Konteynarka Docker ma gaadhi karo VPN? Barbardhig subnet-yada

Konteynaradu waxay ka jawaabaan LAN-ka xafiiska, kadibna way joojiyaan jawaabta isla markii VPN-ga shirkaddu isku xirto. Waxba kama beddelmin konteynarka: ma jiro dib u bilow, ma jiro cusboonaysiin sawir, mana jiro wax ka beddelid habaynta. Waxa isbeddelay waa shaxda marin-hagidda host-ka, halkaas oo marin uu tunelku ku daray uu hadda daboolayo cinwaanka Docker bixiyay. Ka hor intaadan beddelin subnet ama ka codsanin ka-reebis VPN, dhigo labada qorshe cinwaan dhinac, sababtoo ah hagaajintu waxay qaataan waqti aad u kala duwan.

Akhri marinka ka hor intaadan beddelin habaynta

Ka bilow shabakadda Docker dhab ahaan dhisay. Qaybta IPAM waa qorshaha cinwaanka, subnet-na waa khadka muhiimka ah:

docker network inspect project_default --format '{{json .IPAM.Config}}'
# [{"Subnet":"172.18.0.0/16","Gateway":"172.18.0.1"}]

Compose wuxuu si caadi ah u qoondeeyaa /16 mashruuc kasta oo cusub, marka laba adeeg ay ku dhex jiri karaan baaxad 65,536 cinwaan ah. Ballacaas ayaa sabab u ah in is-dulsanaanta ay badan tahay: /16 si kadis ah loo doortay waa ku filan yahay inuu liqo goob aad ku gaadho tunelka, qofna ma dareemo ilaa tunelku kaco.

Kadib barbardhig doorashada marinka hal cinwaan konteynar, mar tunelku xiran yahay iyo mar furan yahay:

ip route get 172.18.0.7
# 172.18.0.7 dev br-3f2a9c src 172.18.0.1

Laba qaab oo jawaab ah waxay u horseedaan meelo kala duwan. Haddii soo-saarku sheegto tun0, wg0 ama qalab kale oo tunel, horgalaha VPN waa ugu yaraan sida marin-buundada oo kale oo gaar ah, iyo baakadu waligeed ma gaadho konteynarka. Haddii uu weli sheegto buundada, host-ku wuu gaadhi karaa konteynarka, khaladkaaguna waa shaandhayn, DNS ama marin-soo-noqosho ku guuldareysta hal jiho oo keliya.

Sababta isku-dhac /16 ay u fudud yahay in la gaadho

Docker wuxuu shabakadaha buundada ka qaataa barkadaha gaarka ah, barkadda caadiga ahna waxay ka timaaddaa qaybta 172.16.0.0/12 oo ah /16 googo. Shabakadaha shirkaduhu waxay inta badan isticmaalaan isla booska gaarka ah, VPN-ga gelitaanka fogna wuxuu horgalayaashaas u riixaa macmiil kasta oo isku xira. Marka labada dhinacba ay rumaystaan inay leeyihiin 172.18.0.0/16, hal shax oo marin-hagid ah waxay qabataa laba sheegasho oo is khilaafaya.

Dhererka horgalaha ayaa go’aamiya guuleystaha, ma aha nidaamka marinnada. Tunel riixaya 10.0.0.0/8 kama guuleysto marin-buunde 172.18.0.0/16, sababtoo ah /8 waa ka gaar yar. Tunel riixaya 172.18.0.0/16, ama 172.18.5.0/24 gudahaheeda, wuu ka guuleystaa. Taasi waa sababta hal laptop uu ka shaqeeyo shabakadda xafiiska oo ku guuldareysto Wi-Fi hotelka isla VPN: macmiilku wuxuu helaa horgalayaal kala duwan.

Isla shaxdaas ayaa maamusha jihada kale. Konteynar u baahan host gudaha 10.8.4.20 wuxuu baakadda u diraa albaabka buundadiisa, host-kuna kadib wuxuu u marin-hagaa tunelka. Marinkaas caadi ahaan wuu shaqeeyaa sababtoo ah host-ku wuxuu sameeyaa NAT, laakiin wuu guuldareystaa marka dhinaca shirkaddu uu aqbalo oo keliya cinwaanka VPN ee laptopka, ama marka shaandhaynta marin-soo-noqoshada ay tuurto jawaabta aan simanayn.

Barbardhig saddexda hagaajin

Waxaa jira saddex keliya oo bixitaan ah, waxayna ku kala duwan yihiin cidda ay tahay inay ansixiso iyo waxa jabaya inta aad mid ka mid ah dabaqayso.

Dib-u-nambaraynta waa hagaajinta keliya ee aad ku dhammayn karto bilaa tikit, taas ayaa sabab u ah in qoraallada badankoodu halkaas ku joogsadaan. Waa jaban mashruuc yar, wuuna qaali noqdaa marka qalabka guuritaanka ama xarig isku-xir oo kaydsan uu tilmaamo cinwaan sugan. Tir sheegashooyinkaas ka hor intaadan beddelin YAML, ma aha kadib.

