I-dev container ayikwazi ukufinyelela i-host ye-VPN kuphela: yikuphi okufanele ubheke

I-API eyimfihlo iyavuleka kusiphequluli sakho sedeskithophu kodwa yehluleka ku-container yokuthuthukisa. Lokho akukona ukungqubuzana, futhi akuvamisile ukuthi yi-VPN uqobo. Isicelo sesiphequluli nesicelo esihlulekayo senziwa izinqubo ezihlukene, ezinama-resolver, ama-proxy nemizila ehlukene, futhi ngokuvamile zivela ezinhlakeni zamagama zenethiwekhi ezihluke ngokuphelele. "Kulaptop yami" kungasho i-host ye-Windows, ukusatshalaliswa kwe-WSL, umshini wobuciko we-Docker Desktop kanye ne-container ngaphakathi kwalowo mshini, izinhlaka ezine okungenzeka ziyiphendule ngendlela ehlukene i-hostname efanayo. Thola ukuthi iyiphi inqubo ehlulekayo esebenzisayo ngaphambi kokuthinta isethingi eyodwa.

Thola inqubo ngaphambi kokushintsha isethingi

Qala ngenjini ye-container hhayi ngeklayenti ye-VPN. Buza ukuthi umugqa womyalo ukhuluma naluphi uhlaka, nokuthi ley njini isebenza kuluphi uhlelo lokusebenza, ngoba i-container ye-Linux ephethwe umshini wobuciko wedeskithophu iyindlela ehlukile kuleyo ephethwe i-daemon yendawo:

docker context ls
docker info --format '{{.OperatingSystem}} / {{.Name}}'
docker run --rm alpine ip route

Kwi-Windows, wsl -l -v ikutshela ukuthi ukusatshalaliswa kusebenza ngaphansi kwe-WSL 2 yini, okukubeka ngemva kweswishi yayo yobuciko. Leyo mininingwane inquma ukuthi i-container yabelana ngethebula yemizila ye-host noma ihlezi ngemva kwe-NAT edinga iphothi edlulisiwe noma igama le-host ukuze ifinyelele i-host.

Gcina isicelo esisodwa singashintshi bese uqhathanisa

Khetha indawo eyodwa engenabungozi ku-host eyimfihlo futhi uyisebenzise kukho konke ukuqhathanisa, kusukela kusiphequluli, kusukela kutheminali ye-host, kusukela kukusatshalaliswa kwe-WSL nangaphakathi kwe-container. Bhala izinto ezine okwazozonke izamo: ikheli elixazululiwe, ukuthi kusetshenziswe i-proxy yini, uhlobo lokwehluleka nesikhathi esidlulile. Ukusesha igama, ukusungula ukuxhumana, ukuqinisekisa i-TLS nesimo se-HTTP yizinkinga ezine ezihlukene, futhi ukuzihlanganisa zibe "akusebenzi" kuchitha ekuseni lonke.

Qhuba ukuqhathanisa ngaphakathi kwe-container ehlulekayo, nesikhathi esibekiwe ukuze i-firewall ethule ingabambi itheminali imizuzu. I-container entsha ikhiqiza kabusha uhlaka lwenethiwekhi lwenjini kodwa hhayi isikhala samagama, izinto eziguquguqukayo ze-proxy noma i-resolver ye-container yohlelo lokusebenza, ngakho docker exec kulelo langempela ukuhlolwa okugunyaziwe futhi i-container eseceleni iyindlela nje yokuhlukanisa ukuthi umehluko usenjinini noma kukho-container:

docker exec -it app /bin/sh -c "getent hosts api.internal; curl -v --max-time 8 https://api.internal/ 2>&1 | tail -20"
docker run --rm --network container:app curlimages/curl:latest -sv --max-time 8 https://api.internal/ 2>&1 | tail -20

Isithombe esiyisisekelo se-alpine sine-busybox futhi asinayo i-curl, futhi yilokho kanye uhlobo lwemininingwane okwenza ibhlokhi yokuxilonga ekopishiwe yehluleke: khetha isithombe esineklayenti, noma uyengeze ngaphakathi kokusebenza okufanayo. Ukuqhathanisa namasayithi omphakathi angenalutho akuhlukanisi lutho. Uma https://example.com isebenza kusukela ku-container, ufunde ukuthi i-container inokufinyelela kwi-inthanethi futhi akukho lutho mayelana nokuthi ingafinyelela ikheli eliyimfihlo ngomhubhe yini. Ngendlela efanayo, ukuvula itheminali entsha kufakazela kuphela ukuthi itheminali entsha iyasebenza, hhayi ukuthi yabelana ngesikhathi sokusebenza nohlelo olwehlulekile.

