Dev Container ba ya isa ga mai masaukin da ake samu ta VPN kawai: inda za a duba

API na sirri yana buɗewa a browser ɗin tebur ɗinka kuma yana kasawa a cikin kwano na ci gaba. Wannan ba sabani ba ne, kuma da wuya VPN ɗin kansa ne sanadin. Buƙatar browser ɗin da buƙatar da ta kasa, ayyuka daban-daban ne suka yi su, da resolver, proxy da hanyoyi daban-daban, kuma sau da yawa daga wuraren suna na cibiyar sadarwa daban-daban gaba ɗaya. “A kan kwamfutar tafi-da-gidanka ta” na iya nufin mai masaukin Windows, rarraba WSL, na'urar kama-da-wane ta Docker Desktop da kwano a cikin wannan VM — mahalli huɗu waɗanda kowanne zai iya amsa sunan mai masauki ɗaya daban. Gano wanne ne aikin da ya kasa ke amfani da shi kafin ka taɓa ko ɗaya saiti.

Gano aikin kafin ka canza saiti

Fara da injin kwano, ba abokin ciniki na VPN ba. Tambaya wane mahalli ne layin umarni yake magana da shi da wace tsarin aiki injin ɗin yake gudana a kai, domin kwano na Linux da VM na tebur ke sarrafawa yana bin wata hanya dabam da wanda daemon na gida ke sarrafawa:

docker context ls
docker info --format '{{.OperatingSystem}} / {{.Name}}'
docker run --rm alpine ip route

A Windows, wsl -l -v yana gaya maka ko rarraba ɗin yana gudana a ƙarƙashin WSL 2, wanda ke ajiye shi a bayan nasa maɓallin kama-da-wane. Wannan dalla-dalla ne ke yanke shawara ko kwano ɗin yana raba teburin hanya na mai masauki ko yana zaune a bayan NAT da ke buƙatar tashar da aka tura gaba ko sunan mai masauki don isa ga mai masaukin.

Riƙe buƙata ɗaya a tsaye ka kwatanta

Zaɓi ƙarshen wuri marar lahani a kan mai masaukin sirri ka yi amfani da shi ga kowace kwatance: daga browser, daga tashar mai masauki, daga rarraba WSL da daga cikin kwano. Rubuta abubuwa huɗu ga kowane ƙoƙari: adireshin da aka warware, ko an yi amfani da proxy, rukunin gazawa da lokacin da ya wuce. Neman suna, kafa haɗi, tabbatar da TLS da matsayin HTTP matsaloli huɗu ne daban-daban, kuma haɗa su cikin “ba ya aiki” yana ɓata safiya.

Gudanar da kwatancen a cikin kwanon da ya kasa, da lokacin ƙarewa don kada bangon wuta marar magana ya riƙe tashar na mintuna. Sabon kwano yana sake haifar da mahallin cibiyar sadarwa na injin, amma ba sararin suna, masu canza proxy ko resolver na kwanon aikace-aikacen ba, don haka docker exec cikin ainihin kwanon shi ne gwajin da ya dace, kuma kwanon gefe hanya ce kawai ta keɓance ko bambancin yana cikin injin ko cikin kwanon:

docker exec -it app /bin/sh -c "getent hosts api.internal; curl -v --max-time 8 https://api.internal/ 2>&1 | tail -20"
docker run --rm --network container:app curlimages/curl:latest -sv --max-time 8 https://api.internal/ 2>&1 | tail -20

Hoton tushe na alpine yana ɗauke da busybox kuma ba shi da curl, kuma irin wannan dalla-dalla ce ke sa kwafin toshe na bincike ya kasa: zaɓi hoto mai abokin ciniki, ko ƙara shi a cikin guda ɗaya. Kwatance da shafukan jama'a marasa alaƙa ba ya keɓance kome. Idan https://example.com yana aiki daga kwanon, ka koyi cewa kwanon yana da hanyar intanet, kuma ba kome game da ko yana iya isa adireshin sirri ta hanyar rami. Hakanan, buɗe sabuwar tasha yana tabbatar da sabuwar tashar tana aiki ne kawai, ba cewa tana raba yanayin gudana da aikace-aikacen da ya kasa ba.

