Trafik din kwantena na Docker yana wuce VPN na host: yadda za a duba
VPN na host yana rufe sararin suna na host kawai. Yi amfani da wadannan duba don gano ko trafik din kwantena a kan gada yana shiga cikin rami ko yana fita kai tsaye.
Burawsan ka a kan host yana nuna adireshin fita na VPN, kwantenan yana ba da labarin hadin gidanka, sai wani ya kira hakan yabo. Babu abin da ya yabo. Ramin host tarin mashigai ne, hanyoyi da ka'idoji da suka mallaki sararin suna na cibiyar sadarwar host, kuma kwantena a kan gada wani sararin suna ne daban da nasa hanyar da aka saba. Na zauna a kan tarin Compose inda abokin ciniki na VPN ya kasance a hade shekaru da yawa kuma babu ko daya fakiti na kwantena da ya taba shiga ciki.
Duba sararin suna kafin gunkin tray
Sararin suna ne dukan hujja. Lokacin da Docker ya fara kwantena a kan cibiyar sadarwar gada, yana kirkiro sararin suna na cibiyar sadarwa, yana hada karshen daya na veth biyu a ciki, kuma yana ba da adireshi da hanyar da aka saba ga wannan sararin suna. Mashigin ramin, ko yaya ake kiransa, yana rayuwa a cikin sararin suna na host. Trafik din da ke cikin kwantenan ba zai iya ganinsa ba, kuma babu wani saitin abokin ciniki da zai canja hakan daga waje.
Akwai hanyoyi biyu da ake tallafawa da za su fitar da kai daga kebewa. --network host yana sanya kwantenan cikin sararin suna na host, don haka yana gado hanyoyin host kuma saboda haka ramin. --network container:vpn yana raba sararin suna na wani kwantena, kuma haka yawancin tsarin sidecar suke aika aikin ta cikin kwantenan VPN. Dukansu zabubbuka ne bayyanannu; yawanci daya ne kawai daga cikinsu abin da mutumin da ke turawa ya nufa.
Yanayin host ba ingantawa ce ta kyauta ba. Kwantenan ya daina samun adireshinsa, buga tashar jiragen ruwa ya daina aiki, kuma tsari da ke rike NET_ADMIN a can zai iya sake rubuta hanyoyin host. Karbar hakan na iya zama shawara daidai. Tsammanin an riga an kunna shi shine yadda mutane suke kashe maraice suna gyara ramin da bai taba kasancewa a hanya ba.
Bi fakiti daga gada
Kwantena a kan gada yana aika fakitinsa zuwa kofarsa ta al'ada, wadda ita ce mashigin gada a kan host. Sannan host yana tura fakitin kuma, a cikin tsarin da aka saba, yana fassara adireshin tushe zuwa nasa kafin fakitin ya fita. Wannan matakin fassara ne yake karya manufa a hankali.
Lokacin da fakitin ya isa karshen ramin yana dauke da adireshin host. Duk wata ka'ida, hanyar manufa ko shawarar rami da aka raba da ta dogara da ainihin adireshin kwantenan ta daina dacewa, kuma kwantena biyu da aka nufa su fita ta hanyoyi daban-daban ba za a iya bambanta su da tushe kawai ba. Idan kana bukatar turawa ga kowane kwantena, shawarar dole ta faru kafin fassarar ko cikin sararin suna da kake sarrafawa.
Docker yana kula da wadannan ka'idoji da kansa, ta kowace hanya ta bango da aka saita daemon da ita. Ka'idojin da aka rubuta da hannu a wajen kugiya da ake tallafawa don trafik da ake turawa, DOCKER-USER, ana iya sake tsara su ko a watsar da su lokacin da daemon ya sake farawa ko host ya inganta. takardun Docker kan tacewar fakiti yana nuna tsarin sarkoki; batun aiki shi ne kowane ka'ida na bukatar mai shi da hanyar sake lodawa da ka gwada da gaske.
Gwada tsarin biyu daban
Shaida daga sararin suna daya ba ta fadi komai game da dayan ba. Bukatar da aka gudanar cikin kwantenan VPN tana tabbatar da ramin yana aiki ga wannan kwantenan. Ba shaida ba ce game da host, kuma wannan umarnin da aka gudanar daga kwantenan --network host ba shaida ba ce game da gada.
