Dev Container ma gaaro host kaliya VPN laga helo: halka laga eego

API-ga gaarka ah wuxuu ka furmaa browser-kaaga desktop-ka wuxuuna ku fashilmaa container-ka horumarinta. Taasi maahan khilaaf, oo marar dhif ah VPN laftiisa ayaa sabab ah. Codsiga browser-ka iyo codsiga fashilma waxaa sameeyay hawlo kala duwan, oo leh serializer, proxy iyo dariiqo kala duwan, iyo inta badan meelo magacyo shabakadeed gebi ahaan kala duwan. «Laptop-kayga» waxay ka dhigan kartaa host-ka Windows, qaybinta WSL, mishiinka mala-awaalka ah ee Docker Desktop iyo container ku jira VM-kaas — afar xaaladood oo mid kastaa si kala duwan uga jawaabi karo isla magaca host-ka. Ogaado kee ay isticmaasho hawsha fashilma ka hor intaadan taaban hal setting.

Raadi hawsha ka hor intaadan beddelin setting

Ka bilow mishiinka container-ka, ma aha macmiilka VPN. Weydii xaaladda ay khadka amarka la hadlayo iyo nidaamka hawlgalka uu mishiinku ku shaqeynayo, sababtoo ah container Linux oo VM desktop ah maamusho wuxuu maraa dariiq ka duwan kan daemon maxalli ah maamulo:

docker context ls
docker info --format '{{.OperatingSystem}} / {{.Name}}'
docker run --rm alpine ip route

Windows-ka, wsl -l -v wuxuu sheegayaa haddii qaybintu ku shaqeyneyso WSL 2, taasoo ka dhigaysa gadaasha switchkeeda mala-awaalka ah. Faahfaahintaas ayaa go'aamisa haddii container-ku la wadaago shaxda dariiqa host-ka ama uu fadhiisto gadaasha NAT u baahan port la sii maray ama magac host si uu host-ka u gaaro.

Hal codsi ku hay mid joogto ah oo isbarbar dhig

Dooro hal dhibic oo aan waxyeello lahayn oo ku taal host-ka gaarka ah oo u isticmaal isbarbardhig kasta: browser-ka, terminal-ka host-ka, qaybinta WSL iyo gudaha container-ka. Qor afar shay codsi kasta: ciwaanka la xalliyay, haddii proxy la isticmaalay, fasalka fashilka iyo waqtiga la qaatay. Raadinta magaca, dhisidda xiriirka, xaqiijinta TLS iyo xaaladda HTTP waa afar dhibaato oo kala duwan, oo ku daridda «ma shaqeyso» waxay lumisaa subax.

Isku barbardhig gudaha container-ka fashilma, oo leh waqti-koob si firewall aamusan uusan terminal-ka u hayn daqiiqado. Container cusub wuxuu dib u soo saaraa macnaha shabakadda mishiinka, laakiin ma aha meesha magacyada, doorsoomayaasha proxy ama serializer-ka container-ka barnaamijka, sidaas darteed docker exec gelidda container-ka dhabta ah waa imtixaanka la aqoonsan yahay, container-ka dhinacna waa kaliya hab lagu go'doomiyo haddii farqigu ku jiro mishiinka ama container-ka:

docker exec -it app /bin/sh -c "getent hosts api.internal; curl -v --max-time 8 https://api.internal/ 2>&1 | tail -20"
docker run --rm --network container:app curlimages/curl:latest -sv --max-time 8 https://api.internal/ 2>&1 | tail -20

Sawirka aasaasiga ah ee alpine wuxuu leeyahay busybox oo ma laha curl, oo taasi waa nooca faahfaahinta keenta in block-ka ogaanshaha la koobiyeeyay uu fashilmo: dooro sawir leh macmiilka, ama ku dar isla socodka. Isbarbardhigga la sameeyo boggaga dadweynaha ee aan la xiriirin waxba ma go'doomiyo. Haddii https://example.com ka shaqeeyo container-ka, waxaad baratay in container-ku leeyahay gelitaan internet, waxna kama baran haddii uu tunnel-ka ku gaaro ciwaan gaar ah. Sidoo kale, furista terminal cusub waxay caddeynaysaa kaliya in terminal-ka cusub shaqeeyo, ma aha in uu la wadaago deegaan socodsiin barnaamijka fashilmay.

