Docker: marin uun kontaynar VPN, kan kalena si toos ah u daa
Tunnel-ka sii kontaynar u gaar ah, u ogolow oo kaliya adeegyada u baahan in ay wadaagaan booska magacyadaas, ka dibna xisaabso waxa mulkiilaha daba socda: dekedaha, localhost, DNS.
Hal martigeliyaha, laba culeys oo shaqo iyo shuruud kala sooca: macmiil soo dejineed oo ay tahay in uu ka soo baxo VPN ganacsi, iyo interface maamul oo ay tahay in uu sii wato isticmaalka xiriirka martigeliyaha. Rakibidda macmiilka VPN martigeliyaha ayaa isla markiiba buqda shuruudda, sababtoo ah markaas labada culeys waxay wadaagaan hal bixitaan. Qaabka dhab ahaan shaqeeya waa in tunnel-ka loo raro kontaynar u gaar ah oo loo ogolaado oo kaliya culeysyada u baahan in ay ku biiraan booska magacyada shabakada kontaynarkaas. Wax kasta oo kale waxay hayaan wadada caadiga ah ee Docker, tafaasiisha soo socdaana waa natiijooyinka cidda leh booska magacyada.
Sababta boos magacyo la wadaago u beddelo xeerarka
Kontaynarka ku biira booska magacyada mid kale ma helo stack shabakadeed u gaar ah. Wuxuu arkaa isla interfaces-ka, isla shaxda dariiqa iyo isla loopback-ka kontaynarka uu ku biiray, taasina waa sababta qaabku faa'iido u leeyahay: culeyska wuu xalliyaa oo si caadi ah ayuu u xirmaa, tunnel-ka hoostiisana wuxuu qabtaa socodka iyada oo aan barnaamijku ogeyn. Qiimaha ayaa ah in goob kasta oo shabakadeed ay hadda leedahay hal mulkiile, kontaynarka ku biirayana ma aha isaga.
Xeerka lahaanshaha ayaa ka jawaaba su'aalaha badan ee habaynta ka hor inta aan la weydiin. Haddii goobtu ku nooshahay stack-ka shabakadda, waxay ka tirsan tahay kontaynarka dhinaca. Haddii ay qeexdo habka, waxay la joogtaa culeyska.
loopback waa qaybta dadka yaabiso. Gudaha kontaynarka ku biiray, localhost waxaa loo xalliyaa loopback-ka kontaynarka dhinaca, ma aha mid u gaar ah oo gaar loo leh, sidaas darteed adeeg ku xidha 127.0.0.1 oo filanaya gooni ahaansho hadda waxay la wadaagaa ciwaankaas kontaynarka tunnel-ka.
Ku daabac dekedaha kontaynarka leh booska magacyada
Khariidadda dekeduhu waxay ka tirsan tahay mulkiilaha booska magacyada, xitaa marka habka dhageysanaya uu ku socdo kontaynarka kale. Ku dhawaaq khariidadda kontaynarka dhinaca, culeyskuna ha hayo habaynta habkiisa oo aan la taaban. Khariidad ku taal adeega ku biiray ma yeelan karto saameyn, ha ahaato in mishiinku diido ama si aamusan u ignor-gareeyo iyadoo ku xiran sida kontaynarka loo bilaabay, taasina waa sababta interface hore loo gaari karey uu baaba'o isla marka qaabka la isticmaalo.
services:
gluetun:
image: qmcgaw/gluetun
cap_add: [NET_ADMIN]
ports: ["8080:8080"]
client-vpn:
image: example/client
network_mode: "service:gluetun"
client-direct:
image: example/client
ports: ["8081:8080"]U akhri qaybtan sidii saddex go'aan ee ma aha saddex adeeg. Kontaynarka dhinaca wuxuu leeyahay tunnel-ka iyo dekedda la daabacay; macmiilka ku biiraya wax shabakad ah ma caddeeyo; macmiilka tooska ah wuxuu hayaa khariidad u gaar ah shabakadda caadiga ah. Awoodda NET_ADMIN ayaa u ogolaata kontaynarka dhinaca in uu sameeyo interfaces oo uu beddelo dariiqooyinka, taasina waa sababta kontaynarkan uu uga baahan yahay xaq u badan culeysyada uu u adeego.
Adeega tooska ah ee hadhay wuxuu hayaa shabakadiisa
Culeyska aan tunnel-ka mari karin wuxuu hayaa buundada caadiga ah ama shabakad u gaar ah oo isticmaalaha qeexay, isaga oo wata dekeddiisa la daabacay iyo bixitaankiisa. Waa la soo jiitayaa in lagu xiro shabakadda kontaynarka dhinaca si labada kontaynar ay magac ku wada hadlaan, laakiin tallaabadaas kaliya waxay si aamusan u rartaa socodkiisa tunnel-ka. Haddii ay is gaaraan, dhis shabakad gooni ah oo isticmaalaha qeexay, ku xir labadaba, kontaynarka dhinacana ka dhig wadada kaliya ee baxa.
