Taraafikada konteenarrada Docker waxay dhaafisaa VPN-ka martigeliyaha: sida loo hubiyo
VPN-ka martigeliyaha wuxuu daboolaa kaliya booska magacyada shabakada martigeliyaha. Isticmaal hubintan si aad u ogaato in taraafikada konteenarrada buundada ay gasho tunnellada ama si toos ah u baxdo.
Browser-kaaga martigeliyaha wuxuu muujinayaa cinwaanka bixitaanka VPN-ka, konteenarka wuxuu soo sheegaa xiriirka gurigaaga, qofna wuxuu u yaqaannaa daadasho. Waxba ma daadan. Tunnelka martigeliyaha waa koox ka mid ah isku-xirka, waddooyinka iyo xeerarka ka tirsan booska magacyada shabakada martigeliyaha, konteenarka buundada ku yaalna waa boos magacyo kale oo leh waddadiisa caadiga ah. Waxaan ku fadhiistay stack Compose halkaas oo macmiilka VPN uu toddobaadyo ku xidhnaa oo aan xitaa hal baakad konteenar ah waligiis gelin.
Hubi booska magacyada ka hor aaladda tray-ga
Boosaska magacyadu waa doodda oo dhan. Marka Docker uu konteenar ku bilaabo shabakad buundo, wuxuu abuuraa boos magacyo shabakadeed, wuxuu gudaha ku xiraa hal daraf oo lammaane veth ah, wuxuuna booskaas siinayaa cinwaan iyo waddo caadi ah. Isku-xirka tunnelka, magac kasta oo loo yaqaanno, wuxuu ku nool yahay booska magacyada martigeliyaha. Taraafikada gudaha konteenarka ma arki karto, oo ma jiro habayn macmiil oo tan dibadda ka beddela.
Laba tallaabo oo la taageeray ayaa kaa saaraya go'doonka. --network host wuxuu konteenarka dhigaa booska magacyada martigeliyaha, sidaas darteed wuxuu dhaxlaa waddooyinka martigeliyaha iyo sidaas darteed tunnelka. --network container:vpn wuxuu wadaagaa booska magacyada konteenar kale, waana sida ay inta badan naqshadaha sidecar culeyska shaqada u mariyaan konteenar VPN. Labaduba waa xulashooyin cad; badanaa mid kaliya ayaa ah wixii qofka geynaya uu ula jeeday.
Habka martigeliyaha ma aha kor u qaadis bilaash ah. Konteenarku wuu joojiyaa inuu lahaado cinwaankiisa, daabacaadda dekeddu ma shaqayso, iyo hannaanka halkaas ku haya NET_ADMIN wuxuu dib u qori karaa waddooyinka martigeliyaha. In taas la aqbalo waxay noqon kartaa go'aan sax ah. In loo maleyno inuu horey u shaqeynayo waa sida dadku u qaataan fiidkii iyagoo cilad-saareynaya tunnel aan waligiis jidka ku jirin.
Raac baakadda bannaanka buundada
Konteenarka buundada wuxuu baakaddiisa u diraa albaabka caadiga ah, kaas oo ah isku-xirka buundada ee martigeliyaha. Kadib martigeliyuhu wuu gudbiyaa baakadda, isla markaana qaabeynta caadiga ah wuxuu u tarjumaa cinwaanka isha midkiisa ka hor inta aan baakaddu bixin. Tallaabada tarjumaaddaas ayaa si aamusan u jabisa siyaasadda.
Marka baakaddu gaarto dhammaadka tunnelka waxay qaadataa cinwaanka martigeliyaha. Xeer kasta, waddo siyaasadeed ama go'aan tunnel qaybsan oo ku salaysan cinwaanka asalka ah ee konteenarka wuu joojiyaa isku-dhac, laba konteenar oo loogu talagalay inay ka baxaan bixitaanno kala duwan lama kala garto isha kaliya. Haddii aad u baahan tahay waddo-mariid konteenar kasta, go'aanku waa inuu dhaco ka hor tarjumaadda ama gudaha boos magacyo aad maamusho.
Docker ayaa iskiis u ilaaliya xeerarkan, iyada oo loo marayo backend-ka dab-demiska ee daemon-ka lagu habeynayay. Xeerarka gacanta lagu qoray ee ka baxsan xadhkaha la taageeray ee taraafikada la gudbiyo, DOCKER-USER, waa la dib u habeyn karaa ama waa la tuuri karaa marka daemon-ku dib u bilaabo ama martigeliyuhu kor u kaco. Dukumeentiga Docker ee ku saabsan shaandheynta baakadaha wuxuu muujinayaa nidaamka silsiladaha; qodobka waxqabadka waa in xeer kastaa u baahan yahay milkiile iyo waddo dib-u-soo-rorin oo aad runtii tijaabisay.
Tijaabi labada nidaam si gooni ah
Caddaynta ka timid hal boos magacyo waxba kama sheegto kan kale. Codsi lagu dhex fuliyay konteenarka VPN wuxuu caddeeyaa in tunnelku u shaqeeyo konteenarkaas. Taasi ma aha caddayn ku saabsan martigeliyaha, isla amarkana oo laga fuliyay konteenar --network host ma aha caddayn ku saabsan buundada.