Docker Desktop wuu la shaqeyn karaa VPN

Dukumeentiga Docker laftiisa ee ku saabsan VPN iyo xiriirka host-ka wuxuu tan ku tilmaamayaa hab-dhis la taageeray, soo-koobka daacadda ahna waa inuu shaqeeyo halkii uu si otomaatig ah u jabi lahaa. Ha u malayn in VM-ga desktop uu dariiqa host-ka dhaafo naqshad ahaan; hab-dhisyo badan ayaa taraafikadu si sax ah u raacdaa tunnel-ka host-ka, taasina waa sababta hal-abuurka «Docker wuu iska indhatiraa VPN-ka» uu u soo saaro talo kalsooni leh oo khaldan.

Waxa weli muhiim ah waa backend-ka la isticmaalayo, siyaasadda split-tunnel ee macmiilka iyo hab-dhiska serializer-ka ee VM-ku helay. Macmiil VPN oo rakiba dariiqooyin laakiin aan DNS ahayn, ama riixa server DNS oo VM-ku aan gaari karin, wuxuu abuuraa fashilka raadinta magaca gudaha container-ka halka host-ku shaqeynayo sababtoo ah wuxuu leeyahay serializer dheeraad ah ama jawaab kaydsan. Taasi waa dhibaato serializer oo qaba labiska container-ka. Waxay ka badbaadaysaa dib-u-xiriir kasta oo VPN ah oo aad isku daydo, sababtoo ah tunnel-ku horey ayuu u qaadayaa taraafikada aad ka codsatay.

Isku-tallalka ciwaannada iyo MTU waa fashilal kala duwan

Laba fashil ayaa mudan ogaansho u gaar ah sababtoo ah waxaa badanaa loo arkaa siyaasad gelitaan. Midda koowaad waa isku-tallalka ciwaannada: haddii VPN-ku riixo xaddi ku dhacaya subnet-ka buundada caadiga ah ee shabakadda container-ka, dariiqa container-ka ee xaddigaas wuxuu tilmaamaa buundada maxalliga ah oo marnaba ma gaaro tunnel-ka. Baadh subnet-yada dhabta ah halkii aad qiyaasi lahayd:

docker network inspect bridge --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'
ip route get 10.20.30.40

Midda labaad waa dhibaatada MTU. Haddii xiriirku dhismayo oo TLS dhammaado laakiin jawaabaha waaweyn istaagaan, waxaad leedahay dhibaato cabbir baakidh, ma aha oo ogolaansho, oo beddelka diiwaannada DNS marnaba ma hagaajinayo. Tijaabi codsi yar iyo mid weyn ka hor intaadan wax beddelin, oo qor labada natiijo.

Xalka isku-tallalka waa subnet container oo kale ama dariiq xaddidan, oo uu doorto mulkiilaha qorshaha ciwaannada. Xalka istaagga MTU waa in la adkeeyo ama la yareeyo MTU tunnel-ka ama interface-ka ilaa qiimo ka badbaada dariiqa, laguna dabaqo lakabka aad maamusho.

Hab-dhiska proxy waa hawsha, ma aha mishiinka

Gudaha container, localhost wuxuu magacaabaa macnaha shabakadda container-kaas, sidaas darteed proxy ku shaqeynaya host-ka halkaas laguma gaari karo magacaas. Docker Desktop wuxuu bixiyaa host.docker.internal gelitaanka host-ka, Linux-na waxaad si cad ugu darto --add-host=host.docker.internal:host-gateway. Si kastaba, magacaas wuxuu ku siinayaa dariiq host-ka; ma abuuro adeeg proxy mana ku siinayo fasax aad ku isticmaasho mid.

Isticmaal ciwaanka iyo port-ka proxy ee loo bixiyay deegaanka dhabta ah, oo hubi yaa akhrinaya. Doorsoomayaasha lagu dhoofiyay shell is-dhexgal ah si otomaatig ah uma habeyso kasta extension editor, server luqadeed, qalab build iyo daemon asaagga. Midda muhiimka ah waa hawsha sameysay codsiga fashilma, sidaas darteed baadh deegaankeeda ma aha tan terminal-kaaga.

Ugu dambeyn, u ogolow sixitaanku inuu is sharraxo. Xal faa'iido leh wuxuu magacaabaa xadka qaldanaa, setting-ka beddelay, iyo kooxda hawlooyinka uu hadda saameynayo. Dib-u-kicinta VPN-ka, tafatirka iyo mishiinka si isku xigta waxay beddeli kartaa calaamadda, laakiin waxba ma reebto oo qofka xiga isticmaali karo.