Gyara zirga-zirgar Docker da WSL da ke watsi da VPN na host

Na shafe mafi yawan safiya a wannan bazara ina bin kwantena da ya kasa warware ko ɗaya sunan ciki yayin da burauzar da ke gefensa tana buɗe wiki ba tare da korafi ba. Ramin yana sama, burauzar ta tabbatar da haka, kuma kwantenan yana wani filin suna na cibiyar sadarwa dabam da wani teburin hanya dabam da wani mai warwarewa dabam. Abin da ke gaba shi ne tsari da nake duba yanzu: farko teburan hanya, na biyu warwarewa, na uku turawa, kuma a ƙarshe dandalin host. Tsaya a matakin farko da ya riga ya gaza, domin ƙara dokoki a ƙasan tari yana ɓoye iyaka maimakon matsar da ita.

Kwatanta teburan hanya guda uku kafin ka canza doka

Kwantenan da ke kan gadar Docker ta tsohuwa yana da hanyar tsohuwa ɗaya da ke nuni ga ƙofar docker0, kuma ba ya san tun0 yana wanzuwa. Host ɗin yana da tun0, hanyoyin da VPN ya tura, da wataƙila dokar manufa da ke aika zirga-zirgar gwaji ta wata maƙalar daban fiye da yadda kake tsammani. WSL yana ƙara tebur na uku a bayan na'urar sa ta kirkira. Buga duka uku kafin ka gyara ɗayansu.

Idan hanyar kwantenan ita kaɗai ita ce gada kuma tun0 ba ya bayyana a filin sunansa, babu abin da ke ƙasa da zai taimaka: babu canjin uwar garken suna da ke ƙirƙirar hanya, kuma babu hanyar da ke ƙirƙirar asalin rami da abokin zai karɓa. Tsari yana da muhimmanci domin gazawar DNS da gazawar hanya suna kama da juna daga cikin harsashi.

Juya mai warwarewa zuwa ramin maimakon na jama'a

A kan host, resolvectl status yana lissafa uwar garken DNS kowace hanyar sadarwa, kuma readlink -f /etc/resolv.conf yana gaya maka ko fayil ɗin stub ne na systemd, fayil na NetworkManager, ko wani abu da abokin ciniki na mai sayarwa ya sake rubutawa. A cikin kwantena a kan cibiyar sadarwar da mai amfani ya ayyana, /etc/resolv.conf yana suna 127.0.0.11, mai warwarewar Docker da ke ciki, wanda ke turawa zuwa duk wani sama da aka saita daemon da shi. Kwantenan da ke kan gadar tsohuwa kuwa ya sami kwafin fayil ɗin host lokacin da aka ƙirƙira shi, kuma yana riƙe da shi.

Wannan kwafin shi ne dalilin da ya sa rami da ya tashi bayan kwantenan ya fara yana barin kwantenan yana tambayar tsohon sama. Ko ka ba da mai warwarewar VPN a fili tare da docker run --dns 10.8.0.53, ko ka saita "dns": ["10.8.0.53"] a cikin /etc/docker/daemon.json ka sake kunna daemon, ko ka sake ƙirƙirar kwantenan da zarar ramin ya tashi. Sake ƙirƙirar yawanci ya fi sauƙi fiye da gyara mai warwarewa da ya kasance daidai awa ɗaya da ta wuce.

Saka mai warwarewa na jama'a shi ne gyaran da ke riƙe da alamar. Yana warware intanet kuma yana gaza a kowane yanki na sirri, kuma yana iya wuce tacewar da ramin ya wanzu don tilasta shi a hankali. Idan ka gwada rubuta cikin /etc/resolv.conf na kwantenan da ke gudana, sai ka yi tsammanin Device or resource busy: Docker yana bind-mount ɗin wannan fayil, don haka gyaran yana buƙatar unmount da farko. Saita --dns lokacin ƙirƙira ita ce jerin da ke tsira daga sake kunnawa.

Tura kuma fassara lokacin da kwantena suka ari ramin

Tare da gadar tsohuwa, host ɗin mai turawa ne tsakanin docker0 da tun0, kuma a tsohuwa ba ya yin ɗaya daga cikin ayyukan biyu. Kunna turawa, ka fassara adireshin tushe domin abokin ya ga adireshin ramin host maimakon wanda ba shi da hanyar dawowa zuwa gare shi (maye gurbin tun0 da abin da abokin cinikinka ya kira maƙala):

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -A FORWARD -i docker0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o docker0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Dokokin FORWARD suna da muhimmanci a kan host ɗin da manufar turawarsu DROP ce. Docker yana saka nasa sarƙoƙi, don haka gwada da fakiti maimakon karanta iptables -S: daga kwantenan, ip route get 10.8.0.20 ya kamata ya ambaci ƙofar gada, kuma nc -vz 10.8.0.20 443 ya kamata ya haɗa ko ya ƙare lokaci a ramin maimakon a mai warwarewa.

Ba tare da MASQUERADE abokin yana buƙatar hanyar dawowa zuwa 172.17.0.0/16, wadda yawancin VPN na shiga nesa ba za su tura ba. A nan ne kuma abokin ciniki mai tushen manufa ke karya shirin: idan yana kama zirga-zirgar wasu UID ko cgroups kawai, dokokinka na turawa ba sa ganin fakitin cikin ramin, kuma gyaran ya shafi manufar tafiyar abokin ciniki ba iptables ba. Dokokin da aka ƙara da hannu suna ɓacewa a sake kunnawa, don haka saka su a cikin naúrar systemd ko teburin netfilter-persistent ka sake gwadawa bayan sake kunnawa, tunda ramin da ya tashi a makare zai iya share su.

