Kwantena mai hanyoyin sadarwa biyu tana zaɓar ƙofar da ba daidai ba

Kwantenanka har yanzu yana amsawa a kan gadar sarrafawa, amma kowane fakiti mai fita yana wucewa ta macvlan na ofis. Babu abin da ya lalace. Haɗi biyu kowanne yana ba da ƙofarsa, kuma hanyar farko ɗaya ta tafi hanyar sadarwar da ba ka nufa ba, don haka sabis ɗin yana ci gaba da aiki yayin da zirga-zirgarsa ke bin hanya mai tsawo. Har sai wani ya lura, shaidar ita ce teburin turawa maimakon saƙon kuskure.

Bayanin da aka saba shine Docker ya zaɓi hanyar sadarwar bisa kuskure. A aikace tsohuwar shawarar tana bin tsarin haruffan sunayen hanyoyin sadarwar da aka haɗa, wanda ya mai da turawa sakamakon wani lakabi. gw_priority yana maye gurbin hakan da lamba da ka zaɓa da gangan, kuma ɗaukar shi yana ɗaukar kusan minti ɗaya da zarar an rubuta tsarin.

Me ya sa hanyar farko take sauka a kan hanyar sadarwar da ba daidai ba

Kowace hanyar sadarwar da sabis ya shiga tana iya bayar da ƙofarta, kuma kwantenan har yanzu yana ƙarewa da hanyar farko guda ɗaya. Kafin Compose 2.33.1 an warware daidaici ta hanyar tsara sunayen hanyoyin sadarwa, don haka lakabi kamar control da ke zuwa gaban office shine yake yanke shawarar inda zirga-zirga zai je. Babu wani abu a cikin kwantenan da ke rubuta cewa shawarar ta kasance ta yadda aka yi, wanda shine dalilin da ya sa take wucewa a duba lambar kuma daga baya ta bayyana a matsayin hanya mai ban mamaki. Sanya manufa a cikin fayil ɗin compose ita ce hanya ɗaya tilo da za a iya duba zaɓin.

Abubuwa biyu ne ke canza wace hanyar sadarwa za ta yi nasara: ƙimar gw_priority da ka ke bayarwa, da kuma waɗanne hanyoyin sadarwa aka haɗa kwata-kwata. Ƙara hanyar sadarwa ta uku kuma saitin ƴan takara yana girma; cire macvlan kuma babu abin da zai fafata da gada. Babu ɗayan waɗannan matakan da ke bayyana a rajistan ayyukan aikace-aikacen, domin hanyar farko mara kyau ba kasafai take katse haɗi gaba ɗaya ba. Tana sa amsoshin su zo daga adireshin da wata ƙila ba ta yi tsammani ba.

Ƙulla ƙofar da gw_priority

Compose yana nuna gw_priority a kowace haɗin sabis-zuwa-hanyar sadarwa tun daga sigar 2.33.1, kuma mafi girman lamba ce ke yin nasara. Babu maɓallin ƙofa ga kowane sabis, don haka ƙimar tana cikin rukunin networks na sabis ɗin. Misalin da ke ƙasa yana ba da hanyar farko ga control yayin da office ke kasancewa ana iya isa gare ta don LAN ɗinta da aka haɗa kai tsaye.

services:
  vpn:
    networks:
      control:
        gw_priority: 1
      office:
        gw_priority: 0

networks:
  control:
    driver: bridge
    ipam:
      config:
        - subnet: 172.30.50.0/24
  office:
    driver: macvlan
    driver_opts:
      parent: eno1.120
      macvlan_mode: bridge
    ipam:
      config:
        - subnet: 192.168.120.0/24
          ip_range: 192.168.120.192/27
          gateway: 192.168.120.1

Karanta rukunin a matsayin sarrafawa biyu daban: gw_priority yana yanke hanyar farko, kuma sashin ipam yana yanke adireshi. Canza subnet kawai yana barin zaɓin fitar ba a taɓa shi ba, kuma wannan ita ce hanyar da aka fi sani da ake aiwatar da wannan gyara rabi. Riƙe fifiko kusa da hanyar sadarwar da suke tafiyar da ita domin mai karatu na gaba kada ya nemi shawarar.

Kada ka rikita gw_priority da sifar priority ta talakawa da ke gefensa. Wannan tana tsara ƙirƙirar haɗi kuma ba ta ce komai game da turawa, don haka ba za ta iya zaɓar ƙofar farko ba kuma ba ta gyara sunayen mu'amala. Idan wani ya ba da shawarar a ƙara priority don tafiyar da zirga-zirga, shawarar ba daidai ba ce koda kuwa tsarin da ya samu ya yi kama da daidai bisa kwatsam.

