Ithrafikhi yamakhontheyna e-Docker idlula i-VPN yomsingathi: indlela yokuhlola
I-VPN yomsingathi ihlanganisa kuphela indawo yamagama yenethiwekhi yomsingathi. Sebenzisa lezi zihlolo ukuthola ukuthi ithrafikhi yamakhontheyna ebhulohweni ingena emhubheni noma iphuma ngqo.
Isiphequluli sakho kumsingathi sikhombisa ikheli lokuphuma le-VPN, ikhontheyna ibika ukuxhumana kwakho kwasekhaya, futhi othile ukubiza lokho ngokuvuza. Akukho okuvuzile. Umhubhe womsingathi iqoqo lamafasitela, imizila nemithetho engaphansi kwendawo yamagama yenethiwekhi yomsingathi, futhi ikhontheyna ebhulohweni ingenye indawo yamagama enomzila wayo wokuzenzakalela. Ngihlezi ku-stack ye-Compose lapho iklayenti le-VPN lalixhunyiwe amasonto amaningi futhi akukho ngisho iphakethe elilodwa lekhontheyna elake langena kulo.
Hlola indawo yamagama ngaphambi kwesithonjana se-tray
Izindawo zamagama ziyimpikiswano yonke. Uma i-Docker iqala ikhontheyna kunethiwekhi yebhuloho, idala indawo yamagama yenethiwekhi, ixhuma elinye iphethe lepheya ye-veth ngaphakathi kwayo, futhi inikeza leyondawo yamagama ikheli nomzila wokuzenzakalela. Ifasitela lomhubhe, noma lingabizwa ngani, lihlala endaweni yamagama yomsingathi. Ithrafikhi engaphakathi kwekhontheyna ayikwazi ukulibona, futhi asikho isilungiselelo seklayenti esishintsha lokho ngaphandle.
Kunezinyathelo ezimbili ezisekelwayo ezikukhipha ekuhlukaniseni. --network host ibeka ikhontheyna ngaphakathi kwendawo yamagama yomsingathi, ngakho izuza imizila yomsingathi futhi ngalokho umhubhe. --network container:vpn yabelana ngendawo yamagama yelinye ikhontheyna, futhi yileyo ndlela amadizayini amaningi e-sidecar athumela ngayo umsebenzi ngokusebenzisa ikhontheyna ye-VPN. Kokubili kuyizinqumo ezicacile; ngokuvamile kungenye kuphela yazo okwakushiwo umuntu obekayo.
Imodi yomsingathi akusiyo ukuthuthukiswa kwamahhala. Ikhontheyna iyeka ukuba nekheli layo, ukushicilelwa kwembobo akusasebenzi, futhi inqubo ephethe i-NET_ADMIN lapho ingabhala kabusha umzila womsingathi. Ukukwamukela lokho kungaba isinqumo esifanele. Ukucabanga ukuthi isivele ivuliwe yikho okwenza abantu bachithe ubusuku belungisa umhubhe ongakaze ube sendleleni.
Landela iphakethe uphume ebhulohweni
Ikhontheyna yebhuloho ithumela iphakethe layo esangweni layo lokuzenzakalela, okuyifasitela lebhuloho kumsingathi. Umsingathi ube esedlulisa iphakethe futhi, ekulungiseleleni okuzenzakalelayo, uhumusha ikheli lomthombo libe ngelakhe ngaphambi kokuba iphakethe liphume. Yiso leso sinyathelo sokuhumusha esihlula inqubomgomo buthule.
Lapho iphakethe lifika endaweni yokugcina yomhubhe, selithwele ikheli lomsingathi. Noma yimuphi umthetho, umzila wenqubomgomo noma isinqumo somhubhe ohlukanisiwe esisekelwe ekhelini lokuqala lekhontheyna awusasifanisi, futhi amakhontheyna amabili okufanele aphume ngemiphuma ehlukene awakwazi ukwehlukaniswa ngomthombo kuphela. Uma udinga umzila wekhontheyna ngayinye, isinqumo kufanele sithathwe ngaphambi kokuhumusha noma ngaphakathi kwendawo yamagama oyilawulayo.
I-Docker iyazondla ngokwayo le mithetho, ngokusebenzisa noma yikuphi ingemuva lomlilo odongeni elalilungiselelwe i-daemon. Imithetho ebhalwe ngesandla ngaphandle kwegwegwe elisekelwayo lethrafikhi edluliswayo, DOCKER-USER, ingahle ihlelwe kabusha noma ilahlwe lapho i-daemon iqala kabusha noma umsingathi uthuthukiswa. Imibhalo ye-Docker mayelana nokuhlunga amaphakethe ikhombisa ukulandelana kwamaketanga; iphuzu elisebenzayo ukuthi umthetho ngamunye udinga umnikazi nomzila wokulayisha kabusha okuwuzame ngempela.
Hlola izinhlelo ezimbili ngokwehlukana
Ubufakazi obuvela endaweni eyodwa yamagama abusho lutho ngomunye. Isicelo esigijiswe ngaphakathi kwekhontheyna ye-VPN sifakazela ukuthi umhubhe uyasebenza kuleyo khontheyna. Lokho akubona ubufakazi ngomsingathi, futhi umyalo ofanayo ogijiswe kusukela kukhontheyna ye---network host awubona ubufakazi ngobhuloho.