Docker Desktop na iya aiki da VPN

Takin Docker da kansa game da VPN da haɗin mai masauki yana bayyana wannan a matsayin saitin da ake goyan bayansa, kuma taƙaitaccen gaskiya shi ne yana aiki maimakon ya karye kai tsaye. Kada ka ɗauka cewa VM na tebur yana ƙetare ramin mai masauki bisa ƙira; a yawancin saiti zirga-zirga yana bin ramin mai masauki yadda ya kamata, kuma shi ya sa tatsuniya “Docker yana watsi da VPN” ke haifar da shawara mai ƙarfin gwiwa kuma ba daidai ba.

Abin da har yanzu ke da muhimmanci shi ne backend da ake amfani da shi, manufar split-tunnel na abokin ciniki da tsarin resolver da VM ya karɓa. Abokin ciniki na VPN da ke shigar da hanyoyi amma ba DNS ba, ko yana tura uwar garken DNS da VM ba zai iya isa ba, yana haifar da gazawar neman suna a cikin kwanon yayin da mai masaukin ke aiki saboda yana da ƙarin resolver ko amsa da aka adana. Matsalar resolver ce sanye da tufafin kwano. Tana tsira daga kowace sake haɗa VPN da ka gwada, domin ramin yana ɗauke da zirga-zirgar da ka ce ya ɗauka.

Haɗuwar adireshi da MTU gazawa ne daban

Gazawa biyu sun cancanci nasu binciken domin ana ɗauka su manufar shiga ne. Na farko haɗuwar adireshi ne: idan VPN yana tura kewayon da ya yi karo da ƙaramin hanyar gada ta asali na cibiyar sadarwar kwano, hanyar kwanon ga wannan kewayon tana nuni ga gada ta gida kuma ba za ta taɓa isa ramin ba. Duba ainihin ƙananan hanyoyin maimakon yin hasashe:

docker network inspect bridge --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'
ip route get 10.20.30.40

Na biyu matsalar MTU ce. Idan haɗin ya kafa kuma TLS ya cika amma manyan amsoshi sun tsaya, kana da matsalar girman fakiti, ba matsalar izini ba, kuma maye gurbin rikodin DNS ba zai taɓa gyara ta ba. Gwada da ƙaramar buƙata da babba kafin ka canza kome, ka rubuta sakamakon duka.

Maganin haɗuwa ita ce wata ƙaramar hanyar kwano daban ko hanya mai iyaka, wanda mai tsarin adireshin ya zaɓa. Maganin tsayawar MTU shi ne matse ko rage MTU na rami ko mu'amala zuwa ƙimar da za ta tsira a hanya, ana amfani da ita a Layer da kake sarrafawa.

Tsarin proxy na kowane aiki ne, ba na kowace na'ura ba

A cikin kwano, localhost yana nufin mahallin cibiyar sadarwar kwanon kansa, don haka proxy da ke gudana a kan mai masauki ba ya samuwa a can da wannan sunan. Docker Desktop yana ba da host.docker.internal don shiga mai masauki, kuma a Linux kana ƙara shi a fili da --add-host=host.docker.internal:host-gateway. Ko ta yaya, wannan sunan yana ba ka hanya zuwa mai masaukin; ba ya ƙirƙirar sabis ɗin proxy kuma ba ya ba ka izinin amfani da ɗaya.

Yi amfani da adireshin proxy da tashar da aka bayar don ainihin yanayin, ka duba wanda ke karanta su. Masu canji da aka fitar a cikin shell mai mu'amala ba sa saita kowane ƙarin edita, uwar garken harshe, kayan aikin gini da daemon na baya kai tsaye. Wanda ke da muhimmanci shi ne aikin da ya yi buƙatar da ta kasa, don haka duba yanayinsa ba na tasharka ba.

A ƙarshe, bar gyaran ya bayyana kansa. Maganin da ya dace yana ambaton iyakar da ba daidai ba, saitin da ya canza ta, da jerin ayyukan da yanzu ya shafa. Sake kunna VPN, edita da injin a jere na iya canza alamar, amma ba ya barin kome da mutum na gaba zai iya amfani da shi.