Raba hanyar sadarwar kwantena VPN: abin da ke faruwa da DNS

Raba wurin suna na hanyar sadarwar kwantena VPN yana ba aikace-aikacenka mu'amaloli da hanyoyin tunnel. Ba ya ba shi resolver na tunnel, ko kwafin da aka haɗa na wani abu a kan host. Wannan gibin yana haifar da takamaiman matsala: sunayen jama'a suna warwarewa, na ciki ba sa warwarewa, kuma app ɗin da ya kasa yana kama da yana amfani da sabar DNS mara daidai, domin haka yake. Gyaran yawanci ya fi ƙanƙanta fiye da yadda bincike ke nunawa.

Mataki 1: Gwada daga app ɗin, ba daga host ba

Gudanar da binciken a cikin kwantena da ke da matsalar, ba a kan host ba kuma ba a cikin burauza ba. docker exec app-container getent hosts db.internal yana amsa tambayar da ta fi muhimmanci: abin da resolver na wannan tsari ke dawowa.

Idan host ya warware sunan kuma kwantena bai yi ba, ka sami matsalar. Duk abin da ya biyo baya shine zaɓin hanyar da aka goyi bayan gyara ta.

Mataki 2: Karanta samfurin da runtime ke goyan bayansa

Takardun hanyar sadarwa na Docker yana rubuta ƙuntatawa kan tutocin DNS ga kwantena da ke raba yanayin sadarwa na wani kwantena. A cikin Compose network_mode: service:vpn yana ɗaure app ɗin zuwa wurin suna na kwantena VPN, kuma ga kowane sabis dns saitunan ba sa yin hali kamar yadda suke yi ga sabis na yau da kullum. Maganin da kake samu shine wanda wurin suna da aka raba yake da shi.

Hanyoyin sadarwar gada da mai amfani ya ayyana suma suna amfani da DNS da aka saka na Docker daban da gada ta asali. Shi ya sa dns sashe da aka kwafa daga misalin gada mai aiki ba zai iya yin komai ba a cikin tarin da aka raba. Duba tsarin kafin ka kwafa sashin.

Adireshin loopback koyaushe yana nufin mahallin sadarwar da ya dace. A cikin wurin suna da aka raba, 127.0.0.1 ba resolver na host ba ne.

Mataki 3: Bi tambayar har zuwa mai karɓarta

Karanta tsarin resolver na app ɗin, sannan duk wani DNS mai ɓoyewa na musamman na app ɗin da yake ɗaukarsa, domin app ɗin da ke gudanar da nasa resolver yana watsi da fayil ɗin da ka gyara. Sannan duba ko zaɓaɓɓen resolver ana iya isa gare shi a ƙarƙashin hanyoyin VPN da manufar firewar. Adireshin resolver a wancan gefen tunnel ba shi da amfani idan wurin suna ba shi da hanya zuwa gare shi. Tabbatar da mai karɓa kafin ka gyara kowane fayil.

Shafin duba IP a burauza ba zai iya gaya maka inda tambayoyin suna suka tafi ba. Yana gaya maka inda haɗin HTTP ɗaya ya tafi.

Mataki 4: Gyara nau'ikan gazawa biyu daban

Idan sunayen sabis sun kasa yayin da sunayen jama'a ke aiki, matsalar tana cikin gano sabis a cikin hanyar sadarwar kwantena, ba jerin resolver na jama'a ba. Canza kowane adireshin DNS na jama'a ba zai ƙirƙiri rikodin da ba a taɓa neman injin gano hanyar sadarwar ya ƙirƙira ba.

Idan duka nau'ikan biyu sun kasa, fara da isarwa zuwa resolver. Idan ɗaya kawai ya kasa, fara da injin ganowa. Su biyu suna da masu mallaka daban-daban, shi ya sa gyara ɗaya ba ya taɓa rufe duka biyu.

Mataki 5: Sake gwadawa bayan sake ƙirƙira

Canza tsarin ta hanyar injin da runtime ke goyan bayansa, sannan sake ƙirƙirar kwantena maimakon gyara fayiloli a cikin wanda ke gudana. Gwada sabon suna na sirri, sabon suna na jama'a, da buƙatar aikace-aikacen da ke biyo binciken. Gyaran da aka yi a /etc/resolv.conf cikin kwantena yana ɓacewa a sake ƙirƙira kuma zai tabbatar maka cewa gyaran ya yi aiki alhali bai yi ba.

Rubuta mai mallakar resolver da wurin suna da ake tsammani kusa da ma'anar hanyar sadarwar da aka raba. Mutum na gaba zai buƙaci duka biyun.