Dockerコンテナに外部ネットワークからアクセスできるように環境構築しました(CentOS7)

yum -y install docker net-tools                                  # dockerとnet-toolsのインストール
systemctl start docker                                           # dockerの起動
systemctl enable docker                                          # サーバー再起動時のdockerの自動起動設定
docker pull centos:centos7                                       # docker hubからcentos7をダウンロード
docker run --privileged -d --name TEST centos:centos7 /sbin/init # コンテナ起動
docker exec -it TEST /bin/bash                                   # コンテナにログイン

service docker stop               # Dockerを停止
ip link set dev docker0 down      # Dcokerが生成していたdocker0のinterfaceをdownさせる
brctl delbr docker0               # docker0のinterfaceを削除

 vi /etc/sysconfig/network-scripts/ifcfg-br0
 
 [root@server ~]# cat /etc/sysconfig/network-scripts/ifcfg-br0 
 DEVICE=br0
 TYPE=Bridge
 BOOTPROTO=static
 IPADDR=192.168.1.2
 NETMASK=255.255.255.0
 NETWORK=192.168.1.0
 BROADCAST=192.168.1.255
 DELAY=0
 DNS1=192.168.1.1
 GATEWAY=192.168.1.1
 ONBOOT=yes

 vi /etc/sysconfig/network-scripts/ifcfg-enp3s0f0
 
 [root@server ~]# cat /etc/sysconfig/network-scripts/ifcfg-enp3s0f0
 DEVICE="enp3s0f0"
 BOOTPROTO=none
 NM_CONTROLLED="yes"
 ONBOOT="yes"
 TYPE="Ethernet"
 BRIDGE=br0　#ここが物理ポートと関連付けの設定

[root@server ~]# /etc/rc.d/init.d/network restart
Restarting network (via systemctl):                        [  OK  ]

vi  /etc/sysconfig/iptables
-I FORWARD -m physdev --physdev-is-bridged -j ACCEPT 

[root@server ~]# systemctl restart iptables.service

[root@server ~]# echo 'DOCKER_OPTS="-b=br0"' >> /etc/sysconfig/docker-network

[root@server ]# cat /etc/sysconfig/docker-network 
# /etc/sysconfig/docker-network
DOCKER_NETWORK_OPTIONS="-b=br0"

[root@server ~]# cat /root/script/run_docker.sh
#!/bin/bash

usage() {
  echo "usage : $0 [-d] | [-a address] IMAGE NAME" 1>&2
  exit 1
}

while getopts da:h OPT
do
  case $OPT in
    d) DHCP_FLG="true"
       ;;
    a) ADDRESS_FLG="true"
       ADDRESS="$OPTARG"
       ;;
    h) usage
       ;;
    \?) usage
       ;;
  esac
done
shift $(($OPTIND -1))

if [ $# -lt 2 ]; then
  usage
fi

if [ "$ADDRESS_FLG" = "true" ] && [ -z "$ADDRESS" ]; then
  echo specify address
  exit 1
fi

# run docker container from image and get container id
CONTAINER_ID=`docker run -d --privileged --hostname=$2 --name=$2 $1 /sbin/init`
#docker start $CONTAINER_ID

if [ $? -eq 1 ]; then
  exit 1
fi

# get docker pid, ip address (allocated by docker)
PID=`docker inspect --format '{{.State.Pid}}' $CONTAINER_ID`
IPADDR=`docker inspect --format '{{.NetworkSettings.IPAddress}}' $CONTAINER_ID`
IPSUB=`docker inspect --format '{{.NetworkSettings.IPPrefixLen}}' $CONTAINER_ID`

echo -------------------------------------
echo Container ID  : $CONTAINER_ID
echo Container PID : $PID
echo Allocated IP  : $IPADDR/$IPSUB
echo -------------------------------------

# del allocated ip address
nsenter -t $PID -n ip addr del $IPADDR/$IPSUB dev eth0

if [ "$ADDRESS_FLG" = "true" ]; then
  echo set address $ADDRESS
  nsenter -t $PID -n ip addr add $ADDRESS dev eth0
elif [ "$DHCP_FLG" = "true" ]; then
  # get ip address from dhcp
  echo set address from dhcp
  nsenter -t $PID -n -- dhclient eth0
  dhclient -r
fi

# reset default gateway address
nsenter -t $PID -n route add default gw 192.168.1.1 eth0
nsenter -t $PID -n route del -net 192.168.1.0 netmask 255.255.255.0

# print ip addr
nsenter -t $PID -n ip addr

[root@server ~]# docker images
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
docker.io/centos         centos7             1e1148e4cc2c        2 months ago        202 MB

[root@server ~]#  sh /root/script/run_docker.sh -a 192.168.1.10/24 docker.io/centos:centos7 docker-test

[root@server ~]# docker ps -a
CONTAINER ID        IMAGE                          COMMAND             CREATED             STATUS                     PORTS               NAMES
e333b8a9e27c        docker.io/centos:centos7   "/sbin/init"        2 minutes ago       Up 2 minutes                                   docker-test

[root@server ~]# docker exec -it docker-test /bin/bash
[root@docker-test /]# 

[root@docker-test /]# ping 172.16.0.1
PING 172.16.0.1 (172.16.0.1) 56(84) bytes of data.
64 bytes from 172.16.0.1: icmp_seq=1 ttl=253 time=0.802 ms
64 bytes from 172.16.0.1: icmp_seq=2 ttl=253 time=0.855 ms
64 bytes from 172.16.0.1: icmp_seq=3 ttl=253 time=0.868 ms
64 bytes from 172.16.0.1: icmp_seq=4 ttl=253 time=0.778 ms
^C
--- 172.16.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3000ms
rtt min/avg/max/mdev = 0.778/0.825/0.868/0.051 ms
[root@docker-test /]# 

L3SW#ping 192.168.1.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/8 ms
L3SW#