# host namespace
ip route get 1.1.1.1
ip -brief addr show
# a fresh container on the same bridge network
docker run --rm --network appnet alpine sh -c 'ip route; cat /etc/resolv.conf; ip -6 route'Bese uphinda isivivinyo ngaphakathi kwekhontheyna yangempela yohlelo lokusebenza hhayi kusithombe esifanayo. Uhlelo lungase luthwale umzila owengeziwe, ukuguquguquka kwemvelo kwe-proxy noma isixazululi esihlukile, futhi ngakunye kwalokho kushintsha impendulo. Hlola ukuxazululwa kwamagama kanye nomkhakha wesibili wamakheli ngaso sonke isikhathi: amakhontheyna emabhulohweni achazwe umsebenzisi axazululwa ngesixazululi esakhelwe ngaphakathi se-Docker ku-127.0.0.11, futhi umzila wokuzenzakalela we-IPv6 ebhulohweni ungakhipha ithrafikhi ngaphandle ngesikhathi umatasa uhlola umhubhe we-IPv4 kuphela.
Funda iphethini ngaphambi kokuthinta imininingwane yokufinyelela
Lapho umsingathi usebenza futhi ikhontheyna ingasebenzi, imbangela cishe njalo iwuhlelo, futhi ukushintsha okhiye noma ukufaka kabusha iklayenti kuchitha intambama. Hlela umphumela kuqala futhi ukulungiswa ngokuvamile kuzibiza ngokwako.
| What you see | Usual cause | First check |
|---|---|---|
| Host exits through the VPN, container shows the ISP address | The container never entered the tunnel | Default route inside the container |
| Container works until the daemon restarts, then stops | Rules outside the supported hook, or a changed backend | Daemon's reported firewall backend and DOCKER-USER |
| Container loses internal hosts after the tunnel comes up | VPN prefix overlaps the Docker bridge subnet | ip route on the host, then docker network inspect |
| Small replies arrive, large ones hang | Tunnel MTU or missing MSS clamping | Link MTU on both ends of the tunnel |
| Container falls back to the ISP address when the tunnel drops | Nothing enforces the kill switch for forwarded traffic | Stop the tunnel with a request in flight |
Umugqa wokugqagqana ufanele umusho wawo. Iphrofayela ye-VPN eqhubekisela phambili umzila we-172.17.0.0/16, noma we-10.0.0.0/8 eqondana ngesikhathi esithile nesijobelelo sebhuloho lakho, yenza umhubhe ufune isizinda samakhontheyna, futhi izimpendulo eziya kumakheli ahumushiwe zizohamba ngendlela engalungile noma zinyamalale. Ukuphinda unombola inethiwekhi ye-Docker ngokuvamile kuhlanzekile kunokuqongelela okuhlukile.
Yenza ukumboza kucace, bese ukwephula ngamabomu
Amadizayini amabili ayaphila ekubuyekezweni. Yabelana ngendawo yamagama yekhontheyna ye-VPN futhi umthwalo womsebenzi ngamunye ohlanganisiwe usebenzisa umhubhe owodwa onomngcele owodwa wokuqala kabusha, okuyinto elula kuze kube yilapho insiza eyodwa idinga omunye umphuma noma umzila wayo we-DNS. Noma qondisa inethiwekhi yamakhontheyna esangweni le-VPN kumsingathi: ukudlulisela kuvuliwe, isijobelelo sebhuloho sibhekiswe emhubheni, ithrafikhi ebuyayo isingathwe ngokusobala. Lokho kuthenga ukulawula ngenethiwekhi ngayinye futhi kukubiza iqoqo lemigomo okufanele uyigcine phakathi kokuthuthukiswa kwe-daemon neklayenti.
Kungakhathaliseki, isivivinyo esibalulekile yisimo sokwehluleka. Misa umhubhe ngesikhathi isicelo sekhontheyna sisendleleni bese ubheka ukuthi iphakethe liya kuphi. Uma libuyela emuva emzileni oqondile, ukumboza akuzange kuphoqelelwe, ngoba i-kill switch yeklayenti ilawula ithrafikhi yeklayenti ngokwalo hhayi amaphakethe adluliswayo avela ebhulohweni. Bese uqala kabusha i-daemon nomsingathi futhi uqinisekise umphumela okwesibili; yiso leso sikhathi lapho imithetho ebhalwe ngesandla inyamalala.
Ngaphambi kokukubiza ngokuqediwe, qinisekisa izinto ezine: ifasitela lomhubhe lisendaweni yamagama efanayo nethrafikhi, isivivinyo sekhontheyna sigijiswe ngaphakathi kwekhontheyna yangempela, ukuxazululwa kwamagama kanye nemikhakha yamakheli yomibili kwahlolwa, futhi isivivinyo sokwehluleka komhubhe sisahluleka sivaliwe. Bese ubhala phansi ingemuva lomlilo odongeni, inguqulo yeklayenti nomnikazi womthetho ngamunye. Lowo mbhalo yiwona ovimbela ukuthuthukiswa okulandelayo ekushiyeni ingxube yemibono emidala engabhalwanga.