Saka ramin cikin kwantenan lokacin da keɓewa ita ce manufa

Idan kwantena ɗaya dole ya fita ta wani kumburi, gudanar da abokin ciniki a cikin wannan kwantenan. Yana buƙatar --cap-add NET_ADMIN da --device /dev/net/tun, sannan ya mallaki nasa tun0, hanyoyi da bangon wuta. Idan wasu kwantena suna wucewa ta cikinsa, yana kuma buƙatar turawa da dokar MASQUERADE cikin kwantenan, kuma waɗannan abokan suna buƙatar hanyar fili ko wakili da ke nuni gare shi; gadar Docker ta tsohuwa ba ta ƙara wannan hanyar maka ba.

Cibiyar sadarwar host, docker run --network host, ita ce sigar mai sauƙi: kwantenan yana shiga filin sunan host kuma yana ganin hanyoyin ramin kai tsaye. Hakanan yana watsar da keɓewar cibiyar sadarwa, yana gayyatar karo na tashoshi, kuma a aikace zaɓi ne na Linux. Tashar da aka buga ba ita ce madadin ba. -p 8080:80 yana sa sabis ya isa daga host; ba ya sa adiresoshin ciki 10.x su isa daga cikin kwantenan, kuma haɗa biyun shi ne yadda matsalar tafiya ke juya zuwa buɗaɗɗen tashar bayanai.

Bambanta gazawar suna daga yankin da ya mamaye

Gadar Docker ta tsohuwa ita ce 172.17.0.0/16, kuma yawancin tafkunan VPN na kamfanoni suna cikin 172.16.0.0/12. Da zarar ramin ya mallaki wannan kewayo, zirga-zirgar da aka yi nufin kwantenan na iya tafiya cikin ramin maimakon haka. Sunaye suna gaza, kuskuren yana kama da DNS, kuma adiresoshin su ne matsalar. Duba inda aka nufa, ba mai warwarewa ba: ip route get 172.17.0.5 a kan host, sannan ka kwatanta prefix ɗin gada da tafkin VPN da docker network inspect bridge --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'.

Gyaran shi ne a motsa ɗaya daga cikin kewayon: ko wani tafkin adireshi na tsohuwa na Docker a cikin daemon.json ko wani tafki a kan mai tattarawa. Ƙara wata uwar garken suna ba ya yin komai a nan, haka kuma ssh -b ba ya: ɗaure abokin ciniki ga maƙala yana canza adireshin tushe, ba hanyar da ta nufa cikin ramin ba. Rabon aiki cikin sauri: sunan da ke warwarewa a host amma ba a cikin kwantenan ba matsalar mai warwarewa ce, yayin da haɗin IP kai tsaye da ke rataye a cikin kwantenan amma yana aiki a host matsalar hanya ce ko sarkar turawa.

WSL da Docker Desktop ba sa bin dokokin Linux

A cikin yanayin NAT na tsohuwa, WSL yana bayan na'urar sa ta kirkira kuma ba ya samun hanyoyin ciki ko suffix ɗin DNS na VPN na Windows, shi ya sa burauzar ke aiki kuma ping cikin rarrabawar ba ya aiki. Haɗin cibiyar sadarwar madubi, wanda ke samuwa a sabbin builds na Windows 11, yana raba maƙallan host maimakon haka, amma dole ne a kunna shi a cikin .wslconfig kuma a sake kunna rarrabawar tare da wsl --shutdown. Tabbatar da yanayin da ke aiki tare da wslinfo --networking-mode kafin ka yi gyara, domin amsar NAT ba daidai ba ce ga yanayin madubi da akasin haka.

Docker Desktop yana ƙara wani Layer. Kwantenan Linux a Windows suna bayan wani aiwatarwar NAT da ake kira vpnkit a tarihi, kuma hanyarsu ta bambanta da ta host na Linux na asali. Kwantenan Windows suna haɗuwa ta hanyar switch na kirkira na Hyper-V, kuma abokin ciniki na kamfani na iya toshe zirga-zirga daga wannan switch, don haka kwantenan Linux a kan inji ɗaya na iya isa cibiyar sadarwa yayin da kwantenan Windows ba su da komai. Switch na waje da aka ɗaure ga na'urar zahiri ita ce hanyar da aka saba, kuma yana canza asalin cibiyar sadarwar kwantenan ta hanyoyin da manufa ba za ta yarda ba.

Kafin ka rubuta wata doka, bi matakan huɗu a tsari ka tsaya inda ɗayansu ba daidai ba:

• Cikin kwantenan: shin ip route yana isa prefix ɗin sirri, kuma shin /etc/resolv.conf yana ambaton sama da ke warware shi?
• A kan host: shin turawa a kunne, shin NAT yana ɗaure ga maƙalar rami, kuma shin sarkar turawa tana karɓar gada zuwa rami?
• A kan abokin: shin ya san hanyar dawowa, ko kana dogaro da NAT don ɓoye yankin kwantenan?
• A kan dandali: shin WSL yana cikin NAT ko yanayin madubi, kuma kwantenan Linux ne ko Windows?

Sake gudanar da kowane gwaji a cikin sabon kwantenan ko harsashi. Dogon tsari mai ajiyayyun amsa ko kafaffen haɗi zai ci gaba da gaza bayan saitin ya zama daidai, kuma wannan gazawar tana kama da gyaran da bai yi aiki ba.