# host namespace
ip route get 1.1.1.1
ip -brief addr show
# a fresh container on the same bridge network
docker run --rm --network appnet alpine sh -c 'ip route; cat /etc/resolv.conf; ip -6 route'Kadib ku celi tijaabada gudaha konteenarka dhabta ah ee barnaamijka halkii aad ka yeelan lahayd sawir la mid ah. Barnaamijku wuxuu qaadan karaa waddo dheeraad ah, doorsoome deegaan proxy ah ama xallin kale, mid kastaana wuxuu beddelaa jawaabta. Hubi xallinta magacyada iyo qoyska cinwaanka labaad mar kasta: konteenarrada buundooyinka isticmaaluhu qeexay waxaa lagu xalliyaa xallinta gudaha Docker ee 127.0.0.11, waddada caadiga ah ee IPv6 ee buundadana waxay taraafikada dibadda u qaadi kartaa inta aad ku mashquulsan tahay tijaabinta tunnel IPv4 kaliya.
Akhri qaabka ka hor inta aadan taaban aqoonsiga
Marka martigeliyuhu shaqeeyo konteenarkuna aanu shaqeyn, sababtu badanaa waa qaab-dhismeed, furayaasha wareejintooda ama macmiilka dib-u-rakibiddiisu waxay lumisaa galab. Marka hore kala sooc calaamadda oo hagaajintu badanaa magaceeda ayay sheegataa.
| What you see | Usual cause | First check |
|---|---|---|
| Host exits through the VPN, container shows the ISP address | The container never entered the tunnel | Default route inside the container |
| Container works until the daemon restarts, then stops | Rules outside the supported hook, or a changed backend | Daemon's reported firewall backend and DOCKER-USER |
| Container loses internal hosts after the tunnel comes up | VPN prefix overlaps the Docker bridge subnet | ip route on the host, then docker network inspect |
| Small replies arrive, large ones hang | Tunnel MTU or missing MSS clamping | Link MTU on both ends of the tunnel |
| Container falls back to the ISP address when the tunnel drops | Nothing enforces the kill switch for forwarded traffic | Stop the tunnel with a request in flight |
Sadarka is-dhaafka ah wuxuu mudan yahay jumlad u gaar ah. Profaylka VPN ee riixa waddo loogu talagalay 172.17.0.0/16, ama loogu talagalay 10.0.0.0/8 oo si kadis ah u kooban prefix-ka buundadaada, wuxuu tunnelka ka dhigaa inuu sheegto subnet-ka konteenarrada, jawaabahana cinwaannada la tarjumay waxay u socdaan jihada qaldan ama way lumi doonaan. Dib u nambareynta shabakada Docker badanaa way ka nadiifsan tahay ururinta ka-reebitaannada.
Ka dhig daboolka mid cad, kadib si ula kac ah u jabi
Laba naqshad ayaa u adkaysata dib-u-eegista. Wadaag booska magacyada konteenarka VPN oo culeyska shaqada ee la daboolay kastaa wuxuu isticmaalaa hal tunnel oo leh hal xad dib-u-bilaabid, taas oo fudud ilaa hal adeeg uu u baahan yahay bixin kale ama waddo DNS u gaar ah. Ama u jihee shabakada konteenarrada albaab VPN ah oo ku yaal martigeliyaha: gudbinta daaran, prefix-ka buundada u jeediyay tunnelka, taraafikada soo noqodka si cad loo maareeyay. Taasi waxay iibsataa xakameyn shabakad kasta waxayna ku kacdaa xeerar ay tahay inaad ilaaliso inta lagu jiro kor u qaadista daemon-ka iyo macmiilka.
Sida kasta, tijaabada muhiimka ah waa kiiska guuldarrada. Jooji tunnelka iyadoo codsiga konteenarku hawada ku jiro oo eeg halka baakaddu tagto. Haddii ay ku soo laabato waddada tooska ah, daboolka waligiis lama fulin, sababtoo ah kill switch macmiilku wuxuu maamulaa taraafikada macmiilka laftiisa ee ma aha baakadaha laga gudbiyo buundada. Kadib dib u bilaab daemon-ka iyo martigeliyaha oo xaqiiji natiijada mar labaad; waa daqiiqadda xeerarka gacanta lagu qoray ay baaba'aan.
Ka hor inta aadan dhahin waa dhammaatay, xaqiiji afar arrimood: isku-xirka tunnelku wuxuu ku yaal isla booska magacyada taraafikada, tijaabada konteenarku waxay ku dhacday gudaha konteenarka dhabta ah, xallinta magacyada iyo labada qoys cinwaan ayaa la hubiyay, tijaabada guuldarrada tunnelkuna weli way ku guuldareysataa xiran. Kadib qor backend-ka dab-demiska, nooca macmiilka iyo milkiilaha xeer kasta. Diiwaankaas ayaa ka hortagaya kor u qaadista xigta inay ka tagto isku-dhaf aan dukumeenti lahayn oo malo-awaal hore ah.