes 44514 (44.5 KB)
RX errors 0  dropped 0  overruns 0  frame 0
TX packets 279  bytes 155791 (155.7 KB)
TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ip link 输出 #

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 
2: venet0: <BROADCAST,POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state
UNKNOWN mode DEFAULT group default
link/void 
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
link/ether 02:42:6e:1b:78:dd brd ff:ff:ff:ff:ff:ff 
5: veth3e60e5d@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc
noqueue master docker0 state UP mode DEFAULT group default
link/ether fe:73:1e:7d:30:0a brd ff:ff:ff:ff:ff:ff link-netnsid 0 
7: veth83488a2@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc
noqueue master docker0 state UP mode DEFAULT group default
link/ether 0e:11:e7:a6:8d:47 brd ff:ff:ff:ff:ff:ff link-netnsid 1

完全可行，以下是两种常用实现方式：

方法一：绑定宿主机IP启动容器 #

启动容器时通过--publish参数指定绑定的宿主机IP（即venet子接口的IP），容器对外流量会自动使用该IP作为源地址。

示例：

• 让容器A使用venet0:0的IP（xx.xx.xx.xx）对外提供服务：

docker run -d --name containerA -p xx.xx.xx.xx:80:80 nginx

• 让容器B使用venet0:1的IP（xx.yy.yy.yy）对外提供服务：

docker run -d --name containerB -p xx.yy.yy.yy:80:80 nginx

这种方式适合需要对外暴露端口的场景，无需额外配置路由规则。

方法二：配置iptables规则强制流量走指定IP #

如果容器不需要对外暴露端口，但需要所有出站流量都使用指定的venet子接口IP，可以通过添加iptables规则实现。

步骤1：获取容器内部IP #

启动容器后，执行以下命令查看容器的内部IP：

docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' container_name

假设容器A的内部IP是172.17.0.2，容器B是172.17.0.3。

步骤2：添加SNAT规则 #

为每个容器的出站流量指定源IP：

• 针对容器A（172.17.0.2），强制使用xx.xx.xx.xx：

iptables -t nat -A POSTROUTING -s 172.17.0.2 -o venet0 -j SNAT --to-source xx.xx.xx.xx

• 针对容器B（172.17.0.3），强制使用xx.yy.yy.yy：

iptables -t nat -A POSTROUTING -s 172.17.0.3 -o venet0 -j SNAT --to-source xx.yy.yy.yy

步骤3：保存规则确保重启生效 #

执行以下命令保存iptables规则：

iptables-save > /etc/iptables/rules.v4

如果未安装iptables-persistent，先安装：

apt-get install iptables-persistent

验证方式 #

进入容器执行curl ifconfig.me，查看返回的IP是否为预期的venet子接口IP，即可验证流量路由是否正确。

内容的提问来源于stack exchange，提问作者amstel