为何自定义Docker Bridge网络网关IP无法从Linux主机访问？

环境与操作背景 #

• 本地系统：Linux
• 操作：搭建Docker MySQL容器，容器内初始化数据库后，本地测试连接
• 现象：docker-compose创建的自定义bridge网络integration_default的网关IP（172.27.0.1）无法访问，默认bridge网络网关（172.17.0.1）可正常ping通
• 临时解决：指定network_mode: bridge使用默认bridge网络后可正常访问，想了解原因

相关配置与网络信息 #

docker-compose.yaml配置 #

version: "3.4"

services:
  integration-test-mysql:
    image: mysql:8.0
    container_name: ${MY_SQL_CONTAINER_NAME}
    environment:
      - MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD
    ports:
      - "3306:3306"
    volumes:
      # - ./src/db:/usr/src/db #Mount db folder so we can run seed files etc.
      - ./seed.sql:/docker-entrypoint-initdb.d/seed.sql
    network_mode: bridge
    healthcheck:
      test: "mysqladmin -u root -p$MYSQL_ROOT_PASSWORD -h 127.0.0.1 ping --silent 2> /dev/null || exit 1" 
      interval: 5s
      timeout: 30s
      retries: 5
      start_period: 10s 
    entrypoint: sh -c "
      echo 'CREATE SCHEMA IF NOT EXISTS gigs;' > /docker-entrypoint-initdb.d/init.sql;
      /usr/local/bin/docker-entrypoint.sh --default-authentication-plugin=mysql_native_password
      "

网络列表（docker network ls输出） #

docker network ls
NETWORK ID     NAME                  DRIVER    SCOPE
42a11ef835dd   bridge                bridge    local
c7453acfbc98   host                  host      local
48572c69755a   integration_default   bridge    local
bd470f8620fd   none                  null      local

自定义网络integration_default详情（docker network inspect integration_default输出） #

[
    {
        "Name": "integration_default",
        "Id": "48572c69755ae1bbc1448ab203a01d81be4300da12c97a9c4f1142872b878387",
        "Created": "2022-09-28T00:48:20.504251612Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.27.0.0/16",
                    "Gateway": "172.27.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "79e897decb4f0ae5836c018d82e78997e8ac2f615b399362a307cc7f585c0875": {
                "Name": "integration-test-mysql-host",
                "EndpointID": "1f7798554029cc2d07f7ba44d057c489b678eac918f7916029798b42585eda41",
                "MacAddress": "02:42:ac:1b:00:02",
                "IPv4Address": "172.27.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {},
        "Labels": {
            "com.docker.compose.network": "default",
            "com.docker.compose.project": "integration",
            "com.docker.compose.version": "2.7.0"
        }
    }
]

默认bridge网络详情（docker inspect bridge输出） #

[
    {
        "Name": "bridge",
        "Id": "42a11ef835dd1b2aec3ecea57211bb2753e0ebd4a2a115ace8b7df3075e97d5a",
        "Created": "2022-09-27T21:54:44.239215269Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {
            "com.docker.compose.network.bridge.default_bridge": "true",
            "com.docker.compose.network.bridge.enable_icc": "true",
            "com.docker.compose.network.bridge.enable_ip_masquerade": "true",
            "com.docker.compose.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.compose.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

原因分析 #

自定义bridge网络和默认bridge网络的核心差异在于网关的绑定行为：

1. 默认bridge网络的网关绑定到主机可见虚拟网卡
   默认bridge网络的网关（172.17.0.1）绑定在主机的docker0虚拟网卡上，该网卡直接接入主机网络栈，因此主机可以直接ping通这个网关IP。从默认网络的Options配置里的com.docker.network.bridge.name: docker0也能验证这一点。

2. 自定义bridge网络的网关仅存在于Docker内部网络栈
   自定义bridge网络的网关（172.27.0.1）并未绑定到主机的任何可见网卡，它只是Docker为该网络创建的内部虚拟网关，仅用于容器间通信和容器对外的NAT转发。主机网络栈无法直接访问这个内部网关IP，所以ping操作无响应。

需要注意的是，自定义网络网关无法ping通并不影响容器正常使用：

• 容器之间可通过自定义网络正常通信
• 主机访问容器依然可以通过ports映射的端口（比如示例中的3306端口）连接，无需直接访问网关IP。

你切换到默认网络后能访问网关，本质是因为默认网络的网关绑定到了主机可见的docker0网卡上。

内容的提问来源于stack exchange，提问作者Sean