我正在清除 /etc/resolv.conf 以禁用网络:
sudo mv /etc/resolv.conf /etc/resolv_backup.conf
sudo touch /etc/resolv.conf
然后启用网络:
sudo mv /etc/resolv_backup.conf /etc/resolv.conf
但是资源繁忙,我无法执行这些命令。
我想从容器内禁用互联网而不使用:
docker 网络断开连接 [选项] 网络容器
从部署容器的服务器执行此操作。 我正在使用 Alpine。
在容器内部,通常禁止您更改网络状态:
$ docker run -it --rm alpine:latest /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
929: eth0@if930: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP
link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
/ # ip link set eth0 down
ip: ioctl 0x8914 failed: Operation not permitted
出于安全考虑,这是有意为之,以防止应用程序逃离容器沙箱。 如果您不需要容器的安全性(因此我建议不要这样做),您可以使用额外的网络功能来运行容器:
$ docker run -it --rm --cap-add NET_ADMIN alpine:latest /bin/sh
/ # netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 172.17.0.1 0.0.0.0 UG 0 0 0 eth0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
933: eth0@if934: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP
link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
/ # ip link set eth0 down
/ # ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
ping: sendto: Network unreachable
当您尝试恢复网络时,您还需要再次设置默认路由才能连接到外部网络:
/ # ip link set eth0 up
/ # ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
ping: sendto: Network unreachable
/ # netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
/ # route add default gw 172.17.0.1
/ # ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=58 time=12.518 ms
64 bytes from 8.8.8.8: seq=1 ttl=58 time=11.481 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 11.481/11.999/12.518 ms
首先,清除 resolv.conf 并不是禁用容器网络的正确方法。这只是避免了名称解析,但您仍然可以使用 IP 连接。
要禁用网络,您应该使用正确的脚本,具体取决于您使用的是 systemd 还是 sysV。与此类似的东西应该可以工作(这取决于您的发行版):
# /etc/init.d/networking stop
# systemctl stop networking
希望这有帮助! :-)
受到@BMitch答案的启发,但由于我没有
route
命令,即使我从 net-tools-deprecated
包安装它,它也会给我一个错误,然后我做了一个 DisconnectReconnectNetwork.sh
脚本来执行此操作:
#!/bin/bash
DEFAULT_VIA=$(ip r | grep "default via")
ip link set eth0 down
ip link set eth0 up
# Disable https://www.shellcheck.net/wiki/SC2086 (double quote to prevent globbing and word splitting)
# for DEFAULT_VIA since else it is not taken properly by ip route add
# shellcheck disable=SC2086
ip route add ${DEFAULT_VIA}
注意@BMitch答案中提到的,您必须在
--cap-add NET_ADMIN
命令中使用docker run
,或者如果在docker compose中,请添加到您的服务:
cap_add:
- NET_ADMIN