Tabbatar wace hanyar sadarwa ce ke ɗauke da hanyar farko da gaske

Duba cikin kwantenan da ke gudana, domin teburin turawa na uwar gida yana kwatanta uwar gida ba sararin suna da sabis ɗin ke amfani da shi ba. Fara gudanar da duba saitin farko domin kuskuren rubutu ya karye kafin sake kunnawa, sannan karanta hanyar da kwantenan ya kafa da gaske.

docker compose config --quiet
docker exec vpn ip -4 route show default
docker exec vpn cat /proc/net/route

Sakamako daidai yana ambaton na'urar gada da 172.30.50.1; mara kyau yana ambaton 192.168.120.1 da na'urar macvlan. Idan hoton ba shi da fakitin iproute2, fayil ɗin /proc har yanzu yana ba da rahoton hanyar farko, tare da makoma 00000000 da bytes ɗin ƙofar a juye. Kwatanta ginshiƙin mu'amala da docker inspect idan sunayen na'urorin ba su bayyana ba.

Macvlan tashar jiki ce, ba kwafin gada ba

Macvlan yana ba kwantenan asali na biyu akan waya, kuma wannan shine ainihin abin da ke sa samun na'urorin gida ya yi aiki. Hakanan yana nufin tashar switch da hypervisor dole su karɓi ƙarin adireshin MAC, kuma yawancin hanyoyin sadarwar girgije suna ƙin hakan a hankali. Gwada kwantena ɗaya kafin ka shirya runduna, domin MAC da aka ƙi yakan bayyana a matsayin mahaɗin da ke sama kuma ba ya wuce komai.

Saitin macvlan_mode: bridge yanayi ne na direban macvlan, ba gadar software ta Docker ba, kuma passthru yanayi ne na musamman daban ba tsoho ba. Linux kuma yana hana kwantenan macvlan isa ga uwar gidansa ta hanyar iyaye ɗaya, kuma wannan shine dalilin da ake riƙe gadar sarrafawa maimakon tsammanin haɗi ɗaya zai yi ayyukan biyu.

Ba da sunan iyayen VLAN kafin Compose ya gan shi

Docker yana ɗaukar iyaye mai digo kamar eno1.120 a matsayin ƙaramin mu'amala na 802.1Q kuma yana ƙirƙirar na'urar VLAN da kansa. Wannan sauƙin yana da iyaka: sunan da aka samo ya dogara da sunan mu'amalar jiki, kuma dogayen sunaye na iya tura sakamakon fiye da abin da kayan aikin da ke kewaye suke tsammani. Ƙirƙirar mu'amalar VLAN mai suna a cikin saitin hanyar sadarwar uwar gida da karkatar da parent zuwa gare ta yana kiyaye ƙarshen biyu ana iya hasashe.

Ka tuna cewa maɓallin da ke ƙarƙashin networks sunan Compose ne, ba na'urar Linux ba. Neman uwar gida don mu'amalar da ake kira office zai kasa, domin kernel yana ganin mu'amalar iyaye kawai da kuma veth biyu da ke bayan kwantenan.

Yi wuri ga VPN a sama

Abokin ciniki na VPN yana haɗawa bayan waɗannan hanyoyin sadarwa sun kasance, don haka yana iya ƙara takamaiman hanyoyi, dokokin manufa da matatun ba tare da la'akari da gw_priority ba. Shirya ƙayyadaddun nesa a kan duka ƙananan hanyoyin sadarwa na gida, gami da amsoshin da hanyar sarrafawa ke buƙata. Lokacin da ƙayyadadden nesa ya yi karo da LAN na ofis, gyara shirin adireshi maimakon yanke dukan kewayon sirri daga rami.

Sake duba adireshi, hanyoyi da hanyar sabis bayan VPN ya fara da kuma bayan ya sake haɗawa, domin a lokacin sake haɗawa ne hanyar da aka ƙara da hannu ke ɓacewa. Rubuta teburin da ake tsammani kafin gwajin farko domin kwatancen bayan haka ya zama diff ba motsa jiki na ƙwaƙwalwa ba. Riƙe mallakar hanyar sadarwa na dindindin a cikin Compose kuma bar saitin VPN ya mallaki manufarsa kawai.