今天使用Dockerfile制作centos的镜像时：

FROM centos
RUN yum install -y net-tools
WORKDIR /home/wwwroot
CMD /bin/bash

然后报错

Loaded plugins: fastestmirror, ovl
Determining fastest mirrors
Could not retrieve mirrorlist http://mirrorlist.centos.org/?release=7&arch=x86_64&repo=os&infra=container error was
14: curl#6 - "Could not resolve host: mirrorlist.centos.org; Unknown error"


 One of the configured repositories failed (Unknown),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:

     1. Contact the upstream for the repository and get them to fix the problem.

     2. Reconfigure the baseurl/etc. for the repository, to point to a working
        upstream. This is most often useful if you are using a newer
        distribution release than is supported by the repository (and the
        packages for the previous distribution release still work).

     3. Run the command with the repository temporarily disabled
            yum --disablerepo=<repoid> ...

     4. Disable the repository permanently, so yum won't use it by default. Yum
        will then just ignore the repository until you permanently enable it
        again or use --enablerepo for temporary usage:

            yum-config-manager --disable <repoid>
        or
            subscription-manager repos --disable=<repoid>

     5. Configure the failing repository to be skipped, if it is unavailable.
        Note that yum will try to contact the repo. when it runs most commands,
        so will have to try and fail each time (and thus. yum will be be much
        slower). If it is a very temporary problem though, this is often a nice
        compromise:

            yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true

Cannot find a valid baseurl for repo: base/7/x86_64

一般来说这是yum源的问题，因为连不上网也就没法更新yum源，只能手动修改配置文件

cd /etc/yum.repos.d/
sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*
sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*
yum makecache

但是仍旧是上面那个错误，于是我在windows的docker执行了上面的命令

[root@a107f0a1563a /]# cd /etc/yum.repos.d/
[root@a107f0a1563a yum.repos.d]# sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*
[root@a107f0a1563a yum.repos.d]# sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*
[root@a107f0a1563a yum.repos.d]# yum makecache
Loaded plugins: fastestmirror, ovl
Loading mirror speeds from cached hostfile
base                                                                                     | 3.6 kB  00:00:00
extras                                                                                   | 2.9 kB  00:00:00
updates                                                                                  | 2.9 kB  00:00:00
(1/10): base/7/x86_64/group_gz                                                           | 153 kB  00:00:01
(2/10): base/7/x86_64/filelists_db                                                       | 7.2 MB  00:00:03
(3/10): base/7/x86_64/other_db                                                           | 2.6 MB  00:00:01
(4/10): base/7/x86_64/primary_db                                                         | 6.1 MB  00:00:02
(5/10): extras/7/x86_64/primary_db                                                       | 253 kB  00:00:02
(6/10): extras/7/x86_64/other_db                                                         | 154 kB  00:00:00
(7/10): extras/7/x86_64/filelists_db                                                     | 305 kB  00:00:02
(8/10): updates/7/x86_64/filelists_db                                                    |  15 MB  00:00:05
(9/10): updates/7/x86_64/other_db                                                        | 1.6 MB  00:00:00
(10/10): updates/7/x86_64/primary_db                                                     |  27 MB  00:00:12
Metadata Cache Created

是成功的，这里是同样的镜像。
最后发现是虚拟机内核没有开启 IPv4 转发功能。

1. Docker 容器的网络原理
   容器的默认网络是通过 docker0 网桥（一般是 172.17.0.1/16）连起来的。
   容器发出去的包会先到达 docker0 网桥 → 走到宿主机的内核网络协议栈。
   如果要访问外网，就需要宿主机把包 转发 (forward) 到它的物理网卡（比如 ens33、eth0）。
2. net.ipv4.ip_forward 的作用
   net.ipv4.ip_forward=0：Linux 内核禁止 IP 转发，包到了宿主机后就被丢弃，容器自然上不了网。
   net.ipv4.ip_forward=1：允许 Linux 把从一个网卡进来的包转发到另一个网卡，这样容器的流量才能通过宿主机的外网卡出网。
3. 结合 iptables NAT
   iptables -t nat 里有 MASQUERADE → 把容器私网地址转换成宿主机地址。
   但是如果没有开启 ip_forward，即使 NAT 规则存在，包也不会被转发出去，等于白配。

经过开启虚拟机转发功能解决

[root@master centosd]sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 0
[root@master centosd]echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
[root@master centosd]sysctl -p
net.ipv4.ip_forward = 1

[root@0b3066ea219f /]# ping www.baidu.com
PING www.a.shifen.com (183.2.172.177) 56(84) bytes of data.
64 bytes from 183.2.172.177 (183.2.172.177): icmp_seq=1 ttl=127 time=5.53 ms
64 bytes from 183.2.172.177 (183.2.172.177): icmp_seq=2 ttl=127 time=6.15 ms
64 bytes from 183.2.172.177 (183.2.172.177): icmp_seq=3 ttl=127 time=5.79 ms
64 bytes from 183.2.172.177 (183.2.172.177): icmp_seq=4 ttl=127 time=6.20 ms
^C