# host namespace
ip route get 1.1.1.1
ip -brief addr show
# a fresh container on the same bridge network
docker run --rm --network appnet alpine sh -c 'ip route; cat /etc/resolv.conf; ip -6 route'Sannan sake maimaita gwajin cikin ainihin kwantenan aikace-aikacen maimakon wani hoto mai kama. Aikace-aikacen na iya dauke da karin hanya, canjin yanayi na wakili ko wani mai warwarewa daban, kuma kowanne daga cikinsu yana canja amsar. Duba warware sunaye da rukunin adireshi na biyu kowane lokaci: kwantena a kan gadoji da mai amfani ya ayyana ana warware su ta hanyar mai warwarewar Docker da ke 127.0.0.11, kuma hanyar da aka saba ta IPv6 a kan gada na iya fitar da trafik yayin da kake shagaltu da gwada ramin IPv4 kawai.
Karanta tsarin kafin ka taba takardun shaida
Lokacin da host yana aiki kuma kwantenan ba ya aiki, sanadin kusan koyaushe tsari ne, kuma juya maballai ko sake shigar da abokin ciniki yana bata rana. Fara jera alamar sannan gyaran yakan ambaci kansa.
| What you see | Usual cause | First check |
|---|---|---|
| Host exits through the VPN, container shows the ISP address | The container never entered the tunnel | Default route inside the container |
| Container works until the daemon restarts, then stops | Rules outside the supported hook, or a changed backend | Daemon's reported firewall backend and DOCKER-USER |
| Container loses internal hosts after the tunnel comes up | VPN prefix overlaps the Docker bridge subnet | ip route on the host, then docker network inspect |
| Small replies arrive, large ones hang | Tunnel MTU or missing MSS clamping | Link MTU on both ends of the tunnel |
| Container falls back to the ISP address when the tunnel drops | Nothing enforces the kill switch for forwarded traffic | Stop the tunnel with a request in flight |
Layin haduwa ya cancanci jumla ta kansa. Bayanin VPN da ke tura hanya don 172.17.0.0/16, ko don 10.0.0.0/8 wanda ya hada da prefix din gadarka kwatsam, yana sa ramin ya yi da'awar rukunin kwantenan, kuma amsoshin da za su je adiresoshin da aka fassara za su tafi wajen da ba daidai ba ko su bace. Sake lambar cibiyar sadarwar Docker yawanci ya fi tsafta fiye da tara keɓe.
Sanya daukar hoto a bayyane, sannan ka karya shi da gangan
Tsare-tsare biyu suna tsayawa a duba. Raba sararin suna na kwantenan VPN kuma kowane aikin da aka rufe yana amfani da rami daya tare da iyakar sake farawa daya, wanda yake da sauki har sai wata hidima tana bukatar wata hanyar fita ko nata hanyar DNS. Ko kuma tura cibiyar sadarwar kwantena zuwa kofar VPN a kan host: an kunna turawa, prefix din gada an nuna shi ga ramin, trafik din dawowa an kula da shi a bayyane. Wannan yana sayan sarrafawa ga kowace cibiyar sadarwa kuma yana kashe maka tarin ka'idoji da za ka kula da su a tsawon ingantawa na daemon da abokin ciniki.
Ko ta yaya, gwajin da ke da muhimmanci shine yanayin gazawa. Dakatar da ramin tare da bukatar kwantenan a cikin jirgi ka duba inda fakitin yake zuwa. Idan ya koma hanyar kai tsaye, ba a taba aiwatar da daukar hoto ba, domin kill switch na abokin ciniki yana sarrafa trafik din abokin ciniki da kansa ba fakiti da ake turawa daga gada ba. Sannan sake farawa daemon da host ka tabbatar da sakamakon a karo na biyu; wannan shine lokacin da ka'idojin da aka rubuta da hannu suke bacewa.
Kafin ka kira shi an gama, tabbatar da abubuwa hudu: mashigin ramin yana cikin sararin suna daya da trafik din, an gudanar da gwajin kwantenan cikin ainihin kwantenan, an duba warware sunaye da duka rukunin adireshi biyu, kuma gwajin gazawar ramin har yanzu yana gazawa a rufe. Sannan rubuta hanyar bango, sigar abokin ciniki da mai kowace ka'ida. Wannan rikodin ne ke hana ingantawa ta gaba barin cakuda marar takardu na tsoffin zato a wurin.