Kala sooc labada su'aal: kontaynarka kee ayaa is gaari kara, iyo kee ayaa ka baxa goobta. Midayntooda waa habka ugu caansan ee naqshaddan dib ugu noqoto VPN martigeliyaha oo dhan.
Matrix guuldarrooyin saacadda koowaad
Inta badan isku dayyada ugu horreeya waxay ku guuldarraystaan mid ka mid ah afar siyaabood, mid kastana sabab gooni ah ayuu leeyahay. Ku hubi sidan, sababtoo ah labada hore waxay sharraxaan ku dhawaad warbixin kasta.
| Symptom | Likely cause |
|---|---|
| Web UI unreachable after the change | Port mapping declared on the joining container instead of the sidecar |
| Both containers show the provider's exit address | The direct service was attached to the sidecar network |
| Internal names stop resolving | Resolver settings live on the host, not in the shared namespace |
| Health check fails but the app works | The check probes localhost, which now means the sidecar |
Safka afraad waa kan dadku si khaldan ugu qiimeeyaan inuu yahay bug barnaamij. Baaritaan lagu qoray loopback-ka culeyska laftiisa ayaa hadda tijaabinaya kontaynarka tunnel-ka, sidaas darteed wuu guuldarraystaa ama wuxuu soo sheegaa adeeg gebi ahaan khaldan.
Marka hal magac martigeliye uu u baahan yahay tunnel-ka
Mararka qaarkood tunnel buuxa waa badan yahay: hal magac gudaha ah waa in uu maraa VPN shirkadeed inta socket maxalli ah ama xiriirka bandhigu sii socdo. Tunnel buuxa oo gudaha kontaynarka wuxuu jebiyaa wadadaas iyo wax kasta oo loo jeediyay martigeliyaha, sidaas darteed u marso kaliya prefix-ka u baahan. Duubista dariiqa kala qaybsan ee ku wareegsan macmiilka ayaa taas sameeya, waxay u dirtaa martigeliyaha la magacaabay tunnel-ka oo ay dariiqa hore uga tagtaa mid aan la taaban wax kasta oo kale.
Dooro tan marka aad u baahan tahay in aad gaarto hal adeeg oo keliya oo aadan isku dayayn in aad rarto dhammaan socodka kontaynarka. Waa qalab ka duwan kontaynarka dhinaca waxayna ka jawaabtaa su'aal kale.
Xaqiiji, ka dibna ka dhig mid u adkeysanaya dib u bilaabista
Weydii kontaynar kasta ciwaanka uu u muuqdo in uu ka yimaado. Kan tunnel-ka ku jira waa in uu daabaco ciwaanka bixiyaha, kan tooska ahna bixitaanka martigeliyaha. Jawaabo isku mid ah waxay la macno tahay in adeega tooska ah uu dhaxlay booska magacyada khaldan ama in VPN heer martigeliye ah uu weli qabanayo wax walba, labadaas hagaajinna way kala duwan yihiin. Mar kale socodsii hubinta ka dib wax kasta oo compose la beddelo, sababtoo ah hal block adeeg oo la koobiyeeyay ayaa ku filan in uu dib u soo celiyo dhibaatada.
Saddex waxyaabood ayaa inta badan dambe jaba. DNS waxay raacdaa mulkiilaha booska magacyada, sidaas darteed goobaha xalliyaha iyo domainka raadinta waxay ka tirsan yihiin kontaynarka dhinaca ee ma aha martigeliyaha. VPN leh gudbinta dekedaha wuxuu beddelaa dekeddiisa dhageysiga marka dib loo xirmo, sidaas darteed dekedda bixiyaha gudbiyay iyo dekedda dhageysiga dhinaca kontaynarka waa in dib loogu qoro habaynta macmiilka ama khariidadda dekedaha, inta badan iyada oo loo marayo cusboonaysiine yar oo akhriya API-ga bixiyaha. Iyo baaritaan kasta oo lagu qoray localhost ayaa hadda weydiinaya kontaynarka tunnel-ka ee ma aha culeyska.
Qor qaabka, oo ay ku jirto kontaynarka leh booska magacyada iyo dekedaha u gaar ah. Qofka xiga wuxuu ku dari doonaa adeeg, wuxuu koobiyeeyaa block khaldan oo wuxuu dib u soo saarayaa guuldarradii ugu horreysay ee maqaalkan.