Ka-reebis tunelka waa jawaabta ugu nadiifsan marka is-dulsanaantu ku jirto baaxad ay shirkaddaadu dhab ahaan leedahay. Sidoo kale waa tan ugu gaabis badan, waana wax-ku-ool u ah qandaraasle aan beddeli karin profile-ka macmiilka. Deked la daabacay ama proxy gadaal oo yar ayaa ka fogaada doodda: macmiilku wuxuu la hadlaa cinwaan tunelku horey si sax ah u marin-hagay, oo dekeddaas oo keliya ayaa loo baahan yahay in la gaadhi karo.

U xidh baaxad si ula kac ah

Hal mashruuc, ku dhawaaq subnet-ka gudaha faylka compose si mashruucu u joojiyo ka qaadashada barkadda la wadaago:

networks:
  default:
    ipam:
      config:
        - subnet: 10.201.7.0/24

Baaxaddaas ka soo qaado diiwaan ay kooxdaadu hayso, ma aha tusaale aad ka heshay intaad raadinaysay. Ku hubi horgalayaasha VPN-ku riixo, LAN-yada guryaha ee dadku ka shaqeeyaan, iyo shabakadaha kale ee konteynarka ee isla host-ka. Kadib qorshee dib-u-abuur, sababtoo ah shabakad jirta waxay haysataa subnet-keedii hore: docker compose down, kadib up -d. docker network rm wuu diidaa inta ay ku xiran yihiin dhibcaha dhamaadka, oo gal kasta oo ipv4_address ah oo faylka ku jira waa inuu ku dhaco baaxadda cusub.

Shabakadaha Docker isagu abuuro, ku dhig barkad daemon gudaha /etc/docker/daemon.json:

{
  "default-address-pools": [
    { "base": "10.201.0.0/16", "size": 24 },
    { "base": "10.202.0.0/16", "size": 24 }
  ]
}

Barkaddu waxay khusaysaa shabakadaha la abuuray ka dib dib-u-bilowga daemon-ka, buundada horey u jirtana way hayaan cinwaannadooda. Taasi waa mid ku habboon oo fudud in la illoobo, marka ula dhaqan mashruuc hore sidii mid weli is-dulsaaran ilaa qof uu dib u abuuro shabakaddiisa. dokumentiga shabakadaynta mishiinka Docker wuxuu qeexayaa xeerarka qoondaynta haddii aad u baahato inaad difaacdo barkadda dib-u-eegis.

Buundada Linux iyo Docker Desktop si kala duwan ayay u guuldareystaan

Host Linux, konteynaradu waxay dul fadhiyaan buundooyin gudaha magaca booska host-ka. Hal shax ayaa wax walba go’aamisa, marka barbardhigga kor ku xusan waa sheekada oo dhan: akhri marinka buundada, akhri marinka tunelka, oo arag kee guuleysta cinwaan konteynar dhab ah.

Docker Desktop wuxuu konteynarada dhigaa gadaal VM leh NAT u gaar ah. Host-ku gabi ahaan ma leh marin u socda cinwaanka konteynarka; wuxuu adeegga ku gaadhaa deked la daabacay, oo caadi ahaan ku xiran 127.0.0.1. Sidaas darteed macmiil VPN ah wuxuu jebin karaa adeegga is-dulsanaan subnet ah la’aan: isagoo rakibaya marin baaxadda gudaha VM-ka ama isagoo xannibaya socodka loopback inta tunelku ku xiran yahay. Haddii ip route get host-ka uu sheego in aan marin loo hayn cinwaanka konteynarka, taasi waa wax la filayo ee ma aha cilad.

Natiijada la taaban karo waa halka aad marka hore eegto. Linux, ka bilow shaxda marin-hagidda. Desktop, ka bilow dekedda la daabacay iyo xeerarka dab-damiska macmiilka VPN, kadib hubi in subnet-ka gudaha VM-ku uu isku dhaco wax tunelku riixayo.

Hubi iyada oo tunelku furan yahay

Dib u xir VPN-ga laba jeer ka hor intaadan dhihin waa la hagaajiyay, sababtoo ah profile marinnada riixa marka la xiro oo dib u qaata marka la gooyo ayaa u ekaan kara mid sax ah isku dayga koowaad ka dib. Kadib samee hubinta uu macmiilku dhab ahaan sameeyo:

1. ip route get host-ka, adigoo isticmaalaya cinwaanka dhabta ah ee konteynarka.
2. Codsi ka yimid konteynar kale, si loo caddeeyo in adeegga laftiisu caafimaad qabo.
3. curl -sv http://127.0.0.1:8080/ macmiilka iyada oo tunelku furan yahay, kadib traceroute -n cinwaanka konteynarka laga soo qaaday mishiin ku jira LAN.
4. sysctl net.ipv4.conf.all.rp_filter haddii codsigu gaadho host-ka laakiin jawaabtu lumo.

Ugu dambayntii, ku qor baaxadda la doortay isla diiwaanka aad ka dooratay, oo wata taariikhda iyo mashruuca iska leh. Is-dulsanaanta xigta waxay ka iman doontaa mashruuc aan cidina diiwaangelin, difaaca keliya ayaa ah in baaxadda si ula kac ah loo hayay ee aan si kadis ah loo soo qaadin.