Tsarin VPN yana tsira daga sake gina kwano kawai idan ka mounte shi
Fayil da aka gyara a cikin kwano mai gudana yana zama a cikin wani Layer da ke ɓacewa. Kwatanta bind mounts, volumes da secrets, sannan sake ginawa kuma tabbatar da abubuwa huɗu.
Kana gyara tsarin WireGuard a cikin kwano mai gudana, yana aiki, kuma sabuntawar image ta gaba tana shafe shi. Babu abin da aka yi kuskure. Fayil ɗin yana zama a cikin Layer rubuce-rubuce na kwanon, wanda ke wanzuwa kawai don wannan kwano. Kwatancen da ke da muhimmanci ba wane kayan aiki za ka yi amfani da shi ba ne, amma waɗanne abubuwan shiga ne turawar ka ke bayyanawa. Duk abin da ka gyara da hannu abin shiga ne da turawar ba ta sani ba.
Nau'i biyu na yanayi, ɗaya za a iya jefar da shi
Kwano yana da Layer rubuce-rubuce don canje-canjen da aka yi lokacin gudana, kuma ana jefar da wannan Layer idan an maye gurbin kwanon. Ba ajiyar tsari ba ne kuma ba kwafin ajiya ba ne. Image da abubuwan shiga da aka bayyana sune cikakken ma'anar abin da ke gudana.
Tambaya waɗanne fayilolin VPN naka ne abubuwan shiga da aka bayyana kuma waɗanne ne hatsari:
docker diff wg-vpn
docker inspect --format '{{json .Mounts}}' wg-vpndiff yana lissafa abin da ya canza a cikin Layer rubuce-rubuce, kuma wannan shine ainihi saitin abubuwan da za su ɓace. Lissafin mount yana nuna abin da ke tsira. Kwatanta biyun yana amsa tambayar kafin ka rasa wani abu.
Bind mount, volume mai suna ko secret: me kowanne ke kariya
Duk ukun suna iya ɗaukar bayanin martaba na VPN, kuma sun bambanta a wanda zai iya karanta shi da abin da ke faruwa idan an maye gurbinsa.
| Mechanism | Survives recreation | Who can read it |
|---|---|---|
| Writable layer | No | Anyone with container access, until it is gone |
| Bind mount | Yes, while the host path exists | Whatever the host permissions allow |
| Named volume | Yes, until the volume is removed | Managed by the runtime |
| Secret | Yes, as a declared input | The container process, by design |
Bind mount yana taswirar hanyar host, don haka fayil ɗin yana da kariya gwargwadon wannan hanyar kuma yana ganuwa gwargwadon izinin host. Ana sarrafa volume mai suna ta runtime kuma yana tsira daga cire kwanon, wanda hakan ya sa ya zama mafi aminci tsoho don yanayin da turawar ta mallaka. Tsarin secret don kayan da ba ka son su a cikin image ko environment variable.
Kada ka ɗauki kowane environment variable da kowane fayil na host a matsayin kariya ɗaya, domin ba haka suke ba.
Gyara a cikin kwano shine tarkon
Tarkon ba kayan aiki ba ne, alkiblar gyaran ne. Canjin da aka yi a cikin kwano mai gudana ba ya ganuwa ga turawar, don haka sake ginawa na gaba yana mayar da shi cikin shiru kuma alamar tana kama da koma baya a cikin image. Idan dole ka yi canji a can don bincike, kwafa shi waje nan take kuma saka shi cikin abin shiga da aka bayyana. Sannan sake ginawa don tabbatar da turawar tana sake haifar da shi.
Bayanin martaba na iya ɗaukar maɓallan sirri da kayan asusu, wanda hakan ya sa kwafin ajiyar wannan fayil ɗin ya zama aikin kula da sirri maimakon kwafin fayil. Riƙe mallaka da damar karatu a iyakance ga ainihin tsarin kwanon, maimakon faɗaɗa wani babban fayil na host don kuskuren izini ya ɓace.
Wannan faɗaɗawa shine yadda sauƙi a cikin kwano ya zama fallasa ga host.
Sake ginawa da gangan, sannan tabbatar da abubuwa huɗu
Rubuta sigar image, na'urar da ake buƙata da iyawa, haɗin cibiyar sadarwa da abubuwan shiga na dindindin. Lissafin na'ura da iyawa yana da muhimmanci musamman ga kwanon VPN, domin rami yana buƙatar na'urar cibiyar sadarwa da ikon daidaita ta.
Tabbatar wace yanayin gudana da aka ƙirƙira ya kamata a sake ginawa maimakon adanawa. Maɓallan da ramin ya ƙirƙira a farkon farawa yanayi ne, kuma ko za ka riƙe su ko sake ƙirƙira su shawara ce mai sakamako ga kowane peer da ya san tsohon maɓallin jama'a.
Bayan sake ginawa da aka sarrafa, tabbatar da asali, tuƙi, DNS da toshewar kasawa da ake buƙata. Tsari da ke farawa ba tare da kuskure ba ya tabbatar da ɗaya daga cikin waɗannan huɗu. Duba shi yayin da rami ke aiki kuma sake bayan ka dakatar da shi, domin toshewar kasawa tana nuna kanta ne kawai idan ramin ya tafi.
Riƙe kwafin dawo a wajen kwanon
Riƙe kwafin dawo da ke rayuwa ba tare da kwano ba, kuma gwada dawo da shi ta hanyar tsarin da aka rubuta. Kwafin ajiyar bayanin martaba na VPN da ba a gwada ba bege ne, musamman idan hanyar dawo da ta ƙunshi izinin da tsarin kwanon ke buƙata.
Idan an maye gurbin kwano da ke da VPN, daidaita aikace-aikacen da ke raba tarin cibiyar sadarwarsa a cikin zagayowar rayuwar runtime da aka goyi baya.
Wannan daidaitawa ita ce bambanci tsakanin sake farawa da katsewa. Turawar ya kamata ta bayyana inda tsarin yake zuwa, kuma takardun volume shine wurin da za ka duba abin da runtime ke adanawa da gaske.