I-Docker Desktop ingasebenza ne-VPN

Idokhumenti ye-Docker uqobo mayelana ne-VPN nokuxhumana ne-host ichaza lokhu njengesethi esekelwayo, futhi isifinyezo esithembekile ukuthi iyasebenza kunokuba ibe yephukile ngokuzenzakalela. Ungacabangi ukuthi umshini wobuciko wedeskithophu udlula umhubhe we-host njengendaba yomklamo; ezimisweni eziningi ithrafikhi ilandela umhubhe we-host ngendlela efanele, yingakho inganekwane ethi "Docker iyayishaya indiva i-VPN" iletha izeluleko eziqinisekile nezingalungile.

Okusabalulekile i-backend esetshenziswayo, inqubomgomo ye-split tunnel yeklayenti, kanye nokucushwa kwe-resolver umshini wobuciko akutholile. Iklayenti le-VPN elifaka imizila kodwa hhayi i-DNS, noma elithumela iseva ye-DNS umshini wobuciko ongakwazi ukuyifinyelela, lidala ukwehluleka kokusesha igama ngaphakathi kwe-container ngenkathi i-host isebenza ngoba ine-resolver eyengeziwe noma impendulo egciniwe. Leyo yinkinga ye-resolver egqoke ingubo ye-container. Iyasinda ekuxhumekeni kabusha kwe-VPN ngakunye okuzamayo, ngoba umhubhe usuvele uthwala ithrafikhi oyicele ukuthi iyithwale.

Ukugqagqana kwamakheli ne-MTU kungukwehluleka okuhlukene

Ukwehluleka okubili kufanele ukuxilongwa kwakho ngoba ngokuvamile kuthathwa ngephutha njengomgomo wokufinyelela. Okokuqala ukugqagqana kwamakheli: uma i-VPN ithumela ububanzi obushayisana ne-subnet yebhuloho elizenzakalelayo yenethiwekhi ye-container, umzila we-container walobo bubanzi ukhomba ebhulohweni lendawo futhi awufinyeleli emhubheni. Hlola ama-subnet angempela esikhundleni sokuqagela:

docker network inspect bridge --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'
ip route get 10.20.30.40

Okwesibili inkinga ye-MTU. Uma ukuxhumana kusungulwa futhi i-TLS iqedwa kodwa izimpendulo ezinkulu ziyama, unenkinga yosayizi wephakethe, hhayi inkinga yegunya, futhi ukushintsha amarekhodi e-DNS ngeke kulungise lokho. Hlola ngesicelo esincane nesikhulu ngaphambi kokushintsha noma yini, futhi ubhale imiphumela yomibili.

Isixazululo sokugqagqana i-subnet ye-container ehlukile noma umzila obekiwe, okhethwa umnikazi wohlelo lwamakheli. Isixazululo sokuma kwe-MTU ukunciphisa noma ukwehlisa i-MTU yomhubhe noma yesixhumi sezimo kunani elinqoba indlela, kusetshenziswa esigabeni osilawulayo.

Ukucushwa kwe-proxy kungokwenguqu ngayinye, hhayi ngomshini

Ngaphakathi kwe-container, localhost ibiza uhlaka lwenethiwekhi lwale container uqobo, ngakho i-proxy esebenza ku-host ayifinyeleleki lapho ngalelo gama. I-Docker Desktop ihlinzeka nge-host.docker.internal yokufinyelela ku-host, futhi ku-Linux uyengeza ngokucacile nge---add-host=host.docker.internal:host-gateway. Kunoma yikuphi, lelo gama likunikeza umzila oya ku-host; alidali isevisi ye-proxy futhi alikunikezi igunya lokuyisebenzisa.

Sebenzisa ikheli le-proxy nephothi elinikezwe indawo yangempela, futhi uhlole ukuthi ngubani oyifundayo. Izinto eziguquguqukayo ezikhishiwe ku-shell esebenzisanayo azicushi isandiso ngasinye somhleli, iseva yolimi, ithuluzi lokwakha ne-daemon yangemuva ngokuzenzakalela. Okubalulekile inqubo eyenza isicelo esihlulekayo, ngakho hlola indawo yayo hhayi eyetheminali yakho.

Ekugcineni, yenza isixazululo sizichazele sona. Isixazululo esiwusizo sisho umngcele owawungalungile, isethingi esiwushintshile, kanye neqoqo lezinguqu ezizithintayo manje. Ukuqalisa kabusha i-VPN, umhleli nenjini ngokulandelana kungashintsha uphawu, kodwa akushiye lutho umuntu olandelayo angalusebenzisa.