我有一个带有 Linux 的利马虚拟机运行带有内核 6.2 和 cgroupsv2 的 Ubuntu 23.04。该虚拟机旨在充当 docker 主机。当我在此虚拟机中创建 docker 网络时，我在其自己的命名空间中获得一个接口：
$ sudo lsns -t net | grep dockerd
4026532237 net 12 3807 lima unassigned /proc/self/exe --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /usr/bin/dockerd-rootless.sh
$ sudo nsenter -n -t 3807 ip a s br-c6a402bfbc91
4: br-c6a402bfbc91: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:a6:e8:5d:1c brd ff:ff:ff:ff:ff:ff
inet 172.18.0.1/16 brd 172.18.255.255 scope global br-c6a402bfbc91
valid_lft forever preferred_lft forever
inet6 fc00:f853:ccd:e793::1/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::42:a6ff:fee8:5d1c/64 scope link
valid_lft forever preferred_lft forever
inet6 fe80::1/64 scope link
valid_lft forever preferred_lft forever
172.18.0.0/16我已经可以从网络上的 VM 容器 ping 通了
$ ping 172.18.1.1
PING 172.18.1.1 (172.18.1.1) 56(84) bytes of data.
64 bytes from 172.18.1.1: icmp_seq=2 ttl=64 time=0.166 ms
64 bytes from 172.18.1.1: icmp_seq=4 ttl=64 time=0.177 ms
但我不能在那里卷曲任何东西
$ curl -v 172.18.1.1
* Trying 172.18.1.1:80...
$ docker ps --filter name=lima-control-plane
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
fc12c34dff80 kindest/node:v1.27.1 "/usr/local/bin/entr…" About an hour ago Up About an hour 127.0.0.1:63869->6443/tcp lima-control-plane
$ docker exec -it lima-control-plane curl 172.18.1.1
{
"message":"no Route matched with those values"
}
除非我使用前面提到的命名空间：
$ sudo nsenter -n -t 3807 curl 172.18.1.1
{
"message":"no Route matched with those values"
}
可能我的 iptables 出了问题，但我不知道是什么：
$ sudo iptables -n -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
348 22152 DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0
348 22152 DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
348 22152 ACCEPT all -- lima0 * 192.168.105.1 172.18.0.0/16
0 0 ACCEPT all -- * * 172.18.0.0/16 192.168.105.1
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain DOCKER (1 references)
pkts bytes target prot opt in out source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-ISOLATION-STAGE-2 all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
778 49492 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
778 49492 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
$ ip r
default via 192.168.5.3 dev eth0 proto dhcp src 192.168.5.15 metric 100
default via 192.168.105.1 dev lima0 proto dhcp src 192.168.105.4 metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
192.168.5.0/24 dev eth0 proto kernel scope link src 192.168.5.15 metric 100
192.168.5.3 dev eth0 proto dhcp scope link src 192.168.5.15 metric 100
192.168.105.0/24 dev lima0 proto kernel scope link src 192.168.105.4 metric 100
192.168.105.1 dev lima0 proto dhcp scope link src 192.168.105.4 metric 100
$ sudo nsenter -n -t 3807 iptables -n -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * br-c6a402bfbc91 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all -- * br-c6a402bfbc91 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- br-c6a402bfbc91 !br-c6a402bfbc91 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- br-c6a402bfbc91 br-c6a402bfbc91 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lima0 * 192.168.105.1 172.18.0.0/16
0 0 ACCEPT all -- lima0 * 192.168.105.1 172.18.0.0/16
0 0 ACCEPT all -- lima0 * 172.18.0.0/16 192.168.105.1
0 0 ACCEPT all -- * lima0 172.18.0.0/16 192.168.105.1
0 0 ACCEPT all -- * * 172.18.0.0/16 192.168.105.1
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- !br-c6a402bfbc91 br-c6a402bfbc91 0.0.0.0/0 172.18.0.2 tcp dpt:6443
0 0 ACCEPT tcp -- !br-c6a402bfbc91 br-c6a402bfbc91 0.0.0.0/0 172.18.0.4 tcp dpt:5000
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-ISOLATION-STAGE-2 all -- br-c6a402bfbc91 !br-c6a402bfbc91 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-ISOLATION-STAGE-2 all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * br-c6a402bfbc91 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
$ sudo nsenter -n -t 3807 ip r
default via 10.0.2.2 dev tap0
10.0.2.0/24 dev tap0 proto kernel scope link src 10.0.2.100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
172.18.0.0/16 dev br-c6a402bfbc91 proto kernel scope link src 172.18.0.1
有趣的是它sudo ip netns list不会返回任何东西。不确定这与通过 . 返回的命名空间有什么关系lsns。
编辑: 显然已经安装了docker无根模式正是上述原因。